Reef has an HVTrust score of 47.7/100 (Grade D), ranked #1002 of 1343 tracked AI agent projects. This score reflects verifiable supply-chain integrity, transparency, maintenance, and adoption signals.

What is the trust score for Reef?

Reef scores 47.7/100 on HVTracker's evidence-weighted HVTrust scale. It has 7.3k GitHub stars and is categorized under Agent Frameworks.

Reef

Repository

Website

Infrastructure for continually self‑improving agents

Agent Frameworks Python Listed Apache-2.0

Is Reef safe? Thin or incomplete trust evidence. Review carefully before production use.

OSSF Scorecard No result

Provenance Attested

Signed commits 100%

Last push today

Advisories None known

Compare Reef

How does it stack up against its Agent Frameworks neighbours?

Pick any agent to compare →

Suggest a correction

In detail: Reef scores 47.7/100 (Grade D), ranked #1002 of 1343 tracked open-source AI agent projects, on evidence coverage C (2 of 5 independent signal types). The public evidence: its packages ship with cryptographic provenance; no OSSF Scorecard result yet; 100% of recent commits are signed; no published advisory affects its latest release (reef-infra); last pushed 2026-09-29. Every point is earned from checkable signals — never paid placement. How scoring works →

How Reef could raise its score

Each line changes one public signal and recomputes with the live scoring function. The gains don't add up exactly, because the score is capped near the top.

Raise the OSSF Scorecard to 9.0no OSSF Scorecard result yet +12.6 → 60.3 C · #54 of 125

Already done? Suggest a correction Add the trust badge

How Reef compares in Agent Frameworks

Bars show each HVTrust score; the tick marks Reef’s 47.7.

Where the 47.7 comes from

HVTrust dimensions vs the Agent Frameworks average

47.7 / 100 · 67.0% confidence

Reef Agent Frameworks average (125 agents)

Safety / Integrity50% OSSF Scorecard · 30% provenance · 20% signed commits

12.5 / 25

2.7 above avg 9.8

Identity / Provenance60% listing status · 40% build provenance

18.0 / 18

6.4 above avg 11.6

Transparency50% declared license · 50% OSSF Scorecard

8.5 / 17

3.9 below avg 12.4

Maintenance60% last-push freshness · 40% commit activity

20.0 / 20

5.9 above avg 14.1

AdoptionLog-scaled stars · package downloads

9.3 / 20

1.9 below avg 11.2

Quick Trust Read

What Would Improve It

Add or improve OSSF Scorecard coverage so safety checks are easier to verify.

Recent Changes

2026-09-29

Newly Listed

First tracked at rank #1002

Maintainer Checklist

Add Scorecard coverage Expose the repository to OpenSSF Scorecard checks so supply-chain posture is easier to verify.

Compare with another agent Get email alerts for Reef View Agent Frameworks Report missing data

86.4

Activity sub-score · out of 100

#91

In Agent Frameworks

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption. Grade D reflects the trust score band: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Evidence coverage C is separate — it grades how many independent signal types back the score (2 of 5), so a high score on thin evidence stays visible. Full methodology →

Activity & Reach

Stars

7.3k

Forks

686

Last Push

2026-09-29

today

Commits (4 wk)

383

Downloads (7d)

—

HN mentions (30d)

—

Open Issues

Rank Change

NEW

Analysis

Activity Inputs

86.4 / 100

StarsRepository reach

23.2 / 30

FreshnessLast push recency

25.0 / 25

ActivityRecent commits

25 / 25

CommunityFork signal

13.2 / 20

Supply Chain Trust

Package Provenance

Verified

pypi attestation

OSSF Scorecard

—

Not available

Signed Commits

100%

of last 100 commits verified

Common questions about Reef

Public trust evidence for Reef is thin: several supply-chain signals are missing or weak. This does not mean the project is unsafe — it means an outside observer cannot easily verify the usual integrity checks. Treat with extra scrutiny.

Does Reef publish package provenance?

Yes. Reef's package releases carry build provenance attestations, which cryptographically link the published package back to its source repository and CI workflow.

Does Reef have an OpenSSF Scorecard?

No OpenSSF Scorecard data is currently published for Reef. Maintainers can enable the Scorecard GitHub Action to get a public score; without it, automated supply-chain hygiene is harder for outsiders to verify.

Is Reef actively maintained?

Actively maintained. The repository was pushed to within the last 1 day(s).

What license does Reef use?

Reef ships under Apache-2.0. A declared, OSI-approved license is one of the transparency signals HVTrust scores.

Are Reef's commits signed?

100% of the last 100 commits to Reef are verified-signed (GPG, SSH, S/MIME, or GitHub's signing flow). Signed commits help confirm that code was authored by who the commit claims.

Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.

AI agent surface

MCP, providers, tool surface

Scored in HVTrust

These runtime-trust fields — detected from public repo docs and manifests — contribute a bounded adjustment to this project's HVTrust score alongside supply-chain evidence. The exact values each field can add or subtract are documented in the methodology → Compare this surface across every listed agent in the capability matrix →

MCP Server Support

None detected

No MCP server signal detected.

Detailed evidence is not shown in the public view.

External Service Dependencies

high confidence

2 detected

Public provider/service dependencies detected.

E2B
Postgres

Credential signal: API keys or service config markers documented.

Tool / Plugin Surface

high confidence

Declared

Declared plugin/integration surface detected.

Detailed evidence is not shown in the public view.

Package Provenance Drift

high confidence

Match

Published package metadata matches the tracked repo

Detailed evidence is not shown in the public view.

MCP signal live
External deps live
Tool / plugin surface live
Package provenance drift live

Maintain Reef?

For maintainers

HVTrust scores Reef from public signals only — we never contact maintainers first. If a signal is wrong, stale, or missing (provenance you publish, a Scorecard you run, signed releases), tell us and we'll review it. Corrections are public and tracked on GitHub.

Submit a correction → Add the trust badge

Reputation Timeline

Signal history

2026-09-29

Newly Listed

First tracked at rank #1002

GitHub → Website → PyPI: reef-infra

Embed Badge Badge guide for maintainers →

For maintainers

Markdown:
            [![HVTrust](https://hvtracker.net/badge/reef.svg)](https://hvtracker.net/agents/reef)
            
HTML:
            <a href="https://hvtracker.net/agents/reef"><img src="https://hvtracker.net/badge/reef.svg" alt="HVTrust"></a>

Other agents in Agent Frameworks

Data sources
GitHub REST API (repo, commits, stars, forks, license) · PyPI / pypistats (downloads, provenance)
Each agent's signals refresh once daily across 6 staggered batches. Methodology v4.4 · Raw JSON