spot-sdk-python

The SDK for writing plugins of SPOT, the Spear-Phishing Overwatching Tool: analyzers, context providers, mail retrievers and responders.

SPOT runs each plugin as a container and calls its /internal/* routes with the plugin's own token. This package holds what SPOT's core and its plugins share:

• the contract (Pydantic models): the email view, verdicts and signals, workflow policies, results, and the plugin manifest with its OCI labels;
• the parser core runs on every message at intake (spot_sdk.mime.parse), bounded against hostile input, which records what mail clients may read differently as anomalies;
• the plugin runtime: create_plugin_app builds the FastAPI app with the routes core calls, token-checked; PluginSettings reads the token and secrets from /run/secrets and the settings from the environment;
• the clients: SpotClient (ingest, message content, results), KnowledgeClient (the Knowledge Store) and LLMClient (OpenAI-compatible chat models, with the email kept apart from the instructions as untrusted data);
• test helpers: view_from_eml, make_view, FakeSpot, FakeKnowledgeClient, FakeLLM and assert_contract.

Install

pip install spot-sdk-python==2.0.0

Python 3.11 to 3.15. Version 2 implements plugin contract 2, for SPOT 2.0.

An analyzer

from spot_sdk import (
    AnalyzerVerdict,
    AnalyzeRequest,
    Egress,
    Manifest,
    PluginKind,
    PluginSettings,
    Signal,
    VerdictClass,
    create_plugin_app,
)
from spot_sdk.signals import AUTH_DMARC_FAIL

MANIFEST = Manifest(
    id="analyzer-dmarc",
    version="1.0.0",
    kind=PluginKind.ANALYZER,
    egress=Egress.NONE,
)


def analyze(request: AnalyzeRequest, settings: PluginSettings) -> AnalyzerVerdict:
    failed = [
        result
        for result in request.email.authentication
        if result.method == "dmarc" and result.result == "fail"
    ]
    if not failed:
        return AnalyzerVerdict(verdict=VerdictClass.BENIGN, score=10, confidence=60)
    return AnalyzerVerdict(
        verdict=VerdictClass.SUSPICIOUS,
        score=70,
        confidence=80,
        signals=[Signal(name=AUTH_DMARC_FAIL, weight=60, evidence="dmarc=fail")],
    )


app = create_plugin_app(MANIFEST, PluginSettings, analyze=analyze)

Serve it with uvicorn analyzer_dmarc:app --host 0.0.0.0 --port 8000, and test it with spot_sdk.testing.assert_contract(app, "tests/phish.eml", token=...).

Documentation

• Documentation: the contract, writing each kind of plugin, the reference.
• Migrating from 1.x: every removed name and its replacement. SDK 2 has no compatibility with contract 1.
• Source and changelog.

License

Apache License 2.0.