Kevlar-CheckDeps
View on GitHub
⚡ Python Ecosystem SCA CLI

Python Dependency Audit CLI: Fast, Zero-Dependency SCA for PyPI

Audit direct and transitive dependencies in Python projects, detect vulnerabilities in the Google OSV database, and validate lockfile integrity—without external packages or API keys.

$ python kevlar.py --tech python --path ./my-python-app --all --vuls
PyPI (`requirements.txt`) Poetry (`poetry.lock`) Pipenv (`Pipfile.lock`) PEP 621 (`pyproject.toml`)
bash - kevlar-checkdeps (python)
user@devsecops ~/my-python-app
$ python kevlar.py --tech python --path . --all --vuls
[INFO] Detected Ecosystem: Python (PyPI)
[INFO] Parsing requirements.txt & poetry.lock...
[INFO] Checking 86 packages against Google OSV DB...
[INFO] Validating SHA-256 package checksums...
[ALERT] Checked: 86 packages in 0.95s.
Vulnerabilities: 2 (1 Critical, 1 High).
Status: ❌ FAIL (Threshold Breach)

The Problem with Traditional SCA Tools in Python

Why do tools like Safety or `pip-audit` introduce friction into the DevSecOps workflow?

Traditional Tools

(Safety CLI / pip-audit)
Limitations

  • Heavy PyPI Installation Overhead

    Requires installing complex PyPI packages and C-extensions into virtualenvs just to run security scans.

  • Mandatory SaaS Subscriptions & Tokens

    Commercial tools enforce paid API tokens, SaaS registration, and manifest uploads to external servers.

  • Limited Multi-Manager Parsing

    Struggles with unified auditing across Poetry, Pipenv, and requirements.txt in monorepos.

Kevlar-CheckDeps

(Python Audit)
Solution

  • Zero External PyPI Dependencies

    Executes strictly on Python 3.11+ standard library. Zero pip packages required.

  • Direct Batch Queries to Google OSV DB

    Sends POST batch requests (/v1/querybatch) for up to 1,000 Python packages without API keys.

  • Unified Poetry, Pipenv & PyPI Parsing

    Natively parses requirements.txt, poetry.lock, Pipfile.lock, and pyproject.toml.

Quick Usage Guide & Practical Example

How to run local scans, export executable reports, and integrate Kevlar into your CI/CD pipeline.

Full Local Scan

Audit direct and transitive Python dependencies querying Google OSV DB:

Scan Command:
$ python kevlar.py --tech python --path ./ --all --vuls

Export HTML / SARIF

Generate interactive HTML dashboards or standard SARIF v2.1.0 reports:

Report HTML:
$ python kevlar.py --tech python --path ./ --all --vuls --output report.html
Report SARIF:
$ python kevlar.py --tech python --path ./ --all --vuls --output report.sarif

CI/CD Build Breaking

Fail CI/CD pipelines automatically if severe vulnerabilities are detected:

Pipeline Command:
$ python kevlar.py --tech python --path ./ --all --vuls --fail-on-vulns "critical:1,high:2"

Quick Comparison Matrix

Compare Kevlar-CheckDeps with common alternatives in the Python ecosystem.

Feature / Criterion
Kevlar-CheckDeps
Featured
pip-audit Safety CLI Bandit
Execution Speed
⚡
Ultra-fast (Multi-threaded & OSV Batch)
Medium PyPI HTTP Queries Slow Safety SaaS API Fast (AST Only) No CVE DB Lookup
External Dependencies
Zero (Python 3.11+ Std Lib)
Requires PyPI Install Requires Safety PyPI Package Requires Bandit PyPI Package
API Keys / Accounts
Not Required (Public Google OSV)
Not Required
Mandatory (Safety Key)
Not Required
Code & Manifest Privacy
100% Local Execution
Local PyPI Queries Manifests Sent to SaaS 100% Local AST Analysis
Lockfile Checksum Audit
Yes (SHA-256 Checksums)
No No No
Cost & License
Free & Open Source (Apache 2.0 License)
Free & Open Source (MIT) Freemium / Commercial Free & Open Source (Apache 2.0)

Frequently Asked Questions (FAQ)

Quick answers to common questions about Python dependency auditing.