thirdpass 0.4.0

Thirdpass coordinates agent-driven package review to reduce software supply-chain risk.

Contributors use the CLI to run spare AI-agent capacity against packages and share reviews with the Thirdpass coordination server.

How it works

Thirdpass coordinates review work from the command line.

A contributor can run:

thirdpass review-any --nightshift

The CLI asks thirdpass.dev for useful work to review. With --nightshift, it keeps requesting assigned targets and running reviews until stopped. Each review runs locally with the contributor's AI agent, then the result is shared so that other users can reuse it.

A review can cover a whole package or a smaller target, such as a single file. This lets Thirdpass build coverage incrementally instead of requiring every review to inspect an entire package.

Thirdpass currently supports packages from:

• crates.io
• PyPI
• npm
• Ansible Galaxy

Core commands

Continuously review assigned high-priority targets from the shared pool:

thirdpass review-any --nightshift

Review a package version:

thirdpass review <package> <version>

Check dependencies in the current project:

thirdpass check

Installation

Install or update the CLI from crates.io:

cargo install thirdpass --force

Extensions

Thirdpass supports multiple ecosystems via extensions.

External extensions are installed as normal Cargo binaries. Install the Ansible Galaxy extension:

cargo install thirdpass-ansible

Ensure Cargo's binary directory, usually ~/.cargo/bin, is on PATH, then verify Thirdpass can discover the extension:

thirdpass extension list

Enable or disable a discovered extension:

thirdpass extension enable ansible
thirdpass extension disable ansible

Official extensions: