Skip to content

Install

Mend Platform Setup

Prior to installing and using the SDK, follow the instructions in the Mend platform documentation and set up the integration with Mend:

  1. Generate an activation key via the Integrations Catalog
  2. Configure the Guardrails policy for your organization

Once you have the activation key and policy configured, proceed with SDK installation below.

Setup Mend Activation Key

Export your Mend activation key as MEND_KEY. The same key is used to download the SDK from the Mend package index and to authenticate the SDK at runtime.

export MEND_KEY="your-mend-activation-key"

Note: Providing the activation key is required to enable the integration with Mend Platform.

Install the SDK

The Mend package index requires authentication. Use your Mend activation key as the HTTP Basic Auth password (username can be any non-empty value, e.g. mend).

pip install --extra-index-url "https://mend:${MEND_KEY}@downloads.mend.io/guardrails/" mend-guardrails

If your key contains characters that are not URL-safe (for example @, :, or /), URL-encode it first:

MEND_KEY_ENCODED=$(python3 -c 'import os, urllib.parse; print(urllib.parse.quote(os.environ["MEND_KEY"], safe=""))')
pip install --extra-index-url "https://mend:${MEND_KEY_ENCODED}@downloads.mend.io/guardrails/" mend-guardrails

Persistent pip configuration

To avoid embedding credentials in shell history, add the index URL to pip.conf (or pip.ini on Windows):

[global]
extra-index-url = https://mend:YOUR_MEND_KEY@downloads.mend.io/guardrails/

Then install normally:

pip install mend-guardrails

Docker

Pass the key as a build argument and use it as the index password:

ARG MEND_KEY
RUN pip install --extra-index-url "https://mend:${MEND_KEY}@downloads.mend.io/guardrails/" \
    mend-guardrails

Build with:

docker build --build-arg MEND_KEY="$MEND_KEY" .

Other pip authentication options

The examples above use HTTP Basic Auth credentials embedded in the index URL.

Pip also supports other authentication methods — for example .netrc, keyring integration, and token-only URLs — that may be better suited to CI pipelines or team-managed environments.

See the official pip documentation for the full list of supported options:

Note: pip does not support custom HTTP headers such as Authorization: Bearer … for package indexes. Credentials must be supplied via one of pip's supported mechanisms.

Next steps