Vexcalibur
Vexcalibur helps security and release engineers generate Vulnerability Exploitability eXchange (VEX) documents from software bills of materials (SBOMs) and vulnerability findings. Use it from the command line, Python, or your CI pipeline.
Documentation | Quickstart | Python API | Releases
Install
Vexcalibur supports Python 3.10 through 3.14. With uv:
uv tool install vexcalibur
vexcalibur --help
Or use pip in a virtual environment on Linux or macOS:
python3 -m venv .venv
source .venv/bin/activate
pip install vexcalibur
vexcalibur --help
The help output lists the available commands. See the installation guide for Windows setup, PATH troubleshooting, and version pinning. Pin an exact release in automation so upgrades are deliberate.
Generate a VEX document
With your own SBOM and a local findings file, replace the input paths below:
vexcalibur generate sbom.json \
--offline \
--findings-file findings.json \
--output vex.json
This writes CycloneDX VEX to vex.json without contacting a vulnerability service. For a guided example with sample inputs, follow the quickstart.
Vexcalibur reads CycloneDX JSON/XML, SPDX 2.3 JSON, and SPDX 3 JSON-LD SBOM files, or fetches an SBOM from GitHub. It generates CycloneDX, OpenVEX, CSAF, and SPDX 3 VEX documents. The generation guides explain the inputs and metadata each format needs.
Findings can also come from an OSV-compatible service. Public OSV requires explicit --allow-public-osv consent, which sends package URLs and versions to https://api.osv.dev. Fetching an SBOM from GitHub does not grant that consent. See the finding-source options before using a network provider with private inventory.
Integrations
The compatibility policy defines the CLI, API, and output contracts. For machine-readable run results, see execution reports.
Contributing and support
Read CONTRIBUTING.md for development setup and checks. Use the issue forms for questions and bug reports; report vulnerabilities through the security policy.
Licensed under Apache License 2.0.
1 maintainer
Metadata
1 maintainer
Release files for vexcalibur 1.1.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| vexcalibur-1.1.1.tar.gz | 1.2 MB | With provenance | Details for vexcalibur-1.1.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| vexcalibur-1.1.1-py3-none-any.whl | Python 3 | none | any | Details for vexcalibur-1.1.1-py3-none-any.whl |
Total release size: 1.4 MB
Release files / vexcalibur-1.1.1.tar.gz
| Download URL | vexcalibur-1.1.1.tar.gz |
|---|---|
| Size | 1.2 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
6dba9f2a83718582e373022c2da21ce605e21fb92905f31ff641ede6158ebd44
|
|
BLAKE2b-256 checksum How to use checksums |
0c224a7de67f323b4ffc555229aab8aaf33caa23cb85211ea60aeb8bd21ae8dc
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 5, 2026.
Transparency logRelease files / vexcalibur-1.1.1-py3-none-any.whl
| Download URL | vexcalibur-1.1.1-py3-none-any.whl |
|---|---|
| Size | 125.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
308089b213503cb385d5877ce79f82d8d243f739dcdfb3543fae1adb66c4076b
|
|
BLAKE2b-256 checksum How to use checksums |
dc680c4c1a4be2776ed57029874a197a9c38889892826f1dbf62a7deb3cd4016
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 5, 2026.
Transparency logSecurity for vexcalibur 1.1.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
Both files in this release have been uploaded with provenance metadata.
Attestation for vexcalibur-1.1.1.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Nov 5, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
