Installation¶

TrustSight requires Python 3.12 or later and git (for cloning AUR repositories during analysis).

pip¶

pip install trustsight

This installs the tool and its core dependencies: pygit2, tldextract, rich, and openai.

From source¶

git clone https://github.com/emiliano-go/trustsight.git
cd trustsight
pip install -e .

The editable install (-e) lets you pull and test new versions immediately.

LLM setup (optional)¶

TrustSight scores every package without an LLM. The scoring pipeline is fully deterministic : the LLM never calculates, modifies, or influences a score. It only translates the existing score and breakdown into a plain-English sentence. See how the trust model works for a deeper explanation.

If you want English verdicts instead of template strings, set an API key:

# Environment variable (recommended : never checked into repos)
export TRUSTSIGHT_API_KEY=sk-...

# Or stored in config
trustsight config set api_key sk-...

The provider defaults to openai (compatible with OpenAI, NVIDIA, Together, and any OpenAI-compatible endpoint). To change the model or provider:

trustsight config set base_url https://integrate.api.nvidia.com/v1

If no API key is configured, template verdicts are used. The tool works identically in either mode : only the prose changes.

Verify the installation¶

trustsight --help

You should see a list of available commands: review, inspect, history, config.

Check your configuration:

trustsight config show

Common failures¶