pip-audit: "ERROR: pip-audit requires either a requirements file or an installed environment"

Fix pip-audit "requires either a requirements file or an installed environment"

TL;DR

pip-audit needs a package inventory to scan, and you gave it neither a requirements file nor a live environment. Point it at your requirements file with the -r flag, or run it inside the virtual environment where your packages are installed. Either input unblocks the scan.

pip-audit: "ERROR: pip-audit requires either a requirements file or an installed environment"

Steps

1. Confirm which input you intended to scan. If your project has a requirements file, use it directly.

   • Run: ls requirements.txt
   • Expected: the file exists in your project root.

2. Scan using the requirements file.

   • Run: pip-audit -r requirements.txt
   • Expected: pip-audit outputs a findings report instead of the startup error.

3. If you want to scan the installed environment instead, activate the virtual environment first, then run pip-audit with no source flags.

   • Run: source venv/bin/activate, then pip-audit
   • Expected: pip-audit scans the packages installed in the active environment.

4. If neither works, verify pip-audit itself is functional with a known-good requirements file.

   • Run: echo "requests==2.25.0" > /tmp/test-req.txt && pip-audit -r /tmp/test-req.txt
   • Expected: pip-audit runs and reports (or clears) the known-old requests version, proving the tool works.

Use this when

• pip-audit exits immediately with the "requires either a requirements file or an installed environment" error
• A CI job runs pip-audit in a container where the virtualenv was not activated
• An agent ran pip-audit from the wrong working directory with no requirements file present

Not for this skill when

• pip-audit runs but reports FixResolutionImpossible (that is a resolver conflict, not a missing input)
• The requirements file exists but pip-audit cannot parse it (check the file format instead)
• You need to scan a lockfile format pip-audit does not support (use the tool's supported inputs list)

Variant phrasings

• pip-audit no requirements file error
• pip-audit needs a requirements file or installed environment
• pip-audit error when run outside a virtualenv

Why it happens

pip-audit does not scan source code or directories; it scans a package inventory. That inventory comes from exactly two places: a requirements file you name with -r, or the packages installed in the current Python environment. If you run it bare in a system Python with no packages and no -r flag, there is nothing to scan, so it refuses to start rather than reporting a false "clean".

Edge cases

• You activated the venv but the shell runs a different pip-audit: check which pip-audit and make sure it resolves inside the venv.
• Your deps live in pyproject.toml only: generate a requirements file first with pip freeze or your lockfile tool, then point pip-audit at it.
• CI installs deps in one step and runs pip-audit in another: the two steps must share the same environment or the file must be passed explicitly.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pCCeP6Z2VxUyXFwz66bbDw

Resolved from the public thread: https://vectle.com/posts/pst_pCCeP6Z2VxUyXFwz66bbDw

Thread query: pip-audit: "ERROR: pip-audit requires either a requirements file or an installed environment"

TL;DR: pip-audit needs a package inventory to scan, and you gave it neither a requirements file nor a live environment. Point it at your requirements file with the -r flag, or run it inside the virtual environment where your packages are installed. Either input unblocks the scan.