Implement uv tool audit

crates/uv-cli/src/lib.rs

@@ -5035,6 +5035,51 @@ pub struct CheckArgs {
     pub refresh: RefreshArgs,
 }
 
+#[derive(Args)]
+#[group(skip)]
+pub struct AuditCommonArgs {
+    /// Select the output format.
+    #[arg(long, value_enum, default_value_t = AuditOutputFormat::default())]
+    pub output_format: AuditOutputFormat,
+
+    /// Ignore a vulnerability by ID.
+    ///
+    /// Vulnerabilities matching any of the provided IDs (including aliases) will be excluded from
+    /// the audit results.
+    ///
+    /// May be provided multiple times.
+    #[arg(long)]
+    pub ignore: Vec<String>,
+
+    /// Ignore a vulnerability by ID, but only while no fix is available.
+    ///
+    /// Vulnerabilities matching any of the provided IDs (including aliases) will be excluded from
+    /// the audit results as long as they have no known fix versions. Once a fix version becomes
+    /// available, the vulnerability will be reported again.
+    ///
+    /// May be provided multiple times.
+    #[arg(long)]
+    pub ignore_until_fixed: Vec<String>,
+
+    /// The service format to use for vulnerability lookups.
+    ///
+    /// Each service format has a default URL, which can be
+    /// changed with `--service-url`. The defaults are:
+    ///
+    /// * OSV: <https://api.osv.dev/>
+    #[arg(long, value_enum, default_value = "osv")]
+    pub service_format: VulnerabilityServiceFormat,
+
+    /// The URL to vulnerability service API endpoint.
+    ///
+    /// If not provided, the default URL for the selected service will be used.
+    ///
+    /// The service needs to use the OSV protocol, unless a different
+    /// format was requested by `--service-format`.
+    #[arg(long, value_hint = ValueHint::Url)]
+    pub service_url: Option<DisplaySafeUrl>,
+}
+
 #[derive(Args)]
 pub struct AuditArgs {
     /// Don't audit the specified optional dependencies.
@@ -5091,9 +5136,8 @@ pub struct AuditArgs {
     #[arg(long, conflicts_with_all = ["locked", "upgrade", "no_sources"])]
     pub frozen: bool,
 
-    /// Select the output format.
-    #[arg(long, value_enum, default_value_t = AuditOutputFormat::default())]
-    pub output_format: AuditOutputFormat,
+    #[command(flatten)]
+    pub audit: AuditCommonArgs,
 
     #[command(flatten)]
     pub build: BuildOptionsArgs,
@@ -5128,43 +5172,6 @@ pub struct AuditArgs {
     /// `aarch64-apple-darwin`.
     #[arg(long)]
     pub python_platform: Option<TargetTriple>,
-
-    /// Ignore a vulnerability by ID.
-    ///
-    /// Vulnerabilities matching any of the provided IDs (including aliases) will be excluded from
-    /// the audit results.
-    ///
-    /// May be provided multiple times.
-    #[arg(long)]
-    pub ignore: Vec<String>,
-
-    /// Ignore a vulnerability by ID, but only while no fix is available.
-    ///
-    /// Vulnerabilities matching any of the provided IDs (including aliases) will be excluded from
-    /// the audit results as long as they have no known fix versions. Once a fix version becomes
-    /// available, the vulnerability will be reported again.
-    ///
-    /// May be provided multiple times.
-    #[arg(long)]
-    pub ignore_until_fixed: Vec<String>,
-
-    /// The service format to use for vulnerability lookups.
-    ///
-    /// Each service format has a default URL, which can be
-    /// changed with `--service-url`. The defaults are:
-    ///
-    /// * OSV: <https://api.osv.dev/>
-    #[arg(long, value_enum, default_value = "osv")]
-    pub service_format: VulnerabilityServiceFormat,
-
-    /// The URL to vulnerability service API endpoint.
-    ///
-    /// If not provided, the default URL for the selected service will be used.
-    ///
-    /// The service needs to use the OSV protocol, unless a different
-    /// format was requested by `--service-format`.
-    #[arg(long, value_hint = ValueHint::Url)]
-    pub service_url: Option<DisplaySafeUrl>,
 }
 
 #[derive(Args)]
@@ -5267,6 +5274,8 @@ pub enum ToolCommand {
     /// List installed tools.
     #[command(alias = "ls")]
     List(ToolListArgs),
+    /// Audit installed tools and their dependencies.
+    Audit(ToolAuditArgs),
     /// Uninstall a tool.
     Uninstall(ToolUninstallArgs),
     /// Ensure that the tool executable directory is on the `PATH`.
@@ -5711,6 +5720,20 @@ pub struct ToolListArgs {
     pub no_python_downloads: bool,
 }
 
+#[derive(Args)]
+pub struct ToolAuditArgs {
+    /// The names of the installed tools to audit.
+    #[arg(required = true, value_hint = ValueHint::Other)]
+    pub name: Vec<PackageName>,
+
+    /// Audit all installed tools.
+    #[arg(long, conflicts_with("name"))]
+    pub all: bool,
+
+    #[command(flatten)]
+    pub audit: AuditCommonArgs,
+}
+
 #[derive(Args)]
 pub struct ToolDirArgs {
     /// Show the directory into which `uv tool` will install executables.

crates/uv-dev/src/generate_preview_features_reference.rs

@@ -108,7 +108,7 @@ mod tests {
         assert_snapshot!(generate(), @r"
         - `add-bounds`: Allows configuring the [default bounds for `uv add`](../reference/settings.md#add-bounds) invocations.
         - `adjust-ulimit`: On Unix, raises the process's soft open-file limit at startup, up to the hard limit.
-        - `audit-command`: Allows using `uv audit`.
+        - `audit-command`: Allows using `uv audit` and `uv tool audit`.
         - `auth-helper`: Allows using `uv auth helper` as a credential helper for external tools.
         - `azure-endpoint`: Allows signing requests to Azure Blob Storage endpoints with Azure credentials.
         - `cache-size`: Allows using `uv cache size`.
@@ -152,8 +152,8 @@ mod tests {
           effect before configuration is loaded.
         - `toml-backwards-compatibility`: Rewrites `pyproject.toml` as TOML 1.0 when building source distributions, preserving the
           original as `pyproject.toml.orig` to ensure compatibility with older build tools.
-        - `tool-install-locks`: Stores a `uv.lock` alongside each installed tool and reuses it for reproducible installations
-          and upgrades.
+        - `tool-install-locks`: Stores a `uv.lock` alongside each installed tool and reuses it for reproducible installations,
+          upgrades, and audits.
         - `venv-safe-clear`: Prevents `uv venv --clear` from clearing a directory that does not contain a `pyvenv.cfg` file
           unless `--force` is provided.
         - `workspace-dir`: Allows using `uv workspace dir`.

crates/uv-preview/src/lib.rs

@@ -284,7 +284,7 @@ pub enum PreviewFeature {
     /// Requires normalized distribution filenames when publishing, skipping files whose names are
     /// not normalized.
     PublishRequireNormalized,
-    /// Allows using `uv audit`.
+    /// Allows using `uv audit` and `uv tool audit`.
     #[preview(alias = "audit")]
     AuditCommand,
     /// Rejects an invalid `--project` path instead of warning and continuing. Except for `uv init`,
@@ -313,8 +313,8 @@ pub enum PreviewFeature {
     /// Stores [project virtual environments](./projects/layout.md#centralized-project-environments)
     /// in the uv cache.
     CentralizedProjectEnvs,
-    /// Stores a `uv.lock` alongside each installed tool and reuses it for reproducible installations
-    /// and upgrades.
+    /// Stores a `uv.lock` alongside each installed tool and reuses it for reproducible installations,
+    /// upgrades, and audits.
     ToolInstallLocks,
     /// Allows using `uv workspace list --scripts`.
     WorkspaceListScripts,

crates/uv-test/src/lib.rs

@@ -1580,6 +1580,14 @@ impl TestContext {
         command
     }
 
+    /// Create a `uv tool audit` command with options shared across scenarios.
+    pub fn tool_audit(&self) -> Command {
+        let mut command = self.new_command();
+        command.arg("tool").arg("audit");
+        self.add_shared_options(&mut command, false);
+        command
+    }
+
     /// Create a `uv tool dir` command with options shared across scenarios.
     pub fn tool_dir(&self) -> Command {
         let mut command = self.new_command();

crates/uv/src/commands/mod.rs

@@ -56,6 +56,7 @@ pub(crate) use python::uninstall::uninstall as python_uninstall;
 pub(crate) use python::update_shell::update_shell as python_update_shell;
 #[cfg(feature = "self-update")]
 pub(crate) use self_update::self_update;
+pub(crate) use tool::audit::audit as tool_audit;
 pub(crate) use tool::dir::dir as tool_dir;
 pub(crate) use tool::install::install as tool_install;
 pub(crate) use tool::list::list as tool_list;