pypa/pip-audit

Health v2 · maintenance only

Adoption not part of the score

1354 stars · 124 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

pip-audit is a command-line tool that scans Python environments, requirements files, and dependency trees for packages with known security vulnerabilities, using the PyPI JSON API and OSV as vulnerability data sources. It can also emit CycloneDX SBOMs and automatically fix vulnerable dependencies with the --fix flag.

Use cases

• scan my python environment for vulnerable packages
• audit requirements.txt for known CVEs
• generate a CycloneDX SBOM for my python project
• automatically upgrade dependencies with security vulnerabilities
• run a dependency security check in CI
• check pip installed packages against OSV database

When to choose

• you need to audit Python dependencies for known vulnerabilities locally or in CI
• you want SBOM generation in CycloneDX format
• you want automatic remediation of vulnerable pinned dependencies
• you need machine-readable output (JSON) for security pipelines

When to avoid

• you need to audit non-Python ecosystems like npm or cargo
• you need continuous runtime monitoring rather than point-in-time scanning
• you require an air-gapped scanner without access to PyPI or OSV services

Facets

cli-tool · maturity active

security vulnerability-scanning dependency-audit cli developer-tools security developer-tools cli python cross-platform pip vulnerability-scanning sbom cyclonedx supply-chain-security ci-cd python supply-chain

Member repositories

For agents

markdown · JSON · MCP: product_card(name="pypa/pip-audit")