Pkgtruth offers four core capabilities to secure software supply chains: Compare to identify added, missing, or modified files and metadata; Investigate to examine security-relevant indicators such as executable .pth files and unexpected imports; Explain through AI-assisted explanations of findings; and Decide with deterministic policies to recommend ALLOW, REVIEW, or BLOCK.

The final takeaway is to rethink software supply-chain security by verifying the release, not just trusting the package, and viewing the problem as a journey from source to deployment.

Partner technologies note that Ollama and Qwen are used for local AI integration, not as official MLH partners.

The hackathon experience shows a shift from simple file comparison to a safe, evidence-based security workflow, acknowledging that not all differences indicate danger.

What comes next points to expanding beyond Python/PyPI, strengthening provenance verification, and production-hardening the tool.

A small example contrasts reviewed source code with a published wheel containing startup.pth, illustrating the need to assess evidence rather than assume malice.

The central challenge is comparing GitHub-reviewed source code with the published package on a registry like PyPI, and distinguishing meaningful differences from benign packaging variations.

Demonstration scenarios cover a normal release, unexpected changes such as an executable .pth, and unresolved provenance to show how pkgtruth handles uncertainty.

The project emphasizes AI that explains evidence rather than delivering security verdicts, using a locally hosted model (Qwen 3.5 4B via Ollama) to generate explanations while keeping deterministic analysis separate.

The demo workflow outlines steps: provide the package and source, inspect, compare, investigate, review evidence, and generate a report.

Pkgtruth originated from Hacktoberfest 2026 Hack Day by Team Commit-tee to tackle the Problem Statement 4: Published Package vs Source Code Integrity Analyzer.

The technology stack includes HTML/CSS/HTMX for frontend, Python with FastAPI for backend, and local AI integration, with no installation or execution of the investigated package.