---
id: socketsecurity
version: "2.6.4"
license: MIT License Copyright (c) 2022 Socket Inc Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in… (full text in the JSON record)
license_treatment: permissive
maintenance: active
---

# socketsecurity — Socket Security CLI for CI/CD

License: permissive · Maintenance: active · Downloads: 220.6K/mo

## What it is and what it does

Socket Security CLI is a command-line tool that scans Python projects for supply-chain security issues—vulnerabilities, policy violations, and license risks—and reports results in multiple formats. It integrates directly into CI/CD pipelines to gate deployments based on security findings, with support for diff-based PR scanning, full-scope analysis, and reachability-aware filtering to reduce noise.

The tool connects to Socket's backend service via API token and can export findings as SARIF (for GitHub, GitLab, and other platforms), JSON reports, SBOMs, and legal/compliance artifacts. It supports both simple policy enforcement (exit on blocking issues) and detailed investigation workflows (full-scope SARIF with instance-level detail). Configuration is flexible—via CLI flags, environment variables, or TOML/JSON config files—and includes presets for common scenarios like legal compliance and FOSSA compatibility.

Use it for:

- Gate pull requests in CI/CD by scanning diffs against a baseline commit and blocking merges if new security issues are found.
- Generate SARIF reports for GitHub Advanced Security, GitLab Dependency Scanning, or other security dashboards.
- Export legal/compliance artifacts (SBOM, license inventory) in standard or FOSSA-compatible formats for audit trails.
- Analyze reachability of vulnerabilities to prioritize fixes based on whether issues are actually used in your code.
- Enforce supply-chain security policies across teams by running scans on every commit to the default branch.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Socket Security CLI scans Python projects for supply-chain security risks, generates SARIF reports, and integrates with CI/CD pipelines to enforce security policies.

Yes, if you need supply-chain security scanning in CI/CD. The tool is actively maintained, has low install friction, and integrates well with common platforms (GitHub, GitLab, Buildkite, Bitbucket). Requires Python 3.11+ and a Socket Security API token. No known vulnerabilities. MIT license is permissive. Start with a basic policy scan or SARIF export to evaluate fit.

## Install

pip install socketsecurity
uv add socketsecurity
poetry add socketsecurity

## Installing socketsecurity

Before you install: Low install friction with a pure-Python wheel. Active maintenance with a release 2 days old. Requires Python 3.11 or later and 11 runtime dependencies including requests, beautifulsoup4, and gitpython.

License in practice: MIT License permits free use, modification, and redistribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart:

pip install socketsecurity
export SOCKET_SECURITY_API_TOKEN="your-token"
socketcli --target-path .

Requires Python 3.11 or later and a valid Socket Security API token set via SOCKET_SECURITY_API_TOKEN environment variable.

Verify before relying:

- Whether the CLI's exit codes (0, 1, 2, 3) and blocking behavior match your CI/CD platform's expectations.
- Whether the package's reachability analysis covers all dependency types in your project (transitive, optional, dev).
- Whether SARIF output is compatible with your security scanning dashboard or SIEM integration.

## Package facts

- License: MIT License Copyright (c) 2022 Socket Inc Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in… (full text in the JSON record) (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 220.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

python supply chain security scanning, dependency vulnerability scanning cli, sarif security report generation, ci/cd security policy enforcement, software composition analysis, reachability analysis security, gitlab security scanning integration, supply-chain-security, ci-cd-integration, sarif-export

[View on SkillFed](https://skillfed.io/packages/socketsecurity) · [View on PyPI](https://pypi.org/project/socketsecurity/)