---
id: socketdev
version: "3.5.0"
license: MIT License Copyright (c) 2025 Socket Inc. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal… (full text in the JSON record)
license_treatment: permissive
maintenance: active
---

# socketdev — Socket Security Python SDK

License: permissive · Maintenance: active · Downloads: 238.2K/mo

## What it is and what it does

The Socket.dev Python SDK is a lightweight wrapper around the Socket.dev REST API that lets you query package metadata, security scores, and license information directly from Python. It handles authentication, request formatting, and response parsing so you don't have to build HTTP calls manually. The SDK supports querying packages by PURL (Package URL), running full scans on manifest files, and exporting SBOMs in multiple formats (CycloneDX, SPDX, OpenVEX).

You initialize it with an API token and optional timeout, then call methods like `purl.post()` to look up package details, `fullscans.post()` to analyze a set of manifest files, or `export.cdx_bom()` to convert scan results into standard SBOM formats. It depends only on requests for HTTP calls and typing-extensions for type hints, making it straightforward to integrate into existing Python projects.

Use it for:

- Query package metadata and security scores for dependencies in your codebase by PURL.
- Automate full scans of manifest files (package.json, requirements.txt, etc.) as part of CI/CD pipelines.
- Export SBOMs in CycloneDX or SPDX format for compliance and supply-chain visibility.
- Retrieve vulnerability and license alerts for a set of components to inform security decisions.
- Integrate Socket.dev security checks into custom tooling or dashboards.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

A Python SDK that wraps the Socket.dev REST API, enabling programmatic access to package security analysis, SBOM export, and full-scan operations from Python code.

Yes. The SDK is actively maintained, has no known vulnerabilities, installs with minimal friction, and is licensed permissively under MIT. Install it if you need programmatic access to Socket.dev's package security API from Python; skip it if you only need one-off lookups via the web UI.

## Install

pip install socketdev
uv add socketdev
poetry add socketdev

## Installing socketdev

Before you install: Low friction: pure Python wheel with only two runtime dependencies (requests and typing-extensions). Active maintenance with a release 8 days ago; repo shows recent commits and is not archived.

License in practice: MIT License permits free use, modification, and distribution with minimal restrictions—suitable for commercial and open-source projects alike.

Quickstart:

pip install socketdev

from socketdev import socketdev
socket = socketdev(token="YOUR_API_KEY")
result = socket.purl.post("true", [{"purl": "pkg:pypi/requests"}])

Requires a valid Socket.dev API token; unauthenticated calls will fail.

Verify before relying:

- Whether the SDK supports all current Socket.dev API endpoints or only a subset of v0.
- Rate limiting behavior and retry logic when making API calls.
- Whether SSL verification can be disabled safely in production contexts beyond testing.

## Package facts

- License: MIT License Copyright (c) 2025 Socket Inc. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal… (full text in the JSON record) (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 238.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

socket.dev api client, python sdk socket security, sbom export python, package vulnerability scanning, supply chain security api, purl package lookup, cyclonedx spdx export, supply-chain-security, sbom, api-client

[View on SkillFed](https://skillfed.io/packages/socketdev) · [View on PyPI](https://pypi.org/project/socketdev/)