api - Official Python SDK for the Vulners vulnerability-

项目说明

<di="center">

🛡️ Python SDK

The official Python client for — the intelligence graph to build on

Query CVEs, exploits and ad enriched with CVSS, EPSS and exploitation status; assess your
software, hosts and SBOMs for the that affect them; and stream the whole graph for
your own pipelines — all from a few lines of typed, async-ready Python.

![PyPI ]()
![Python ]()
![Downloads]()
![CI]()
![Typed]()

SDK documentation ·
Data models ·
Get an API key ·
.com

</div>

---

Why ?

aggregates 230+ sources — CVEs, exploits, ad,
CISA KEV, EPSS and AI risk scores — into one queryable ce graph, so you can
prioritize what to fix beyond raw CVSS. It is API-first and needs no agents or network access:
send asset data in standard formats, get back risk-prioritized intelligence.

This SDK is the fastest way to build on that graph from Python:

---

Installation

Requires Python 3.10+. A plain pip install pulls e needed for fast, modern
transport — httpx, pydantic and
orjson, plus HTTP/2 (h2), response compression
(brotli/zstandard), ISA-L-accelerated gzip (isal) and streaming archi
(ijson/stream-unzip) — all with prebuilt wheels, so there is no build step.

From a branch checkout (unreleased)

The latest pre-release lives on the v4.0 branch (not yet on PyPI). Check the branch out
and install it from source:

Or install that branch directly, without cloning:

---

Quickstart

> Tip: keep your key out of source code — read it from the en:
>

Async

The same API is a on Async:

---

Usage examples

Runnable scripts for every task li
samples/ — a v4 set and a matching
v3 (legacy) set, side by side.

Find public exploits for a CVE

Audit installed software for known CVEs

Audit a Linux host by installed packages

Look up a package's license

Stream the archi, without buffering gigabytes)

Handle errors

---

Data models

Every document the API returns is a bulletin, and the SDK models them in three typed layers,
so your editor and type checker know the exact shape at whate of detail you need:

search/archive/audit return the most specific model that fits a document (type →
bulletinFamily → Bulletin). Every field is optional (a missing one is None) and every model
keeps extra="allow", so a field the API adds before the SDK models it is still on the object —
nothing is e.

The full hierarchy — every family and collection with its fields, descriptions and examples,
generated from live data — is browsable in the
Data models reference.

---

Proxies

Route traffic through a proxy with proxy=, or let the client pick up the standard proxy
en :

En proxies are used when you don't pass proxy= and leave trust_env=True (the
default). See
Proxies, timeouts & retries
for authenticated proxies and combining a proxy with custom TLS.

---

AI agents (MCP)

Ship li intelligence to AI agents and copilots via the built-in
Model Context Protocol server:

It exposes concise, typed tools — search bulletins, look up a CVE, find exploits, and audit
software/Linux/hosts — that any MCP-compatible client (Claude, IDE agents, …) can call. See
AGENTS.md.

> Hosted . For a fully managed, always-on endpoint, use the official hosted
> server at < — no install required. The shipped
> in this package is a minimal, self-hosted implementation (a core set of tools) for
> embedding in your own en.

---

Backward compatibility

Upgrading from 3.x is a drop-in. The entire v3 API — , , every method,
and all import paths — is preser in 4.0:

New code should prefer the / Async clients abo at your own pace — see
the migration guide.

---

Getting an API key

1. Create a free account at .com.
2. Follow the authentication guide
to generate a key.
3. Pass it to (api_key=...), or export and let the client read it.

Ne your API key. The SDK authenticates with the X-Api-Key header; a few legacy
endpoints additionally send the key where the ser it — in the request body (the
subscription and webhook mutations and win_audit) or the query string (webhooks.read()). On
every request it strips the key on cross-origin redirects, refuses redirects to internal
addresses, and keeps it out of exception messages and object reprs.

---

Documentation

| Resource | Link |
|---|---|
| 📘 SDK documentation | |
| 🧬 Data models (bulletin hierarchy) | |
| 🔌 SDK API reference (clients, resources, exceptions) | |
| 🧭 Migration (v3 → v4) | |
| 📖 platform docs | |
| 🧪 Interactive API (Swagger) | |
| 🔑 Authentication / API keys | |
| 💡 Examples | samples/ |
| 🤝 Contributing | CONTRIBUTING.md |
| 🔒 Security policy | SECURITY.md |

---

Compatibility

---

Contributing

Issues and pull requests are welcome! Please open an issue to discuss substantial changes first.
The project uses uv:

See CONTRIBUTING.md for the
full workflow.

---

Security

Found a security issue in the SDK? Please report it pri — see
SECURITY.md. Do not open a public
issue for .

---

License

Distributed under the MIT License. See
LICENSE.

---

<di="center">

Built by the team.
If this SDK helps secure your stack, please ⭐ the repo — it helps others find it.

_{Keywords: intelligence · CVE · exploit intelligence · CVSS · EPSS · CISA KEV ·
risk prioritization · security ad · SBOM · assessment · scanner ·
threat intelligence · database · AI security agents · MCP · MSSP · De ·
Python security · infosec}

</div>

项目信息

开发语言：Python

Star 数：375

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Official Python SDK for the Vulners vulnerability-intelligence API — search CVEs, exploits and advisories (CVSS/EPSS/KEV), audit software, Linux/Windows hosts and SBOMs, and stream the whole graph. Typed sync + async clients, 100% v3-compatible, with a built-in MCP server for AI agents.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。