Vexcalibur
Vexcalibur helps security and release engineers generate Vulnerability Exploitability eXchange (VEX) documents from software bills of materials (SBOMs) and vulnerability findings. Use it from the command line, Python, or your CI pipeline.
Documentation | Quickstart | Python API | Releases
Install
Vexcalibur supports Python 3.10 through 3.14. With uv:
uv tool install vexcalibur
vexcalibur --help
Or use pip in a virtual environment on Linux or macOS:
python3 -m venv .venv
source .venv/bin/activate
pip install vexcalibur
vexcalibur --help
The help output lists the available commands. See the installation guide for Windows setup, PATH troubleshooting, and version pinning. Pin an exact release in automation so upgrades are deliberate.
Generate a VEX document
With your own SBOM and a local findings file, replace the input paths below:
vexcalibur generate sbom.json \
--offline \
--findings-file findings.json \
--output vex.json
This writes CycloneDX VEX to vex.json without contacting a vulnerability service. For a guided example with sample inputs, follow the quickstart.
Vexcalibur reads CycloneDX and SPDX 3 SBOM files, or fetches an SBOM from GitHub. It generates CycloneDX, OpenVEX, CSAF, and SPDX 3 VEX documents. The generation guides explain the inputs and metadata each format needs.
Findings can also come from an OSV-compatible service. Public OSV requires explicit --allow-public-osv consent, which sends package URLs and versions to https://api.osv.dev. Fetching an SBOM from GitHub does not grant that consent. See the finding-source options before using a network provider with private inventory.
Integrations
The compatibility policy defines the CLI, API, and output contracts. For machine-readable run results, see execution reports.
Contributing and support
Read CONTRIBUTING.md for development setup and checks. Use the issue forms for questions and bug reports; report vulnerabilities through the security policy.
Licensed under Apache License 2.0.
1 maintainer
Metadata
1 maintainer
Release files for vexcalibur 1.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| vexcalibur-1.1.0.tar.gz | 1.2 MB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| vexcalibur-1.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 1.4 MB
Release files / vexcalibur-1.1.0.tar.gz
| Download URL | vexcalibur-1.1.0.tar.gz |
|---|---|
| Size | 1.2 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b27c7cdccf7550b01a5ef09450ad407d6829948219553e0cac5338f846deeb3c
|
|
BLAKE2b-256 checksum How to use checksums |
05fdf408d283c214efc83b57c4766f0df3a2d5c05931d5915a675ed1be945735
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 26, 2026.
Transparency logRelease files / vexcalibur-1.1.0-py3-none-any.whl
| Download URL | vexcalibur-1.1.0-py3-none-any.whl |
|---|---|
| Size | 125.6 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
e65806cffe8360257321ede486d77343819cd0dd1a073784d83b3c67c6261046
|
|
BLAKE2b-256 checksum How to use checksums |
3ad1e8808da724de834e22d7a371252ced944b13d8098388d31e1486bff96908
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.13
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 26, 2026.
Transparency log
