Metadata-Version: 2.4
Name: packtrust
Version: 0.1.2
Summary: Multi Agent AI Syste, that vets open-source packages
Author: RAMEEN SOHAIL
License: MIT
Requires-Python: >=3.9
Description-Content-Type: text/markdown
Requires-Dist: requests>=2.31.0
Requires-Dist: python-dotenv>=1.0.0

# PackTrust

Multi-agent AI system that vets open-source packages for trust and security signals — in seconds, not the 15+ minutes it normally takes to manually check GitHub activity, license status, and known vulnerabilities.

## What it does

PackTrust runs six coordinating AI agents to evaluate any PyPI package:

1. **Scout** — gathers evidence from PyPI, GitHub, and OSV.dev (real vulnerability database)
2. **Forensics** — flags anomalies (archived repos, single-maintainer risk, yanked releases)
3. **Compliance** — checks license clarity and known vulnerabilities against configurable deal-breakers
4. **Gap** — maps evidence completeness and produces a confidence score
5. **Risk** — the adversarial judge: vetoes and requests re-investigation if evidence is too thin, otherwise issues a final verdict
6. **Synthesis** — writes the final auditable trust report

## Install

```bash
pip install packtrust
```

## Usage

```bash
packtrust requests
packtrust flask --confidence-threshold 0.7
packtrust some-package --deal-breaker no_gpl_family_license
```

## Setup for real AI reasoning

Without an API key, PackTrust still gathers real evidence from PyPI/GitHub/OSV, but skips LLM reasoning. To enable it:

1. Get a free API key at https://console.groq.com
2. Set it as an environment variable: `GROQ_API_KEY=your_key_here`

## Data sources

- [PyPI](https://pypi.org) — package registry metadata
- [GitHub REST API](https://docs.github.com/en/rest) — repository health signals
- [OSV.dev](https://osv.dev) — Google's open vulnerability database

## License

MIT
