Shipping reconx-py on PyPI

From app to package

ReconX started as a web and desktop app. reconx-py is the same recon engine reshaped into something a developer can pip install and script against, a library and CLI first, with the AI layer optional on top.

Turning an app into a package changes what you optimise for. Instead of screens you design an API: clear functions, sensible defaults, predictable return types. Everything a user might want to automate has to be reachable from code, not just a button.

Designing the API and CLI

The CLI is the second interface. It wraps the same library so anyone can run a scan from the terminal, pipe the output, or drop it into a script. Library and CLI share one core, so they never drift apart.

• pyproject.toml with clear metadata and entry points

• Pinned, tested dependencies for reproducible installs

• A CLI that works the same as the library API

• Docs that show install, first command, and extension points

For a security tool, light dependencies matter. Every extra package is a bigger install, more to audit, and more that can break. reconx-py leans on httpx and a small, deliberate set of libraries so it installs fast and stays easy to trust.

The natural-language agent is opt-in. If you want it, you describe what you're after and the agent maps it to the right recon step; if you don't, the plain library and CLI work with zero AI involved. Optional means optional, no forced dependency on a model.

Shipping to PyPI is more than a first upload. It's semantic versioning, a real README, an MIT licence, and a build that's reproducible so installs don't surprise people. Open source is a commitment to maintain, and packaging it properly is how you keep that promise.

Keeping dependencies light

Keeping the install light means the core package stays useful without an LLM. Optional extras pull in the agent stack only when someone opts in:

• Core install: recon library + CLI only — no LLM SDKs, no heavy agent stack.

• Optional extras: pip install reconx-py[agent] when you want the natural-language layer.

“A library people can pip install is more useful than a clever script.” – Practical packaging rule

The hard part is not the scan logic — it is packaging it so others can install, extend, and trust it without cloning your repo.

The optional AI agent

An optional AI agent rides on top of the same core: describe a recon goal, and the package picks tools, runs them, and explains the output — without forcing the LLM dependency on every install.

What I treated as non-negotiable before shipping to PyPI:

• Publish to PyPI with a trusted build and changelog

• Optional AI agent extras that stay out of the core install

• Versioning that does not break CLI users mid-flight

• CI that runs install + smoke tests on every tag

“Ship the package first. The agent is an optional layer, not the install tax.”

A clean packaging setup, a well-defined CLI entry point, pinned dependencies, and a tested build are what turn a script into a library people can actually pip install and trust.

Try it yourself

reconx-py is live on PyPI, so a single pip install reconx-py gets you the toolkit and CLI. The source, docs and issue tracker are on PyPI.