updated 2026-08-09 19:01 UTC

Weights & Biases Weave

wandb/weave

Weave is a toolkit for developing AI-powered applications, built by Weights & Biases.

Observability & Evaluation Python Grade A Listed Apache-2.0
86.4/100
Rank #32 of 1204
Compare Weights & Biases Weave

How does it stack up against its Observability & Evaluation neighbours?

Pick any agent to compare →

Strong public trust posture, backed by multiple independent signals.

Open compare tool Suggest correction
Listing state
Listed
Evidence coverage
Grade A · 4/5 signals
Last push
2026-08-09 · 0d ago
Recent change
Provider Removed +1

Is Weights & Biases Weave safe? Weights & Biases Weave scores 86.4/100 (Grade A), ranked #32 of 1204 tracked open-source AI agent projects, on evidence coverage A (4 of 5 independent signal types). The public evidence: its packages ship with cryptographic provenance; OSSF Scorecard rates its supply-chain practices 6.4/10; 98% of recent commits are signed; last pushed 2026-08-09. Every point is earned from checkable signals — never paid placement. How scoring works →

Ranked neighbours in Observability & Evaluation

#1 MLflow — 89.8 (A) → #3 OpenLLMetry — 84.7 (A) → #4 Langfuse — 78.2 (B) → #5 Evidently — 76.8 (B) →

Quick Trust Read

What Would Improve It
Improve adoption to lift the weakest part of the trust profile.
Recent Changes
2026-08-07
Provider Removed
Runtime surface shrank — no longer detected: E2B, Postgres
2026-08-07
Provider Added
Runtime surface grew — new detected provider dependencies: Cohere, Google Gemini, Groq, Mistral AI, Multi-provider (LiteLLM)
Maintainer Checklist
Raise Scorecard signals Current OSSF Scorecard is 6.4/10. Tighten the weakest checks to improve public safety evidence.
Compare with MLflow Get email alerts for Weights & Biases Weave View Observability & Evaluation Report missing data
78.0
Activity sub-score · out of 100
#2
In Observability & Evaluation

How to read this: HVTrust (0–100) weighs supply-chain signals (provenance, OSSF Scorecard, signed commits, open license) alongside real-world adoption. Grade A reflects the trust score band: A ≥ 80, B ≥ 65, C ≥ 50, D < 50. Evidence coverage A is separate — it grades how many independent signal types back the score (4 of 5), so a high score on thin evidence stays visible. Full methodology →

Signals refreshed 2026-08-09 19:01 UTC · Repo last pushed today

Activity & Reach

Stars
1.1k
Forks
161
Last Push
2026-08-09
today
Commits (4 wk)
90
Downloads (7d)
611,935
npm+pypi
HN mentions (30d)
0
Open Issues
78
Rank Change
▼1
was #31

Analysis

HVTrust Dimensions vs Observability & Evaluation

86.4 / 100 · 100.0% confidence

Weights & Biases Weave Observability & Evaluation average (22 agents)

Safety / Integrity50% OSSF Scorecard · 30% provenance · 20% signed commits
20.4 / 25
9.6 above avg 10.8
Identity / Provenance60% listing status · 40% build provenance
18.0 / 18
4.9 above avg 13.1
Transparency50% declared license · 50% OSSF Scorecard
13.9 / 17
2.2 above avg 11.7
Maintenance60% last-push freshness · 40% commit activity
19.8 / 20
4.4 above avg 15.4
AdoptionLog-scaled stars · package downloads
15.0 / 20
0.7 above avg 14.3

Activity Inputs

78.0 / 100
StarsRepository reach
18.3 / 30
FreshnessLast push recency
25.0 / 25
ActivityRecent commits
24.4 / 25
CommunityFork signal
10.3 / 20

Supply Chain Trust

Package Provenance
Verified
npm, pypi attestation
OSSF Scorecard
6.4 / 10
OpenSSF Scorecard · scanned Aug 9, 2026
Signed Commits
98%
of last 100 commits verified
Binary-Artifacts 10
Branch-Protection 4
CI-Tests 10
CII-Best-Practices 0
Code-Review 9
Contributors 10
Dangerous-Workflow 10
Dependency-Update-Tool 10
Fuzzing 0
License 10
Maintained 10
Packaging 10
Pinned-Dependencies 5
SAST 0
Security-Policy 10
Signed-Releases -1
Token-Permissions 0
Vulnerabilities 0

Is Weights & Biases Weave safe?

Public supply-chain signals for Weights & Biases Weave are strong: it has multiple independent trust indicators in place. This does not replace your own security review, but Weights & Biases Weave carries less obvious unverified-evidence risk than projects with thin signals.
Does Weights & Biases Weave publish package provenance?
Yes. Weights & Biases Weave's package releases carry build provenance attestations, which cryptographically link the published package back to its source repository and CI workflow.
Does Weights & Biases Weave have an OpenSSF Scorecard?
Weights & Biases Weave has an OpenSSF Scorecard score of 6.4/10. The Scorecard checks for branch protection, signed releases, dependency updates, fuzzing, code review, and other supply-chain hygiene items. See the full check breakdown on this page.
Is Weights & Biases Weave actively maintained?
Actively maintained. The repository was pushed to within the last 1 day(s).
What license does Weights & Biases Weave use?
Weights & Biases Weave ships under Apache-2.0. A declared, OSI-approved license is one of the transparency signals HVTrust scores.
Are Weights & Biases Weave's commits signed?
98% of the last 100 commits to Weights & Biases Weave are verified-signed (GPG, SSH, S/MIME, or GitHub's signing flow). Signed commits help confirm that code was authored by who the commit claims.

Not a safety endorsement. HVTracker describes what public signals show, not whether a project is safe for your use case. Run your own security review before adopting in production.

Compare Weights & Biases Weave head-to-head

Weights & Biases Weave vs MLflow → Weights & Biases Weave vs OpenLLMetry → Weights & Biases Weave vs Langfuse →

AI agent surface

MCP, providers, tool surface
Scored in HVTrust

These runtime-trust fields — detected from public repo docs and manifests — contribute a bounded adjustment to this project's HVTrust score alongside supply-chain evidence. The exact values each field can add or subtract are documented in the methodology → Compare this surface across every listed agent in the capability matrix →

MCP Server Support
high confidence
Implemented
Weights & Biases Weave appears to expose MCP server capabilities.
Detailed evidence is not shown in the public view.
External Service Dependencies
high confidence
9 detected
Public provider/service dependencies detected.
Credential signal: No explicit API-key/config marker detected.
Tool / Plugin Surface
medium confidence
1 tags
Broad capability areas detected.
  • database
Detailed evidence is not shown in the public view.
Package Provenance Drift
medium confidence
Partial
Some package metadata matches; some source metadata is missing
Detailed evidence is not shown in the public view.
  • MCP signal live
  • External deps live
  • Tool / plugin surface live
  • Package provenance drift live
How this surface has changed

Detected changes to Weights & Biases Weave's runtime surface and supply-chain posture, from daily public-signal snapshots. A change here means our detectors see something different — a genuinely changed capability, or better evidence of an existing one.

2026-08-07
Provider Removed
Runtime surface shrank — no longer detected: E2B, Postgres
2026-08-07
Provider Added
Runtime surface grew — new detected provider dependencies: Cohere, Google Gemini, Groq, Mistral AI, Multi-provider (LiteLLM)
2026-06-05
Provider Added
Runtime surface grew — new detected provider dependencies: Amazon Bedrock, Anthropic, E2B, OpenAI, Postgres, Redis
2026-06-05
Mcp Status Changed
Detected MCP server support changed: none → implemented

Maintain Weights & Biases Weave?

For maintainers

HVTrust scores Weights & Biases Weave from public signals only — we never contact maintainers first. If a signal is wrong, stale, or missing (provenance you publish, a Scorecard you run, signed releases), tell us and we'll review it. Corrections are public and tracked on GitHub.

Submit a correction → Add the trust badge

Reputation Timeline

Signal history
Rank 2Surface 2Listed 1HVTrust 1Scorecard 1Score 1MCP 1Surface 1
2026-08-07
Provider Removed
Runtime surface shrank — no longer detected: E2B, Postgres
2026-08-07
Provider Added
Runtime surface grew — new detected provider dependencies: Cohere, Google Gemini, Groq, Mistral AI, Multi-provider (LiteLLM)
2026-06-26
Rank Moved
Rank rose 10 spots (#29 → #19)
2026-06-05
Provider Added
Runtime surface grew — new detected provider dependencies: Amazon Bedrock, Anthropic, E2B, OpenAI, Postgres, Redis
2026-06-05
Mcp Status Changed
Detected MCP server support changed: none → implemented
2026-05-29
Rank Moved
Rank dropped 14 spots (#5 → #19)
2026-05-28
Activity Score Changed
Activity score up 25pts (53 → 78)
2026-05-27
Scorecard Added
OSSF Scorecard: 5.2/10
2026-05-27
HVTrust Changed
HVTrust up 39.2pts (41.4 → 80.6)
2026-05-25
Newly Listed
First tracked at rank #131
GitHub → PyPI: weave npm: weave

Embed Badge Badge guide for maintainers →

For maintainers
HVTrust 86.4 Grade A
Markdown:
[![HVTrust](https://hvtracker.net/badge/weights-biases-weave.svg)](https://hvtracker.net/agents/weights-biases-weave)
HTML:
<a href="https://hvtracker.net/agents/weights-biases-weave"><img src="https://hvtracker.net/badge/weights-biases-weave.svg" alt="HVTrust"></a>

Other agents in Observability & Evaluation

Data sources
GitHub REST API (repo, commits, stars, forks, license) · npm Registry (downloads, provenance) · PyPI / pypistats (downloads, provenance) · OpenSSF Scorecard CLI · Algolia HN Search API
Each agent's signals refresh once daily across 6 staggered batches. Methodology v4.2 · Raw JSON