Check Command

The check command is the consumer side of Thirdpass.

Run it from a project directory:

thirdpass check

Dependency Discovery

The CLI asks installed extensions whether they can identify dependency files in the current directory or one of its parents.

For example, an ecosystem extension might inspect a lockfile, extract package names and versions, and return the dependencies it understands.

Review Lookup

After dependencies are identified, the CLI asks the server for matching reviews and reads committed project reviews from .thirdpass/reviews/.

Committed project reviews are only used when they still match the current package artifact and reviewed file hashes. If a project review is present but no longer matches the current package contents, check reports it as stale.

Results

The command can report:

• Dependencies with review evidence.
• Dependencies with no known review evidence.
• Findings from submitted reviews that match the project's dependencies.
• Matching or stale committed project reviews.

The goal is to make review evidence actionable from the terminal.