Install & Compatibility
Where this runs
tested against v3.2.511 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
264MB installed
● package 264MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
main
✓ N/A - intended as CLI
✗ from bridgecrew.main import main
`bridgecrew` is primarily a command-line interface (CLI) tool. Its Python package installs the `bridgecrew` executable. Direct programmatic import of its internal components like `main` is not officially supported and may lead to unstable behavior. For programmatic IaC scanning, consider using the underlying `checkov` library directly.
The `bridgecrew` library is primarily used as a command-line interface. This quickstart demonstrates how to execute the `bridgecrew` CLI from Python using `subprocess` to scan an Infrastructure as Code file. It highlights the use of the `BC_API_KEY` environment variable for authentication to the Bridgecrew platform.
# Save your Infrastructure as Code (e.g., Terraform, CloudFormation, Kubernetes) to a file named 'my_resource.tf'
# Example content for my_resource.tf:
# resource "aws_s3_bucket" "bad_bucket" {
# bucket = "my-private-bucket"
# acl = "public-read"
# }
import os
import subprocess
# Ensure BC_API_KEY is set in your environment for Bridgecrew platform integration.
# If not set, Bridgecrew will still run checks but won't send results to the platform.
api_key = os.environ.get('BC_API_KEY', 'YOUR_BC_API_KEY_HERE_IF_NEEDED')
# Create a dummy IaC file for scanning
with open('my_resource.tf', 'w') as f:
f.write('resource "aws_s3_bucket" "bad_bucket" {\n bucket = "my-private-bucket"\n acl = "public-read"\n}\n')
print("Scanning 'my_resource.tf' with Bridgecrew...")
try:
# Run bridgecrew CLI via subprocess
# -f specifies the file/directory to scan
# --skip-framework checkov skips scanning with checkov only (bridgecrew uses checkov)
# It is recommended to use the bridgecrew CLI which layers on top of checkov
# Setting BC_API_KEY for the subprocess call
result = subprocess.run(
['bridgecrew', '-f', 'my_resource.tf'],
capture_output=True,
text=True,
check=True,
env={**os.environ, 'BC_API_KEY': api_key} # Pass current env + BC_API_KEY
)
print("Bridgecrew Scan Output:")
print(result.stdout)
if result.stderr:
print("Bridgecrew Scan Errors:")
print(result.stderr)
except subprocess.CalledProcessError as e:
print(f"Bridgecrew scan failed with error: {e}")
print(f"Stdout: {e.stdout}")
print(f"Stderr: {e.stderr}")
except FileNotFoundError:
print("Error: 'bridgecrew' command not found. Please ensure Bridgecrew is installed and in your PATH.")
# Clean up the dummy file
os.remove('my_resource.tf')
bridgecrew --version
Upgrade
Version history
3.2.511latest on PyPI · released Mar 26, 2026
Audit
Dependencies
checkovrequiredProvides the core IaC static analysis engine. Bridgecrew is built on top of checkov.