Usage

Algobank has no network access and writes no files. It reads only the wheels you give it. Your package manager downloads them.

Installation

pip install algobank

standard library only, no dependencies

Download packages

pip download --only-binary :all: -d wheels/ requests==2.34.2

Downloads package and every package it calls. --only-binary :all: downloads wheels only. pip never runs sdist build code.

Find package scope with algobank scope

algobank scope wheels/*.whl
pip install --no-index --find-links wheels/ requests==2.34.2

algobank scope generates one report per file. Missing package gets warning.

Install only algobanked packages with line 2

Compare 2 versions with algobank diff

pip download --no-deps --only-binary :all: -d wheels/ requests==2.31.0
pip download --no-deps --only-binary :all: -d wheels/ requests==2.32.3
algobank diff wheels/requests-2.31.0-py3-none-any.whl wheels/requests-2.32.3-py3-none-any.whl

Sample report

requests-2.31.0-py3-none-any.whl -> requests-2.32.3-py3-none-any.whl
  nodes (functions, classes, module values): 650 (441 unchanged, 26 code changed, 170 affected by a changed dependency, 13 added, 1 removed)
  scope: TOP, env, file, network -> TOP, env, file, network
findings:
  [high] new: requests 2.32.3: PYSEC-2026-1872 (algobank/known.json)
  [high] new: requests 2.32.3: PYSEC-2026-2275 (algobank/known.json)
  [high] old: requests 2.31.0: PYSEC-2026-1872 (algobank/known.json)
  [high] old: requests 2.31.0: PYSEC-2026-1873 (algobank/known.json)
  [high] old: requests 2.31.0: PYSEC-2026-2275 (algobank/known.json)
  ...

Save report

algobank diff wheels/requests-2.31.0-py3-none-any.whl wheels/requests-2.32.3-py3-none-any.whl > report.txt
algobank diff --json wheels/requests-2.31.0-py3-none-any.whl wheels/requests-2.32.3-py3-none-any.whl > report.json

Shell writes file because algobank lacks write to file scope

Recommended report export

old=wheels/requests-2.31.0-py3-none-any.whl
new=wheels/requests-2.32.3-py3-none-any.whl
o=$(basename "$old"); n=$(basename "$new"); v1=${o#*-}; v2=${n#*-}
name=${o%%-*}-${v1%%-*}-${v2%%-*}
algobank diff "$old" "$new" > "$name.txt"
algobank diff --json "$old" "$new" > "$name.json"

Report name is package-oldversion-newversion. requests-2.31.0-2.32.3 is a valid filename. Script generates filename from wheel names.

Options

algobank scope wheels/*.whl --json
algobank scope wheels/*.whl --ignore-native

--json gives the same report for programs and agents. --ignore-native reports native binaries but does not fail on them.

Exit status: 0 means no high finding. 1 means a high finding. 2 means an error.