socketsecurity

What it is and what it does

Socket Security CLI is a command-line tool that scans Python projects for supply-chain security issues—vulnerabilities, policy violations, and license risks—and reports results in multiple formats. It integrates directly into CI/CD pipelines to gate deployments based on security findings, with support for diff-based PR scanning, full-scope analysis, and reachability-aware filtering to reduce noise.

The tool connects to Socket's backend service via API token and can export findings as SARIF (for GitHub, GitLab, and other platforms), JSON reports, SBOMs, and legal/compliance artifacts. It supports both simple policy enforcement (exit on blocking issues) and detailed investigation workflows (full-scope SARIF with instance-level detail). Configuration is flexible—via CLI flags, environment variables, or TOML/JSON config files—and includes presets for common scenarios like legal compliance and FOSSA compatibility.

Use it for:

• Gate pull requests in CI/CD by scanning diffs against a baseline commit and blocking merges if new security issues are found.
• Generate SARIF reports for GitHub Advanced Security, GitLab Dependency Scanning, or other security dashboards.
• Export legal/compliance artifacts (SBOM, license inventory) in standard or FOSSA-compatible formats for audit trails.
• Analyze reachability of vulnerabilities to prioritize fixes based on whether issues are actually used in your code.
• Enforce supply-chain security policies across teams by running scans on every commit to the default branch.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Socket Security CLI scans Python projects for supply-chain security risks, generates SARIF reports, and integrates with CI/CD pipelines to enforce security policies.

Yes, if you need supply-chain security scanning in CI/CD. The tool is actively maintained, has low install friction, and integrates well with common platforms (GitHub, GitLab, Buildkite, Bitbucket). Requires Python 3.11+ and a Socket Security API token. No known vulnerabilities. MIT license is permissive. Start with a basic policy scan or SARIF export to evaluate fit.

Install

socketsecurity on PyPI

pip install socketsecurity

uv add socketsecurity

poetry add socketsecurity

Installing socketsecurity

Before you install

Low install friction with a pure-Python wheel. Active maintenance with a release 2 days old. Requires Python 3.11 or later and 11 runtime dependencies including requests, beautifulsoup4, and gitpython.

License in practice

MIT License permits free use, modification, and redistribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart

pip install socketsecurity
export SOCKET_SECURITY_API_TOKEN="your-token"
socketcli --target-path .

Requires Python 3.11 or later and a valid Socket Security API token set via SOCKET_SECURITY_API_TOKEN environment variable.

Verify before relying

• Whether the CLI's exit codes (0, 1, 2, 3) and blocking behavior match your CI/CD platform's expectations.
• Whether the package's reachability analysis covers all dependency types in your project (transitive, optional, dev).
• Whether SARIF output is compatible with your security scanning dashboard or SIEM integration.

Package facts

Evidence: socketsecurity-2.6.4-py3-none-any.whl

Keywords: oss, sca, security, socket.dev, socketsecurity

Tags

More Quality Assurance packages