ANY.RUN SDK
This is the official Python client library for ANY.RUN, supporting the cybersecurity solutions like the Interactive Sandbox, TI Lookup, and TI Feeds.
With this library you can interact with the ANY.RUN REST API and automate your workflow quickly and efficiently.
Available features
- Built-in objects iterator and exception handling
- Synchronous and asynchronous interface
- Python 3.5-3.13 support
Sandbox API
ANY.RUN Sandbox is an online interactive sandbox for malware analysis, a tool for detection, monitoring, and research of cyber threats in real time.
- Submit files and URLs for analysis
- Monitor analysis progress in real-time
- Get detailed reports
- Manage the tasks
TI Lookup API and YARA Search
TI Lookup is a searchable database of IOCs, IOAs, IOBs, and events for threat hunting and a service for browsing malicious files by their content. Perform deep searches, look up threats online, and enrich your security solutions.
- Look up URLs and file hashes
- Search for IOCs using YARA rules
- Get threat intelligence data
- Monitor search progress in real time
- Get detailed analysis results
TI Feeds API
Threat Intelligence Feeds provide data on the known indicators of compromise: malicious IPs, URLs, Domains Supports the TAXII STIX feed format.
Note:
You can access ANY.RUN services using an API key without a prefix. Legacy access methods are supported for backward compatibility but will be removed in future releases.
API key format: WmNfqnpo...2Sjon7mtvm8e
The library public interface overview
import os
from anyrun.connectors import SandboxConnector
def main():
with SandboxConnector.android(api_key) as connector:
# Initialize the url analysis
analysis_id = connector.run_url_analysis('https://any.run')
print(f'Analysis successfully initialized. Analysis uuid: {analysis_id}')
# View analysis status in real time
for status in connector.get_task_status(analysis_id):
print(status)
# Get analysis verdict
verdict = connector.get_analysis_verdict(analysis_id)
if verdict in ('Suspicious', 'Malicious'):
# Get analysis report
connector.get_analysis_report(analysis_id, report_format='html', filepath='.')
# Remove the analysis from history
connector.delete_task(analysis_id)
if __name__ == '__main__':
# Setup ANY.RUN api key
api_key = os.getenv('ANY_RUN_Sandbox_API_KEY')
main()
You can find additional usage examples here
Installation Guide
You can install the SDK using pip or any other package manager
$ pip install anyrun-sdk
Also, you can install the SDK manually using pyproject.toml
$ git clone git@github.com:anyrun/anyrun-sdk.git
$ cd anyrun-sdk
$ python -m pip install .
Contributing
We welcome contributions! Please see our Contributing Guide for details.
Useful links
Sandbox API documentation
TI Lookup API documentation
TI Feeds API documentation
Contact us
Sales, demo and trial inquiries - sales@any.run
Technical support - techsupport@any.run
Public relations and partnerships – pr@any.run
1 maintainer
Release files for anyrun-sdk 1.14.17
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| anyrun_sdk-1.14.17.tar.gz | 35.9 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| anyrun_sdk-1.14.17-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 90.2 kB
Release files / anyrun_sdk-1.14.17.tar.gz
| Download URL | anyrun_sdk-1.14.17.tar.gz |
|---|---|
| Size | 35.9 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7eed56cc68af97dd651856dd33c8d8edf244166ffd4cc2d54b2780f9a3d68b99
|
|
BLAKE2b-256 checksum How to use checksums |
a7586a7dd69aa32496272f817b7ceebadf855664420b72375baecc1ba41cc612
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 27, 2026.
Transparency logRelease files / anyrun_sdk-1.14.17-py3-none-any.whl
| Download URL | anyrun_sdk-1.14.17-py3-none-any.whl |
|---|---|
| Size | 54.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
19d4fe9120c1a023e0831afda5fb94e16c0a6e5ca637fc3b7179c00ff6d46846
|
|
BLAKE2b-256 checksum How to use checksums |
a82009e7d49ede478f4c1ef0020b2e48460b0a48e5c8dade03fd00f8114e9732
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Aug 27, 2026.
Transparency log
