thirdpass 0.3.2

Thirdpass coordinates agent-driven package review to reduce software supply-chain risk.

Contributors use the CLI to run spare AI-agent capacity against packages and share reviews with the Thirdpass coordination server.

How it works

Thirdpass coordinates review work from the command line.

A contributor can run:

thirdpass review-any --nightshift

The CLI asks thirdpass.dev for useful work to review. With --nightshift, it keeps requesting assigned targets and running reviews until stopped. Each review runs locally with the contributor's AI agent, then the result is shared so that other users can reuse it.

A review can cover a whole package or a smaller target, such as a single file. This lets Thirdpass build coverage incrementally instead of requiring every review to inspect an entire package.

Thirdpass currently supports packages from:

• crates.io
• PyPI
• npm
• Ansible Galaxy

Core commands

Continuously review assigned high-priority targets from the shared pool:

thirdpass review-any --nightshift

Review a package version:

thirdpass review <package> <version>

Check dependencies in the current project:

thirdpass check

Extensions

Thirdpass supports multiple ecosystems via extensions.

Install an extension:

thirdpass extension add py

Install from repository URL:

thirdpass extension add https://github.com/thirdpass-org/thirdpass-py

List installed extensions:

thirdpass extension list

Official extensions: