DepWarden for Python

The depwarden-cli PyPI package is a zero-dependency CLI (Python standard library only) that reads your lockfile, resolves the dependency graph, and streams results back from the API. It supports requirements.txt, Poetry, Pipenv and uv.

Prerequisites

Python ≥ 3.8

Install and run

1. Install

pip install depwarden-cli

2. Set your API key

export APP_API_KEY=dw_xxxxxxxxxxxxxx

3. Run a scan

depwarden

# Specify a lockfile if auto-detection fails:
depwarden --manifest-file poetry.lock

4. Add to a tox / CI step

pip install depwarden-cli
depwarden --formats html,pdf --fail-on-error true

Configuration

--api-key / APP_API_KEY — Your DepWarden API key. Use DEMO for three free full-fidelity scans.
--project (default my-project) — Project name sent to DepWarden — pass this explicitly.
--fail-on-error (default true) — Exit 1 when the server-side gate result is "fail". Pass false to run advisory-only and never block the build.
--formats (default html) — Comma-separated report formats: html, pdf, xlsx, json, csv.
--manifest-file — Path to a specific lockfile. Auto-detected (requirements.txt, poetry.lock, Pipfile.lock, uv.lock, then pyproject.toml, in that order) if omitted.
--out (default depwarden-reports) — Directory where reports are written.
--verify-signature — Verify the returned verdict's signature server-side before trusting it.
--api-url (default https://depwarden.in) — Override API base URL for self-hosted deployments.

Failing the build

The CLI follows the server-side gate verdict (driven by your workspace's Policy rules) rather than a client-side severity threshold: it exits 1 when the gate result is "fail". Pass --fail-on-error false to run advisory-only and never block the build.

Report formats

HTML (default)
PDF
Excel (XLSX)
JSON (CycloneDX SBOM)
CSV

Every scan can also export a CycloneDX SBOM.