OSS Trust
evidence over opaque scores
OSS Trust is an evidence-first ChatGPT app for open-source dependency due diligence.
What it does: given a public GitHub repository or an exact npm/PyPI package version, OSS Trust can inspect exact dependency versions, known OSV advisories, declared package licenses, registry deprecation signals, version differences, and selected upstream maintenance signals.
Evidence sources: the current public MVP uses public GitHub repository data, the
OSV vulnerability database, the npm registry, and the PyPI JSON API. Repository scans support root
package-lock.json files and exact name==version entries in root
requirements.txt files.
How to interpret results: a returned advisory is evidence that the exact package version matched a known vulnerability record. No advisory returned does not prove that a package is secure. A version difference from a registry's current release is not, by itself, a vulnerability. License metadata is a triage signal, not legal advice.
Privacy: the public MVP is read-only and is designed for public repository and package data. See the shared app privacy page for request-processing and third-party service details.