docker-scout-graphql 0.2.0

CLI for querying Docker Scout GraphQL vulnerabilities for Docker images.

docker-scout-graphql

docker-scout-graphql scans Docker images by:

1. Extracting package dependencies from docker sbom --format syft-json.
2. Converting package URLs into the format expected by Docker Scout's GraphQL backend.
3. Querying https://api.dso.docker.com/v1/graphql.
4. Returning vulnerabilities separated by image layer hierarchy.

It can scan one image or all local images.

Install

pip install .

For development mode:

pip install -e .

Usage

Scan one image and print JSON (default):

docker-scout-graphql debian:12-slim

Scan one image and write JSON report:

docker-scout-graphql debian:12-slim -o report.json

Scan all local images and write JSON:

docker-scout-graphql --all-images -o report.json

Markdown output (optional):

docker-scout-graphql debian:12-slim --markdown -o report.md

Output

Default output is JSON with this top-level shape:

{
  "schema_version": "1.0",
  "generated_at_utc": "2026-02-27T02:17:14.428185+00:00",
  "images_scanned": 1,
  "images": []
}

Each images[] entry contains:

• overall counts (queried_packages, vulnerable_packages_count, vulnerability_count)
• raw vulnerable package records (packages)
• layered hierarchy (image_hierarchy.layers) with vulnerable packages grouped by image layer

Release

For TestPyPI/PyPI publishing steps, see PYPI_RELEASE.md. You can also use the helper script:

.\scripts\publish.ps1 -TestPyPI
.\scripts\publish.ps1