Public record
Software health reportschema 0.34.0 · metrics 2.10.0 · 2026-10-21 00:33 UTC

NVIDIA / TensorRT-LLM

TensorRT LLM provides users with an easy-to-use Python API to define Large Language Models (LLMs) and supports state-of-the-art optimizations to perform inference efficiently on NVIDIA GPUs. TensorRT LLM also contains components to create Python and C++ runtimes that orchestrate the inference execution in a performant way.

Python · C++Custom license★ 14,882 stars⑂ 2,842 forkssince Aug 2023View on GitHub ↗
KindNetwork serviceCommand-line toolMCP serverLibraryhow this is determined
#blackwell#cuda#moe#pytorch#llm-serving

NVIDIA/TensorRT-LLM holds a health index of 98 out of 100, placing it in the Exceptional band. It scores highest on Vitality (100/100) and lowest on Security (51/100). It was last updated today. 24 contributors account for most of its recent work.

98
overall / 100
Exceptional

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.

98
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
VitalityCommunity &AdoptionSustainability &GovernanceEngineeringQualitySecurityAI Readiness

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

The weighted overall 87 is calibrated to 98 on the published index scale (record calibration 2026-08-02).

Ownership

NVIDIA CorporationOrganization · verified domain
31,544 followers824 public repossince May 2012

This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.

Package ecosystems

RegistryPackageVersionDownloads / moVersionsLast publishTags
PyPItensorrt_llm1.2.1-156183 days agonvidiatensorrtdeeplearninginference
PyPItensorrt-llm1.2.115,070156183 days agonvidiatensorrtdeeplearninginference

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

100Exceptional · 21% of overall

Development activity

100Exceptional
How it's scored
36/36Push recency — last push 0 days ago
36/36Commit cadence — 52/52 weeks with commits
18/18Commit volume — 7,117 commits in the last year
0/10OpenSSF Scorecard: Maintained — no data
Inputs used
commits_last_year7,117
human_commit_share1
days_since_last_push0
active_weeks_last_year52

Release discipline

100Exceptional
How it's scored
27/27Ships releases — 93 releases published
36/36Release recency — latest release 6 days ago
27/27Release cadence — a release every ~10.1 days
0/10OpenSSF Scorecard: Signed-Releases — no data
Inputs used
releases_count93
latest_release_tagv1.4.0rc0
releases_from_tagsno
days_since_latest_release6
mean_days_between_releases10.1

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

86Excellent · 17% of overall

Popularity & adoption

97Exceptional
How it's scored
60/60Stars — 14,882 stars
25/25Forks — 2,842 forks
11.6/15Watchers — 122 watchers
Inputs used
forks2,842
stars14,882
watchers122
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Community health

86Excellent
How it's scored
22.5/22.5README
16.9/22.5License — license file present, not a recognized license
18/18CONTRIBUTING guide
13.5/13.5Code of conduct
0/7.2Issue template
6.3/6.3PR template
Inputs used
has_readmeyes
has_licenseyes
readme_badges7
has_contributingyes
has_issue_templateno
has_code_of_conductyes
readme_badge_servicesshields.io
has_pull_request_templateyes

Ecosystem adoption (downloads)

70Good
How it's scored
55.7/80Monthly downloads — 15,070 downloads/month across pypi
0/20Registry dependents — not reported by this ecosystem
Inputs used
packagestensorrt_llm, tensorrt-llm
dependents—
ecosystemspypi
total_downloads—
monthly_downloads15,070
unverified_packages_excluded—
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

93Exceptional · 23% of overall

Maintainer resilience (bus factor)

98Exceptional
How it's scored
54/54Bus factor — 24 contributor(s) cover half of all commits
21.1/22.5Commit distribution — top contributor authored 6% of commits
13.5/13.5Contributor breadth — 100 contributors
0/10OpenSSF Scorecard: Contributors — no data
Inputs used
bus_factor24
contributors_sampled100
top_contributor_share0.062

Issue & PR responsiveness

80Excellent
How it's scored
35.2/42Issue resolution — 84% of issues closed
22.1/30PR acceptance — 11,196/15,229 decided PRs merged
0/13Newcomer PR acceptance — no first-time contributor's PR decided in 30d
0/15OpenSSF Scorecard: Code-Review — no data
Inputs used
merged_prs11,196
open_issues675
closed_issues3,468
prs_merged_7d34
prs_decided_7d39
prs_merged_30d36
prs_decided_30d41
issue_closed_ratio0.837
closed_unmerged_prs4,033
first_time_authors_30d0
first_time_prs_merged_30d0
first_time_prs_decided_30d0
Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.

Ownership & stewardship

100Exceptional
How it's scored
30/30Ownership backing — organization-owned
20/20Verified domain
25/25Owner reach — 31,544 followers of NVIDIA
25/25Track record — 824 public repos, account ~14 yr old
Inputs used
followers31,544
owner_typeOrganization
is_verifiedyes
owner_loginNVIDIA
public_repos824
account_age_days5,276

Package maintenance

91Excellent
How it's scored
25/25Published & resolvable — 2 package(s) on pypi
26/35Publish recency — latest publish 183 days ago
20/20Version history — 156 published versions
20/20Not deprecated — active, not deprecated or yanked
Inputs used
packagestensorrt_llm, tensorrt-llm
ecosystemspypi
any_deprecatedno
min_days_since_publish183

Engineering Quality

Are baseline engineering and documentation practices in place?

100Exceptional · 19% of overall

Engineering practices

100Exceptional
How it's scored
24/24CI workflows — 22 workflow(s)
24/24Tests present
16/16Linter config — agent-flow/pyproject.toml ([tool.ruff]), pyproject.toml ([tool.ruff], [tool.isort], [tool.yapf])
9.6/9.6Pre-commit hooks
6.4/6.4.editorconfig
0/20OpenSSF Scorecard: CI-Tests — no data
Inputs used
has_ciyes
has_testsyes
has_editorconfigyes
has_linter_configyes
has_precommit_configyes

Documentation

100Exceptional
How it's scored
30/30README
25/25Documentation directory
15/15Documentation / homepage site — https://nvidia.github.io/TensorRT-LLM
10/10Repository description
10/10Topics — 5 topics
10/10Wiki
Inputs used
topicsblackwell, cuda, moe, pytorch, llm-serving
has_wikiyes
homepagehttps://nvidia.github.io/TensorRT-LLM
docs_sitehttps://nvidia.github.io/TensorRT-LLM
has_readmeyes
has_docs_diryes
has_descriptionyes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

51Moderate · 16% of overall

Security posture

55Moderate
How it's scored
30/30Security policy (SECURITY.md)
0/25Dependabot config
25/25Dependency lockfiles — poetry.lock, uv.lock
0/20CodeQL workflow
Inputs used
sourcefile_signals
lockfilespoetry.lock, uv.lock
manifestsagent-flow/pyproject.toml, docs/requirements.txt, pyproject.toml, requirements-build-openengine.txt, requirements-dev.txt, requirements-grpc-smg.txt, requirements.txt, security_scanning/pyproject.toml, setup.py, triton_backend/requirements.txt
has_codeql_workflowno
has_security_policyyes
has_dependabot_configno

Dependency advisories

36Weak
How it's scored
4.5/35Direct dependencies free of known advisories — 7 affected: anyio 4.13.0 (critical 9.1), mcp 1.27.1 (high 7.6), protobuf 5.27.2 (high 7.5), +4 more
0/25Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
22.8/40No advisories left outstanding — 4 advisory-carrying package(s) unaddressed past 90 days; oldest published 491 days ago
Inputs used
sourceosv
advisories152
affected_packages20
assessed_packages134
unassessed_packages178
affected_by_severitycritical 3, high 12, moderate 5
direct_affected_packages7
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 134 resolved dependencies against OSV. 178 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.

81Excellent · 4% of overall

Agent context & guidance

100Exceptional
How it's scored
45/45Agent instructions — .codex/AGENTS.md, AGENTS.md, CLAUDE.md, agent-flow/AGENTS.md, agent-flow/CLAUDE.md, cpp/tensorrt_llm/batch_manager/kv_cache_manager_v2/AGENTS.md, tensorrt_llm/runtime/kv_cache_manager_v2/AGENTS.md, tensorrt_llm/runtime/kv_cache_manager_v2/CLAUDE.md, tests/AGENTS.md, tests/CLAUDE.md, tests/integration/defs/visual_gen/AGENTS.md, tests/integration/defs/visual_gen/CLAUDE.md, tests/unittest/_torch/visual_gen/AGENTS.md, tests/unittest/_torch/visual_gen/CLAUDE.md
15/15Machine-readable docs (llms.txt) — llms.txt served by the project website (https://modal.com/llms.txt)
40/40Legible commit history — 81 of 100 human commits state their intent (structured subject or explanatory body)
Inputs used
has_llms_txtyes
llms_txt_urlhttps://modal.com/llms.txt
legible_history_share0.81
agent_instruction_files.codex/AGENTS.md, AGENTS.md, CLAUDE.md, agent-flow/AGENTS.md, agent-flow/CLAUDE.md, cpp/tensorrt_llm/batch_manager/kv_cache_manager_v2/AGENTS.md, tensorrt_llm/runtime/kv_cache_manager_v2/AGENTS.md, tensorrt_llm/runtime/kv_cache_manager_v2/CLAUDE.md, tests/AGENTS.md, tests/CLAUDE.md, tests/integration/defs/visual_gen/AGENTS.md, tests/integration/defs/visual_gen/CLAUDE.md, tests/unittest/_torch/visual_gen/AGENTS.md, tests/unittest/_torch/visual_gen/CLAUDE.md
agent_instruction_max_bytes33,470

Verify loop (build / test / typecheck)

72Good
How it's scored
18/18One-command bootstrap — cpp/kernels/fmha_v2/Makefile, cpp/kernels/fmha_v2/train_ops/Makefile, cpp/kernels/xqa/nvrtc/Makefile, docker/Makefile, docs/Makefile, enroot/Makefile
22/22Automated tests
11/11Lint / format config — agent-flow/pyproject.toml ([tool.ruff]), pyproject.toml ([tool.ruff], [tool.isort], [tool.yapf])
0/11Static type checking
10/10Reproducible environment — devcontainer, Dockerfile, lockfile
4/10Demonstrated agent practice — 2 of the last 100 commits agent-authored or agent-credited
0/8Automated maintenance — no automated dependency updates observed
0/10OpenSSF Scorecard: Pinned-Dependencies — no data
Inputs used
has_nixno
has_testsyes
lockfilespoetry.lock, uv.lock
has_dockerfileyes
typed_languageno
bootstrap_filescpp/kernels/fmha_v2/Makefile, cpp/kernels/fmha_v2/train_ops/Makefile, cpp/kernels/xqa/nvrtc/Makefile, docker/Makefile, docs/Makefile, enroot/Makefile
has_devcontaineryes
has_linter_configyes
typecheck_configs—
agent_commit_share0.02
toolchain_manifests—
dependency_bot_commit_share0

Code legibility for models

51Moderate
How it's scored
0/45Type-checkable code — Python without a type-check config
51.2/55Manageable file sizes — 346/4,998 source files over 60KB
Inputs used
primary_languagePython
largest_source_bytes7,622,873
source_files_sampled4,998
oversized_source_files346

Machine-readable interfaces

100Exceptional
How it's scored
40/40API schema (OpenAPI/GraphQL/proto) — tensorrt_llm/grpc/openengine/proto/openengine/v1/error.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/generation.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/kv.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/lifecycle.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/lora.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/model.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/openengine.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/server.proto
20/20MCP server
40/40Runnable examples — examples
Inputs used
example_dirsexamples
has_mcp_signalyes
api_schema_filestensorrt_llm/grpc/openengine/proto/openengine/v1/error.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/generation.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/kv.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/lifecycle.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/lora.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/model.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/openengine.proto, tensorrt_llm/grpc/openengine/proto/openengine/v1/server.proto
interfaces_expected_ofnetwork-service

Key facts

14,882GitHub stars
100contributors
7,117commits, last 12 months
0days since last push
93releases
24bus factor
675open issues
PyPIpackage ecosystems

Data collection warnings

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
  • First-time contributor figures cover 12 of 27 authors (cap 12)
  • pypi download statistics for 'tensorrt_llm' unavailable this scan (stats endpoint failed after retries); adoption may be under-evidenced
  • Could not fetch pypi package 'agent-flow' from its registry
  • OpenSSF Scorecard timed out after 240s; skipping Scorecard checks

More detail

Star and fork history 0 ★ / 2,842 ⇿
0Stars
2,842Forks
45Releases

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

Only the most recent history is shown — this repository exceeds the collection window, so the earliest history is not captured.

1,5002,0002,5003,0002,842102025-112026-052026-10
Major 0Minor 2Patch 1
Direct dependencies 88
RegistryPackageVersion constraintManifest
PyPIanyio>=4.0agent-flow/pyproject.toml
PyPIpyyaml>=6.0agent-flow/pyproject.toml
PyPIrich>=13.0agent-flow/pyproject.toml
PyPIclaude-agent-sdk==0.2.162agent-flow/pyproject.toml
PyPIopenai-codex==0.154.0agent-flow/pyproject.toml
PyPIaccelerate(>=1.7.0)security_scanning/pyproject.toml
PyPIbuild(>=1.6.1,<2.0.0)security_scanning/pyproject.toml
PyPIcolored(>=2.3.2,<3.0.0)security_scanning/pyproject.toml
PyPIcuda-python(>=13)security_scanning/pyproject.toml
PyPIdiffusers(>=0.40.0,<0.41)security_scanning/pyproject.toml
PyPIsafetensors(>=0.8.0)security_scanning/pyproject.toml
PyPIftfy(>=6.3.1,<7.0.0)security_scanning/pyproject.toml
PyPIlark(>=1.3.1,<2.0.0)security_scanning/pyproject.toml
PyPIlazy-loader(>=0.5,<1.0)security_scanning/pyproject.toml
PyPImpi4py(>=4.1.2,<5.0.0)security_scanning/pyproject.toml
PyPInumpy(>=2.0.0,<2.4)security_scanning/pyproject.toml
PyPIgraphviz(>=0.21,<0.22)security_scanning/pyproject.toml
PyPIopenai(>=3.35.1,<4.0.0)security_scanning/pyproject.toml
PyPIpolygraphy(>=0.53.6,<0.54.0)security_scanning/pyproject.toml
PyPIpsutil(>=7.2.2,<8.0.0)security_scanning/pyproject.toml
PyPInvidia-ml-py(>=13)security_scanning/pyproject.toml
PyPIh5py(==3.12.1)security_scanning/pyproject.toml
PyPIstrenum(>=0.4.15,<0.5.0)security_scanning/pyproject.toml
PyPIsentencepiece(>=0.1.99)security_scanning/pyproject.toml
PyPItorch(>=2.14.0a0,<=2.14.0)security_scanning/pyproject.toml
PyPItorchvision(>=0.29.1,<0.30.0)security_scanning/pyproject.toml
PyPInvidia-nccl-cu13(>=2.30.7,<=2.31.2)security_scanning/pyproject.toml
PyPInccl4py(>=0.4,<=0.5)security_scanning/pyproject.toml
PyPItransformers(==5.5.4)security_scanning/pyproject.toml
PyPIprometheus-client(>=0.26.0,<0.27.0)security_scanning/pyproject.toml
PyPIprometheus-fastapi-instrumentator(>=8.1.0)security_scanning/pyproject.toml
PyPIpydantic(>=2.9.1)security_scanning/pyproject.toml
PyPImsgspec(>=0.22.0,<0.23.0)security_scanning/pyproject.toml
PyPIomegaconf(>=2.4.0,<3.0.0)security_scanning/pyproject.toml
PyPIpynvvideocodec(>=2.1.0,<2.2.0)security_scanning/pyproject.toml
PyPIoptimum(>=2.3.0,<3.0.0)security_scanning/pyproject.toml
PyPIdatasets(>=5.1.0,<6.0.0)security_scanning/pyproject.toml
PyPIevaluate(>=0.4.6,<0.5.0)security_scanning/pyproject.toml
PyPImpmath(>=1.3.0)security_scanning/pyproject.toml
PyPIclick(>=8.4.2)security_scanning/pyproject.toml
PyPIclick-option-group(>=0.5.3)security_scanning/pyproject.toml
PyPIaenum(>=3.1.17,<4.0.0)security_scanning/pyproject.toml
PyPIpyzmq(>=27.2.0,<28.0.0)security_scanning/pyproject.toml
PyPIfastapi(>=0.136.3,<0.140.0)security_scanning/pyproject.toml
PyPIstarlette(>=1.3.1)security_scanning/pyproject.toml
PyPIuvicorn(>=0.54.0,<0.55.0)security_scanning/pyproject.toml
PyPIsetuptools(<80)security_scanning/pyproject.toml
PyPIpackaging(>=24.2)security_scanning/pyproject.toml
PyPIordered-set(>=4.1.0,<5.0.0)security_scanning/pyproject.toml
PyPIpeft(>=0.18.1,<0.19.0)security_scanning/pyproject.toml
PyPIpatchelf(>=0.19.1.0,<0.20.0.0)security_scanning/pyproject.toml
PyPIeinops(>=0.8.2,<0.9.0)security_scanning/pyproject.toml
PyPIfla-core(==0.5.2)security_scanning/pyproject.toml
PyPIflashinfer-python(==0.6.18)security_scanning/pyproject.toml
PyPIxgrammar(==0.1.32)security_scanning/pyproject.toml
PyPIllguidance(==0.7.29)security_scanning/pyproject.toml
PyPIjsonschema(>=4.26.0,<5.0.0)security_scanning/pyproject.toml
PyPIbackoff(>=2.2.1,<3.0.0)security_scanning/pyproject.toml
PyPInvtx(>=0.2.16,<0.3.0)security_scanning/pyproject.toml
PyPImeson(>=1.12.1,<2.0.0)security_scanning/pyproject.toml
PyPIninja(>=1.13.2,<2.0.0)security_scanning/pyproject.toml
PyPIsoundfile(>=0.14.0,<0.15.0)security_scanning/pyproject.toml
PyPItriton(==3.8.0)security_scanning/pyproject.toml
PyPItiktoken(>=0.14.0,<0.15.0)security_scanning/pyproject.toml
PyPIblobfile(>=3.3.0,<4.0.0)security_scanning/pyproject.toml
PyPIopenai-harmony(==0.0.4)security_scanning/pyproject.toml
PyPInvidia-cutlass-dsl(==4.8.0)security_scanning/pyproject.toml
PyPInvidia-matmul-heuristics(==0.1.0.27)security_scanning/pyproject.toml
PyPIquack-kernels(==0.5.0)security_scanning/pyproject.toml
PyPIjinja2(>=3.1.6,<4.0.0)security_scanning/pyproject.toml
PyPIplotly(>=7.1.0,<8.0.0)security_scanning/pyproject.toml
PyPIpartial-json-parser(>=0.2.1.1.post7,<0.3.0.0)security_scanning/pyproject.toml
PyPImcp(>=1.23.0,<2.0.0)security_scanning/pyproject.toml
PyPItorch-c-dlpack-ext(==0.1.3)security_scanning/pyproject.toml
PyPIflash-attn-4(==4.0.0b19)security_scanning/pyproject.toml
PyPImistral-common(>=1.10.0)security_scanning/pyproject.toml
PyPItorchao(>=0.14.1,<0.16.0)security_scanning/pyproject.toml
PyPIcuda-core(>=1.2.2,<2.0.0)security_scanning/pyproject.toml
PyPIcuda-tile(>=1.0.1)security_scanning/pyproject.toml
PyPInvidia-cuda-tileiras(>=13.1,<13.2)security_scanning/pyproject.toml
PyPIetcd-sdk-python(==0.0.7)security_scanning/pyproject.toml
PyPIgrpcio(>=1.67.1,<2)security_scanning/pyproject.toml
PyPIprotobuf(>=6.30.2,<7)security_scanning/pyproject.toml
PyPIpython-multipart(>=0.0.32,<0.0.33)security_scanning/pyproject.toml
PyPIcache-dit(>=1.3.5)security_scanning/pyproject.toml
PyPImsgpack(>=1.2.3,<2.0.0)security_scanning/pyproject.toml
PyPIuvloop(>=0.19.0,<0.23.0)security_scanning/pyproject.toml
PyPImooncake-transfer-engine-cuda13(==0.3.13)security_scanning/pyproject.toml
All dependencies 312

Full resolved dependency set from the GitHub dependency graph: 114 direct and 198 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

RegistryPackageVersionRelation
PyPIaccelerate—direct
PyPIaenum—direct
PyPIanyio—direct
PyPIanyio4.13.0direct
PyPIanyio4.14.2direct
PyPIbackoff—direct
PyPIblobfile—direct
PyPIbuild—direct
PyPIcache-dit—direct
PyPIclaude-agent-sdk0.2.162direct
PyPIclick—direct
PyPIclick8.3.3direct
PyPIclick8.4.2direct
PyPIclick-option-group—direct
PyPIcolored—direct
PyPIcuda-core—direct
PyPIcuda-python—direct
PyPIcuda-tile—direct
PyPIdatasets—direct
PyPIdatasets3.1.0direct
PyPIdiffusers—direct
PyPIdiffusers0.40.0direct
PyPIeinops—direct
PyPIetcd-sdk-python0.0.7direct
PyPIevaluate—direct
PyPIfastapi—direct
PyPIfla-core0.5.2direct
PyPIflash-attn-44.0.0b19direct
PyPIflashinfer-python0.6.18direct
PyPIftfy—direct
PyPIgraphviz—direct
PyPIgrpcio—direct
PyPIgrpcio1.67.1direct
PyPIh5py—direct
PyPIh5py3.12.1direct
PyPIjinja2—direct
PyPIjsonschema—direct
PyPIjsonschema4.26.0direct
PyPIlark—direct
PyPIlazy-loader—direct
PyPIllguidance0.7.29direct
PyPImcp—direct
PyPImcp1.27.1direct
PyPImeson—direct
PyPImistral-common—direct
PyPImooncake-transfer-engine-cuda130.3.13direct
PyPImpi4py—direct
PyPImpmath—direct
PyPImpmath1.3.0direct
PyPImsgpack—direct
PyPImsgspec—direct
PyPInccl4py—direct
PyPIninja—direct
PyPInumpy—direct
PyPInumpy2.4.6direct
PyPInumpy2.5.1direct
PyPInvidia-cuda-tileiras—direct
PyPInvidia-cutlass-dsl4.8.0direct
PyPInvidia-matmul-heuristics0.1.0.27direct
PyPInvidia-ml-py—direct
PyPInvidia-nccl-cu13—direct
PyPInvtx—direct
PyPIomegaconf—direct
PyPIopenai—direct
PyPIopenai2.36.0direct
PyPIopenai-codex0.154.0direct
PyPIopenai-harmony0.0.4direct
PyPIoptimum—direct
PyPIordered-set—direct
PyPIpackaging—direct
PyPIpackaging26.2direct
PyPIpartial-json-parser—direct
PyPIpatchelf—direct
PyPIpeft—direct
PyPIplotly—direct
PyPIpolygraphy—direct
PyPIprometheus-client—direct
PyPIprometheus-fastapi-instrumentator—direct
PyPIprotobuf—direct
PyPIprotobuf5.27.2direct
PyPIprotobuf7.35.1direct
PyPIpsutil—direct
PyPIpydantic—direct
PyPIpydantic2.13.4direct
PyPIpynvvideocodec—direct
PyPIpython-multipart—direct
PyPIpython-multipart0.0.28direct
PyPIpyyaml—direct
PyPIpyyaml6.0.3direct
PyPIpyzmq—direct
PyPIquack-kernels0.5.0direct
PyPIrich—direct
PyPIrich15.0.0direct
PyPIsafetensors—direct
PyPIsentencepiece—direct
PyPIsetuptools—direct
PyPIsetuptools84.0.0direct
PyPIsoundfile—direct
PyPIstarlette—direct
PyPIstarlette1.0.0direct
PyPIstrenum—direct
PyPItiktoken—direct
PyPItiktoken0.12.0direct
PyPItiktoken0.13.0direct
PyPItorch—direct
PyPItorch-c-dlpack-ext0.1.3direct
PyPItorchao—direct
PyPItorchvision—direct
PyPItransformers5.5.4direct
PyPItriton3.8.0direct
PyPIuvicorn—direct
PyPIuvicorn0.46.0direct
PyPIuvloop—direct
PyPIxgrammar0.1.32direct
PyPIabsl-py—indirect
PyPIabsl-py2.5.0indirect
PyPIaiohttp3.14.2indirect
PyPIaiperf—indirect
PyPIaiperf0.8.0indirect
PyPIannotated-doc0.0.4indirect
PyPIannotated-types0.7.0indirect
PyPIapache-tvm-ffi0.1.13.post2indirect
PyPIattrs26.1.0indirect
PyPIautodoc-pydantic—indirect
PyPIav—indirect
PyPIbandit1.7.7indirect
PyPIblake3—indirect
PyPIboto3—indirect
PyPIbreathe—indirect
PyPIcertifi2026.4.22indirect
PyPIcertifi2026.6.17indirect
PyPIcffi2.0.0indirect
PyPIcharset-normalizer3.4.7indirect
PyPIcharset-normalizer3.4.9indirect
PyPIcloudpickle—indirect
PyPIcolorama—indirect
PyPIcolorama0.4.6indirect
PyPIcryptography48.0.0indirect
PyPIcupti-python—indirect
PyPIcxxfilt—indirect
PyPIdecord—indirect
PyPIdefusedxml0.7.1indirect
PyPIdill0.3.8indirect
PyPIdistro1.9.0indirect
PyPIdocstring-parser—indirect
PyPIemoji—indirect
PyPIexceptiongroup1.3.1indirect
PyPIfilelock3.32.0indirect
PyPIfire—indirect
PyPIflash-attn—indirect
PyPIflash-linear-attention0.5.2indirect
PyPIflask—indirect
PyPIfsspec2024.9.0indirect
PyPIgdown—indirect
PyPIgenai-perf0.0.13indirect
PyPIgitpython—indirect
PyPIgrpcio-tools1.67.1indirect
PyPIh110.16.0indirect
PyPIhf-transfer0.1.9indirect
PyPIhf-xet1.5.2indirect
PyPIhttpcore1.0.9indirect
PyPIhttpx—indirect
PyPIhttpx0.28.1indirect
PyPIhttpx-sse0.4.3indirect
PyPIhuggingface-hub1.24.0indirect
PyPIidna3.14indirect
PyPIidna3.18indirect
PyPIimmutabledict—indirect
PyPIiniconfig2.3.0indirect
PyPIipython—indirect
PyPIjieba—indirect
PyPIjieba0.42.1indirect
PyPIjiter0.14.0indirect
PyPIjoblib1.5.3indirect
PyPIjsonlines4.0.0indirect
PyPIjsonschema-specifications2025.9.1indirect
PyPIjupyter-server—indirect
PyPIjupyterlab—indirect
PyPIlangdetect—indirect
PyPIlatex2sympy2—indirect
PyPIlatex2sympy2-extended—indirect
PyPIlibrosa—indirect
PyPIline-profiler—indirect
PyPIllist—indirect
PyPIlm-eval0.4.10indirect
PyPIlm-eval0.4.8indirect
PyPIlpips—indirect
PyPImako—indirect
PyPImarkdown-it-py4.2.0indirect
PyPImath-verify—indirect
PyPImatplotlib—indirect
PyPImdurl0.1.2indirect
PyPImistune—indirect
PyPImultidict6.7.1indirect
PyPImultiprocess0.70.16indirect
PyPImypy1.19.1indirect
PyPImyst-parser—indirect
PyPInanobind—indirect
PyPInemo-toolkit2.0.0rc1indirect
PyPInixl-cu131.4.0indirect
PyPInltk—indirect
PyPInltk3.10.0indirect
PyPInotebook—indirect
PyPInumexpr—indirect
PyPInumpy-typing-compat—indirect
PyPInvidia-cuda-cupti—indirect
PyPInvidia-cuda-nvrtc—indirect
PyPInvidia-cudnn-frontend—indirect
PyPInvidia-sphinx-theme—indirect
PyPIonnx—indirect
PyPIonnx-graphsurgeon—indirect
PyPIopentelemetry-api—indirect
PyPIopentelemetry-exporter-otlp—indirect
PyPIopentelemetry-sdk—indirect
PyPIopentelemetry-semantic-conventions-ai—indirect
PyPIoyaml—indirect
PyPIpandas—indirect
PyPIpandas3.0.3indirect
PyPIparameterized—indirect
PyPIpillow—indirect
PyPIpip—indirect
PyPIpluggy1.6.0indirect
PyPIpoetry-core—indirect
PyPIpre-commit—indirect
PyPIpropcache0.5.2indirect
PyPIpulp—indirect
PyPIpyarrow25.0.0indirect
PyPIpybind11—indirect
PyPIpybind11-stubgen—indirect
PyPIpycparser3.0indirect
PyPIpydantic-core2.46.4indirect
PyPIpydantic-settings—indirect
PyPIpydantic-settings2.14.1indirect
PyPIpygit2—indirect
PyPIpygments—indirect
PyPIpygments2.20.0indirect
PyPIpyjwt2.12.1indirect
PyPIpymupdf—indirect
PyPIpytest—indirect
PyPIpytest7.2.2indirect
PyPIpytest9.0.3indirect
PyPIpytest-asyncio—indirect
PyPIpytest-cov—indirect
PyPIpytest-cpp2.3.0indirect
PyPIpytest-csv—indirect
PyPIpytest-env—indirect
PyPIpytest-forked—indirect
PyPIpytest-mock—indirect
PyPIpytest-rerunfailures—indirect
PyPIpytest-split—indirect
PyPIpytest-threadleak—indirect
PyPIpytest-timeout—indirect
PyPIpytest-unused-fixtures—indirect
PyPIpytest-xdist—indirect
PyPIpytest-xdist3.2.1indirect
PyPIpython-dotenv1.2.2indirect
PyPIpytz2026.2indirect
PyPIpywin32311indirect
PyPIrapidfuzz—indirect
PyPIrapidfuzz3.14.5indirect
PyPIray—indirect
PyPIreferencing0.37.0indirect
PyPIregex—indirect
PyPIregex2026.5.9indirect
PyPIregex2026.7.19indirect
PyPIrequests—indirect
PyPIrequests2.34.0indirect
PyPIrouge—indirect
PyPIrouge1.0.1indirect
PyPIrouge-score—indirect
PyPIrouge-score0.1.2indirect
PyPIrpds-py0.30.0indirect
PyPIruff0.9.4indirect
PyPIscipy—indirect
PyPIshellingham1.5.4indirect
PyPIsmg-grpc-proto—indirect
PyPIsniffio1.3.1indirect
PyPIsoupsieve—indirect
PyPIspacy—indirect
PyPIsphinx—indirect
PyPIsphinx-argparse—indirect
PyPIsphinx-click—indirect
PyPIsphinx-copybutton—indirect
PyPIsphinx-togglebutton—indirect
PyPIsphinxcontrib-mermaid—indirect
PyPIsse-starlette3.4.4indirect
PyPIsyllapy—indirect
PyPIsympy—indirect
PyPItabulate—indirect
PyPItavily-python0.7.24indirect
PyPItavilymcp0.1.0indirect
PyPItensorrt-llm—indirect
PyPItimm—indirect
PyPItomli2.4.1indirect
PyPItornado—indirect
PyPItqdm4.67.3indirect
PyPItqdm4.69.0indirect
PyPItransformers-stream-generator0.0.4indirect
PyPItritonclient—indirect
PyPItrtllm-sbom0.1.0indirect
PyPItypeguard4.4.4indirect
PyPItyper0.25.1indirect
PyPItyping-extensions4.15.0indirect
PyPItyping-inspection0.4.2indirect
PyPItzdata2026.3indirect
PyPIurllib3—indirect
PyPIurllib32.7.0indirect
PyPIuv-build—indirect
PyPIword2number—indirect
PyPIwordllama—indirect
PyPIxxhash3.8.1indirect
PyPIyarl1.24.5indirect
Dependency advisories 20

This repository publishes no package the index resolves, so its own dependency graph was assessed — 134 packages, which also include development and test pins that never ship: 20 carry known advisories, of which 7 are direct. 178 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.

PackageVersionRelationSeverityAdvisoriesFixed in
anyio4.13.0directcritical44.14.2
nltk3.10.0indirectcritical403.10.3
pyjwt2.12.1indirectcritical292.15.0
mcp1.27.1directhigh72.2.0
protobuf5.27.2directhigh46.33.5
python-multipart0.0.28directhigh80.0.31
starlette1.0.0directhigh101.3.1
transformers5.5.4directhigh45.10.0
aiohttp3.14.2indirecthigh103.14.4
certifi2026.4.22indirecthigh22026.10.19
certifi2026.6.17indirecthigh22026.10.19
cryptography48.0.0indirecthigh750.0.0
fsspec2024.9.0indirecthigh22026.6.0
nemo-toolkit2.0.0rc1indirecthigh82.6.2
urllib32.7.0indirecthigh62.8.0
datasets3.1.0directmoderate25.0.1
idna3.14indirectmoderate23.15
multidict6.7.1indirectmoderate26.9.1
pydantic-settings2.14.1indirectmoderate12.14.2
pytest7.2.2indirectmoderate29.0.3

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable

Feedback

Spotted something off in this report, or have thoughts to share? Wrong measurements, missed tooling, ideas, questions — anything is welcome. Every message is read and gets a response.

The message is kept through sign-in.

Related records

Inspected repositories sharing catalogue tags or ecosystems with NVIDIA/TensorRT-LLM. Read them side by side →

99vllm-project/vllmA high-throughput and memory-efficient inference and serving engine for LLMsExceptional96NVIDIA/cudnn-frontendcuDNN Frontend is NVIDIA's modern, open-source entry point to the cuDNN library and a growing collection of high-performance open-source kernels.Exceptional94pytorch/TensorRTPyTorch/TorchScript/FX compiler for NVIDIA GPUs using TensorRTExceptional98sgl-project/sglangSGLang is a high-performance serving framework for large language models and multimodal models.Exceptional97flashinfer-ai/flashinferFlashInfer: Kernel Library for LLM ServingExceptional88NVIDIA/TensorRTNVIDIA® TensorRT™ is an SDK for high-performance deep learning inference on NVIDIA GPUs. This repository contains the open source components of TensorRT.Excellent

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.10.0, schema v0.34.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — PyPI.