Python SDK and CLI

devsecure-intelligence is the Python client for the API. It uses only the standard library, is typed, and supports Python 3.10 and later. Installing it also installs the devsecure command.

pip install devsecure-intelligence
export DEVSECURE_API_KEY=...   # from your dashboard; never commit it

Rank a scanner's findings

Pass a list of IDs or any text that mentions them: a Trivy or Grype report, SARIF, a CycloneDX SBOM.

from pathlib import Path
from devsecure_intelligence import Client

client = Client()  # reads DEVSECURE_API_KEY
result = client.prioritize(Path("trivy.json").read_text())

for cve in result["ranked"]:
    print(cve["rank_in_request"], cve["cve_id"], cve["priority_band"], cve["reason"])

priority_band is the Final Priority: the RPS band after the CISA KEV floor and the EPSS gate (see Priority bands).

Long lists are handled for you. Free keys take 25 IDs per call and Pro and above take 1,000. A longer list is sent in chunks of your plan's limit and merged into one ranking in the API's own order: band first, then RPS within a band.

From the terminal

devsecure cve CVE-2024-3400                      # no key needed: falls back to the public record
devsecure prioritize trivy.json grype.json       # ranked table of every CVE found
trivy image -f json app:1.2 | devsecure prioritize - --fail-on high,kev
devsecure movers --window 24h --type kev_added,priority_change
devsecure --json prioritize sbom.cdx.json        # the API's JSON instead of a table

--fail-on takes critical, high, medium and/or kev. The command exits 1 when a CVE matches and 2 on a usage or API error. Your organisation decides what blocks a build. For GitHub Actions with allowlists, VEX and a job summary, use the CI gate.

Other calls

cve, rps, cve_batch, prioritize, movers, recent, cwe_cves, intelligence (Pro and above), patches (Business and Enterprise), and the no-key public_cve, kev, stats, status and health. request() calls any other endpoint. Fields match the API reference.

Errors, retries and quota

Network errors, timeouts, 5xx responses and 429 rate_limited are retried with backoff, honouring Retry-After. quota_exceeded and other 4xx errors are not retried. Every error raises a DevSecureError with status, code, message, docs_url and request_id. Subclasses: AuthenticationError, PlanError, NotFoundError, RateLimitError and QuotaExceededError (see Error handling).

client.last_quota holds the rate-limit and quota headers from the last response. The key is sent only in the Authorization header, never in a URL.

MIT licence; the source ships in the package. Changes are listed in the changelog.

This product uses the NVD API but is not endorsed or certified by the NVD. CVE is a trademark of The MITRE Corporation. All third-party sources and licences: Data Sources and Licences.