Thirdpass

Thirdpass

Coordinated supply chain review.

Thirdpass directs review effort toward package artifacts that need coverage, records structured findings, and lets projects check their dependencies from the terminal.

$ thirdpass review-any --nightshift

Recent Reviews

View all reviews

Showing 5 of 42 reviewed packages

PackageRegistryVersionSeverityCoverageReviews
axumcrates.io0.8.9none
91%19.8K/21.8K lines
30
atomic-wakercrates.io1.1.2none
100%838/838 lines
5
bytescrates.io1.11.1none
96%10.1K/10.5K lines
15
axum-corecrates.io0.5.6none
89%2.9K/3.3K lines
5
adler2crates.io2.0.1none
48%471/981 lines
1
37 more reviewed packages

How Thirdpass Works

Thirdpass separates ecosystem-specific package handling from review coordination, so coverage gathered for one package artifact can be reused by every project that depends on it.

Extensions resolve packages
Ecosystem extensions find dependency files, understand registry metadata, and fetch exact package archives by version.
The server assigns work
The server keeps a prioritized queue of package versions. Nightshift mode keeps asking for the next target in a loop.
The CLI reviews focused files
Each review focuses on selected files, while the configured review agent can use the rest of the package as context.
Projects check coverage
The check command asks extensions to identify dependencies, then compares them with submitted and committed project reviews.
Read the docs

Quickstart

Contribute reviews and check dependency coverage from your terminal.

Help review the shared package pool:

$ thirdpass review-any --nightshift

Review specific files:

$ thirdpass review d3 4.10.0 \
  --file index.js \
  --file build/d3.js

Check accumulated reviews for your dependencies:

$ thirdpass check

Designed for multiple ecosystems

Thirdpass supports dependency ecosystems through extensions.

EcosystemRegistryExtensionAvailability
Rustcrates.iothirdpass-rsBuilt in
Pythonpypi.orgthirdpass-pyBuilt in
JavaScriptnpmjs.comthirdpass-jsBuilt in
Ansible Galaxygalaxy.ansible.comthirdpass-ansibleExternal