Scyvera hits 3,264 PyPI downloads, scores your AI agent's blast radius 0-100
Trout_dev · reddit · 2026-11-07
Open-source project Scyvera (MIT, framework-independent) has crossed 3,264 PyPI downloads (972 in the last 30 days), with v1.3.0 shipped Nov 5.
It targets a real gap: prompts are advisory and code review is a snapshot — most agent setups can't answer "what was this agent allowed to do, and can you prove it afterward?"
Key features:
- scyvera audit . scans scripts, Dockerfiles and CI run: blocks, producing a 0-100 blast radius score
- --generate contract.yaml drafts a contract from findings
- ContractEnforcer enforces default-deny at runtime and logs every decision
- The registry is hash-chained, so tampering with history is detectable
The author admits downloads include CI runs and is actively seeking feedback from people running it against real agents.
Related event: Open-Source Scyvera Scores AI Agent Risk, Hits 3,000+ Downloads(2 posts)→
More from coding & agent
- Dev designs a cybersecurity agent that remembers past attacks with Hindsight — Adventurous-Ant-9370 · 2026-11-07
- Solo dev: most bad LLM coach answers traced to my context, not the model — Aksel_010 · 2026-11-07
- New blog: how your RL judge and credit assignment shape model reasoning quality — tokenbender · 2026-11-07
- Enzyme open-sources a personal agent memory layer saving 40% tokens vs grep — _AustinCalvert_ · 2026-11-07
- Qoder lands stealth model 'Qoduck', free daily for individual users for limited time — hey_abusiddik · 2026-11-07
- Agent autonomy should be earned in stages, not assumed, argues dev — Few-Garlic2725 · 2026-11-07