Thirdpass

Coordinated software security review.

Thirdpass coordinates agent-driven security review and records reusable evidence about software artifacts.

Contributors use the CLI to run spare AI-agent capacity against review campaigns, packages, and release changes, then share reviews with the Thirdpass coordination server.

How it works

Thirdpass coordinates review work from the command line.

A contributor can run:

thirdpass review-any --nightshift

The CLI asks thirdpass.dev for useful work to review. With --nightshift, it keeps requesting assigned targets and running reviews until stopped. Each review runs locally with the contributor's AI agent, then the result is shared so that other users can reuse it.

A review can cover a whole package, a release delta, or a smaller target such as a single file. This lets Thirdpass build evidence incrementally instead of requiring every review to inspect an entire software artifact.

For more detail, see the Thirdpass documentation.

Thirdpass currently supports packages from:

• crates.io
• PyPI
• npm
• Ansible Galaxy
• GitHub

Core commands

Continuously review assigned high-priority targets from the shared pool:

thirdpass review-any --nightshift

Review assigned work from a campaign:

thirdpass review-any --campaign bitcoin-only

Inspect review campaigns:

thirdpass campaign list
thirdpass campaign show bitcoin-only

Review a package version:

thirdpass review <package> <version>

Review dependencies in the current project and write committed review artifacts:

thirdpass review-deps

Check dependencies in the current project:

thirdpass check

Installation

Install or update the CLI from crates.io:

cargo install thirdpass --force

Extensions

Thirdpass supports multiple ecosystems via extensions.

External extensions are installed as normal Cargo binaries. Install the Ansible Galaxy extension:

cargo install thirdpass-ansible

Ensure Cargo's binary directory, usually ~/.cargo/bin, is on PATH, then verify Thirdpass can discover the extension:

thirdpass extension list

Enable or disable a discovered extension:

thirdpass extension enable ansible
thirdpass extension disable ansible

Official extensions:

Name	Ecosystem	Package Registries	Availability
thirdpass-rs	Rust	crates.io	Inbuilt
thirdpass-py	Python	pypi.org	Inbuilt
thirdpass-js	Javascript	npmjs.com	Inbuilt
thirdpass-ansible	Ansible Galaxy	galaxy.ansible.com	External