Case Study: How Haystack Earns the Top HVTrust Score

Haystack, deepset's open-source AI orchestration framework, is the highest-scoring project on HVTracker: 96.5 out of 100, Grade A, ranked #1 of 1,328 tracked AI agent projects and #1 in Agent Frameworks. It is also one of the projects that publishes that score in its own README.

Where the 96.5 comes from

HVTrust is a base score across five dimensions plus a small, bounded runtime calibration. Haystack is at or near the ceiling on four of the five.

The supply-chain detail

The OSSF Scorecard result is where Haystack separates from the field. Thirteen of its checks score a perfect 10: Binary-Artifacts, CI-Tests, Code-Review, Contributors, Dangerous-Workflow, Dependency-Update-Tool, Fuzzing, License, Maintained, Packaging, Security-Policy, Token-Permissions and Vulnerabilities. Its PyPI releases carry build provenance, and the published package points back to the tracked repository, so what you install is traceable to what you can read.

What still holds it back

Even the top score has visible gaps, and they're worth naming because they're the same ones most projects can close:

• Pinned-Dependencies (5/10) and CII-Best-Practices (5/10) are the two weakest Scorecard checks; Branch-Protection and SAST sit at 8.
• Adoption (17.4/20) is the dimension with the most headroom: strong, but not the highest download counts in the registry.
• Evidence coverage is B (3 of 5 signal types). That one is on us, not Haystack: the two missing types, Hacker News discussion and public-action telemetry, aren't configured for it yet. Coverage measures how much independent evidence we hold, which is separate from how good that evidence is.

Ninety days at the top

Across the last 91 daily snapshots Haystack was Grade A every single day and ranked #1 on 52 of them, never lower than #3 except once. That exception, 4 July 2026 (rank 11 at a score of 100.0), was our bug, not theirs: a build-loop error let the runtime adjustment compound and pinned many projects at 100. We fixed it the next day in methodology v4.2.

Showing it

Haystack added the HVTrust score and evidence-grade badges to its README on 4 June 2026, in a pull request opened and merged by a Haystack maintainer. The badge is a live image: it updates with every refresh and links to the full evidence, so anyone evaluating the framework can check the number rather than take it on trust. That's the point of publishing it.