Registry / observability / flare-capa

flare-capa

JSON →
library9.4.0pypypi✓ verified 87d ago

The FLARE team's open-source tool to identify capabilities in executable files. Version 9.4.0 supports Python >=3.10. CAPA detects capabilities in PE, ELF, and shellcode files. Released regularly with minor version bumps.

pip install flare-capa
INSTALL
IMPORT
SIG · FLARE-CAPA
F
flare-capa
observabilitypythonv9.4.0
Install
13.3s avg
Import
1035ms
Disk
151MB
Pass rate
6/ 10
Env Coverage6 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v9.4.0 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
glibc
py 3.10
✕ build_error
✓ 14.1s
py 3.11
✕ build_error
✓ 13.9s
py 3.12
✕ build_error
✓ 12.7s
py 3.13
✕ build_error
✓ 12.1s
py 3.9
✓ —
✓ 13.7s
151MB installed
● package 151MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

Capabilities
from capa.main import Capabilities
import capa
Top-level import does not expose Capabilities class
get_meta
from capa.engine import get_meta
from capa import get_meta
get_meta is in the engine submodule

Basic usage to identify capabilities in an executable file. Ensure rules are extracted or downloaded separately.

import os import json from capa.main import Capabilities from capa.engine import get_meta rules_path = os.environ.get('CAPA_RULES_PATH', '/path/to/rules') with open('sample.exe', 'rb') as f: buf = f.read() capa = Capabilities.get_capabilities(buf, rtype='pe', backend='vivisect', rulesdir=rules_path, signatures='auto') meta = get_meta(buf) print(json.dumps(capa, indent=2)) print(json.dumps(meta, indent=2))
capa --version
Debug
Known issues
breakingIn version 9.0+ the rules directory must be provided explicitly; CAPA no longer bundles rules in the package.
fix
Download rules from https://github.com/mandiant/capa-rules and set CAPA_RULES_PATH environment variable or pass --rules argument.
affects: >=9.0.0
deprecatedThe 'capa' CLI tool is deprecated in favor of the Python API. Direct use of capa.main may change.
fix
Use Capabilities.get_capabilities() instead of calling capa from command line.
affects: >=9.0.0
gotchaCAPA requires vivisect as a backend, which is only available on Windows and Linux. macOS support is limited.
fix
If on macOS, consider using a Docker container with Linux.
affects: all
Errors
Common errors & fixes
ModuleNotFoundError: No module named 'vivisect'
vivisect is not installed or not compatible with the platform.
fix
pip install vivisect (Windows/Linux only). For macOS, use Docker.
FileNotFoundError: [Errno 2] No such file or directory: 'rules/...'
CAPA rules directory not provided or not found.
fix
Download capa-rules and set CAPA_RULES_PATH or pass the 'rules' parameter.
Upgrade
Version history
9.4.0latest on PyPI · released Apr 1, 2026
Audit
Dependencies
vivisectrequiredRequired for analysis of executable formats
Agent activity
24 hits · last 30 days
node
22
OpenAI (training)
2
Resources
flare-capa — pip install flare-capa · libregistry