About ACVE

Positioning

package.json → package-lock.json → npm audit → OSV is a familiar security chain. ACVE is the same pieces for an agent: the harness's own settings files are the manifest, acve.lock.json records what is actually installed, resolved, and hashed, and acve audit matches that snapshot against an OSV-compatible public advisory registry keyed to configurations, not only components. ACVE is a configuration exposure record; it is not a replacement for CVE, OSV, or runtime detection.

ACVE complements CVE and OSV. It focuses on the interaction between harnesses, models, tools, permissions, instruction files, and versions. The registry is intentionally public and PR-based; unknown coverage is reported as possible rather than silently treated as clean.

Threat model

ACVE records configuration exposure. It does not prove that an attacker has reached a machine, replace runtime monitoring, or read secrets. Lockfiles store hashes, names, scopes, and tokenised arguments while credential files and values remain out of scope.

Built and maintained by PickBits contributors.