OS³ is a high-performance, intent-time security scoring engine designed to stop malicious and vulnerable open-source packages before they enter your supply chain. It provides data-saturated security audits for PyPI, NPM, and Maven ecosystems.
Built for the Advanced Agentic Coding era, OS³ integrates directly into your CLI and IDE to provide real-time risk assessments, smart alternatives, and developer-centric suppression.
- Python 3.9+
- [Optional] Maven (for Java dependency depth calculation)
- [Optional] Node.js (for NPM ecosystem support)
git clone https://github.com/bhaskarbhar/os3.git
cd os3
py -m pip install -e .- Score a package:
os3 score flask - Scan a project:
os3 scan requirements.txt - Sync cache:
os3 sync --full
Detailed documentation for OS³ can be found below:
- Core Features: Explore the security signals and scoring logic.
- Installation & CLI Deep Dive: Comprehensive installation and command reference.
- VS Code Extension: Setup and features for the VS Code integration.
- Configuration: Managing cache, suppressions, and settings.
- Development: Guidelines for contributing and running tests.
- Contributing Guide: How to get involved with the project.
- Backend: Python, Typer (CLI), Rich (TUI), SQLite (Cache), Fernet (Encryption).
- Frontend (IDE): TypeScript, VS Code Extension API.
- APIs: OSV.dev, PyPI JSON API, NPM Registry/Downloads, Maven Central Solr API, deps.dev.
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
Built by the OS³ Team.