AIPass
Persistent Agent Workspace — AI agents that remember, collaborate, and never start from zero.
AIPass is an open-source AI agent in the Agent Frameworks category with 173 GitHub stars — Persistent Agent Workspace — AI agents that remember, collaborate, and never start from zero..
HVTracker independently evaluates AIPass with a Trust Score of 80.9/100 (Grade C), ranking it #22 of 172 tracked AI agents.
It scores 6.4/10 on the OpenSSF Scorecard for supply-chain security.
Package provenance is verified.
Signals are refreshed daily from GitHub, package registries, and security databases.
Quick Trust Read
Verdict
Promising trust profile, but some evidence still deserves review.
80.9/100 · Grade C
Strongest Signal
Identity / Provenance
20.0/20
Weakest Signal
Adoption
4.1/10
What Would Improve It
Increase the share of verified signed commits for clearer maintainer identity.
70.0
Activity Score · out of 100
80.9
HVTrust Score · out of 100
How to read this: HVTrust (0–100) weighs harder-to-fake supply-chain signals (provenance, OSSF Scorecard, signed commits) more than popularity. Grade C reflects evidence coverage: A = 5+ signal types, B = 4, C = 3, D = 1–2. Adoption alone cannot buy a top score. Full methodology →
Signals refreshed
2026-05-30 20:03 UTC
·
Repo last pushed today
Activity & Reach
Last Push
2026-05-30
today
HVTrust Breakdown 80.9 / 100 · 100.0% confidence
Safety / Integrity (max 30)
20.4
Identity / Provenance (max 20)
20.0
Transparency (max 20)
16.4
Maintenance (max 20)
20.0
Supply Chain Trust
Package Provenance
Verified
pypi attestation
OSSF Scorecard
6.4 / 10
via deps.dev · OpenSSF
Signed Commits
30%
of last 100 commits verified
Dependency-Update-Tool
10
Dangerous-Workflow
10
Code-Review
0
Security-Policy
10
Maintained
10
Binary-Artifacts
10
Token-Permissions
10
License
10
CII-Best-Practices
0
Pinned-Dependencies
3
Signed-Releases
0
Fuzzing
0
Vulnerabilities
4
SAST
10
Packaging
10
Branch-Protection
3
Contributors
0
CI-Tests
10
Is AIPass safe?
AIPass has a mixed signal profile. Some trust indicators are present, others are missing. Whether it is safe for your use case depends on which gaps matter to you — review the breakdown below before adopting in production.
Does AIPass publish package provenance?
Yes. AIPass's package releases carry build provenance attestations, which cryptographically link the published package back to its source repository and CI workflow.
Does AIPass have an OpenSSF Scorecard?
AIPass has an OpenSSF Scorecard score of 6.4/10. The Scorecard checks for branch protection, signed releases, dependency updates, fuzzing, code review, and other supply-chain hygiene items. See the full check breakdown on this page.
Is AIPass actively maintained?
Actively maintained. The repository was pushed to within the last 1 day(s).
What license does AIPass use?
AIPass ships under MIT. A declared, OSI-approved license is one of the transparency signals HVTrust scores.
Are AIPass's commits signed?
30% of the last 100 commits to AIPass are verified-signed (GPG, SSH, S/MIME, or GitHub's signing flow). Signed commits help confirm that code was authored by who the commit claims.
Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.
Runtime trust — coming soon
HVTrust currently scores supply-chain signals. We're adding runtime trust next: what an agent actually does when it runs — what it can reach, which tools it carries, what external services it depends on. Track progress on the roadmap →
- MCP support
- Tool / plugin surface
- External service deps
- Package provenance drift
Maintain AIPass?
HVTrust scores AIPass from public signals only — we never contact maintainers first. If a signal is wrong, stale, or missing (provenance you publish, a Scorecard you run, signed releases), tell us and we'll review it. Corrections are public and tracked on GitHub.
Reputation Timeline
2026-05-30
🛡️
scorecard added
OSSF Scorecard: 6.4/10
2026-05-30
🔄
rank changed
Rank rose 47 spots (#69 → #22)
2026-05-29
🟢
listed
First tracked at rank #69
Markdown:
[](https://hvtracker.net/agents/aipass)
HTML:
<a href="https://hvtracker.net/agents/aipass"><img src="https://hvtracker.net/badge/aipass.svg" alt="HVTrust"></a>
Other agents in Agent Frameworks
Data sources
GitHub REST API (repo, commits, stars, forks, license) · PyPI / pypistats (downloads, provenance) · OSSF Scorecard via deps.dev
Each agent's signals refresh once daily across 6 staggered batches. Methodology v3.0 · Raw JSON
