PySentry

Fast, reliable vulnerability scanning for Python dependencies.

Documentation · Benchmarks · Help test & improve · Usage survey

PySentry audits Python projects for known security vulnerabilities. It reads your lock file or manifest, resolves the full dependency tree, and checks every package against three vulnerability databases — then reports what is affected, how severe it is, and the upgrade that fixes it.

Features

• Every dependency format — uv.lock, poetry.lock, Pipfile.lock, pylock.toml, pyproject.toml, Pipfile, requirements.txt, and PEP 723 inline script metadata. Lock files take precedence when both are present.
• Three databases, one report — PyPA Advisory Database, PyPI JSON API, and OSV.dev, queried concurrently with results merged and de-duplicated.
• Tree-aware findings — distinguishes direct from transitive dependencies and names the top-level package that pulls a vulnerable one in.
• PEP 792 lifecycle checks — flags archived, deprecated, and quarantined packages; --forbid-quarantined turns known malware into a failing build.
• Built for CI — human, JSON, SARIF, and Markdown output; --fail-on sets the exit threshold without hiding lower-severity findings.
• Fast — a Rust core with async fetching and local caching. See the benchmarks.

Used by

PySentry runs in CI pipelines at Genkit (Google), OVD-Info, activist.org, and To Be Precise, among others.

Installation

# Run without installing (recommended)
uvx pysentry-rs

# Or install permanently
pip install pysentry-rs    # PyPI
cargo install pysentry     # crates.io

Pre-built binaries are attached to GitHub Releases. See the installation guide for all options.

Naming: the Python package installs the binary as pysentry-rs; the Rust crate and release binaries are plain pysentry. Examples below use pysentry-rs — substitute accordingly.

Quick start

# Scan the current directory
pysentry-rs

# Scan another project
pysentry-rs /path/to/project

# Report only high and critical findings
pysentry-rs --severity high

# Exit non-zero only for critical findings
pysentry-rs --fail-on critical

# Write a SARIF report for GitHub code scanning
pysentry-rs --format sarif --output results.sarif

# Refuse quarantined (malicious) packages
pysentry-rs --forbid-quarantined

More examples in the quickstart guide.

Pre-commit

repos:
  - repo: https://github.com/pysentry/pysentry-pre-commit
    rev: v0.4.9
    hooks:
      - id: pysentry
        # args: ['--compact']  # terser output for hook runs

CI

The GitHub Action downloads a checksum-verified binary, audits the project, and uploads a SARIF report to GitHub Code Scanning:

permissions:
  security-events: write # for the SARIF upload

steps:
  - uses: actions/checkout@v4
  - uses: nyudenkov/pysentry@v0.4.9
    with:
      fail-on: high

On any other CI system, pysentry-rs --fail-on high exits non-zero when findings reach the threshold. Details in the CI guide.

Configuration

Project defaults live in .pysentry.toml or pyproject.toml; CLI flags always take precedence:

version = 1

[defaults]
severity = "medium"
fail_on = "high"

[sources]
enabled = ["pypa", "osv"]

[ignore]
ids = ["CVE-2023-12345"]

All options are covered in the configuration guide.

Documentation

Full documentation lives at docs.pysentry.com: Installation · Quickstart · CLI options · Configuration files · Environment variables · Troubleshooting

Requirements

• Python 3.9–3.14 for the PyPI package
• Rust 1.79+ only for cargo install or building from source
• uv (recommended) or pip-tools for scanning manifests without a lock file (requirements.txt, pyproject.toml, Pipfile) — auditing lock files needs no external tools

Feedback

Bug reports and feature requests are welcome on the issue tracker; a couple of minutes on the usage survey helps shape the roadmap. For anything else, reach out at nikita@pysentry.com.

If PySentry saves you time, consider sponsoring on GitHub or buying me a coffee.

Acknowledgments

Inspired by pip-audit and uv #9189. Vulnerability data comes from PyPA, PyPI, and OSV.dev.

License

MIT