ALTA AI Agent
by kyky2347Autonomous LLM Trading Asterism — a research-only multi-agent trading platform with evidence-first research, an auditable console, Shadow simulation and explicitly authorized broker execution.
ALTA is an open-source ai agent by kyky2347, written mainly in Python, with 1,075 GitHub stars and the Apache-2.0 license. Its code was last updated Oct 31, 2026.
Scan summary: scanned Nov 5, 2026 at commit 68c31c4. No capabilities flagged by our checks. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
68c31c4 · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings. BuildsIt installed from a fresh machine.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Secrets scanfailFlagged. This check found an issue. See the findings below.
Flagged. This check found an issue. See the findings below.Dependency audit166 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Passed. This check ran and found nothing it flags.BuildpassPassed. This check ran and found nothing it flags.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Boot & handshaken/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Network egressn/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Not applicable. This check does not apply to this kind of project, or it was not run in this scan.Reproducible (×3)n/aNot applicable. This check does not apply to this kind of project, or it was not run in this scan.
Findings (85)
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.secrets issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.pyasn1@0.6.4: 8 known vulnerabilitiesGHSA-2qm8-x737-gmw5, GHSA-9m75-vc3g-4x39, GHSA-fm9c-5rcf-2q5p, GHSA-mm57-4v3p-rchx, GHSA-2qm8-x737-gmw5 +3 more
alta-runtime/broker-python/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.urllib3@2.7.0: 9 known vulnerabilitiesPYSEC-2026-4175, PYSEC-2026-4176, PYSEC-2026-4177, PYSEC-2026-4175, PYSEC-2026-4176 +4 more
alta-runtime/broker-python/uv.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.30.0: 6 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.3.0: 1 known vulnerabilityGHSA-27r3-jxmh-p828
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.9: 3 known vulnerabilitiesGHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.6: 7 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-58mr-gqgx-xq4g, GHSA-hrr3-gc8f-f4qj, GHSA-qw65-cvwx-89v3, GHSA-w74x-v6f9-j3xg +2 more
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.markdown-it@14.3.0: 4 known vulnerabilitiesGHSA-253c-mchw-3w2r, GHSA-gfr2-rv44-r23c, GHSA-r7fv-28h4-cvq7, GHSA-vfgh-jcmw-g37q
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.source-map-js@1.2.1: 1 known vulnerabilityGHSA-68fv-2mgg-jv7q
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.systeminformation@5.33.1: 3 known vulnerabilitiesGHSA-3f7j-7jwc-fxfj, GHSA-4vjg-vx72-qq4g, GHSA-7648-jmwf-vw7j
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.undici@7.29.0: 18 known vulnerabilitiesGHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +13 more
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.vite@8.2.2: 6 known vulnerabilitiesGHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
pnpm-lock.yaml - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.aws-smithy-json@0.61.9: 1 known vulnerabilityGHSA-8ffr-xgwf-xj56
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.gix@0.81.0: 4 known vulnerabilitiesGHSA-f26g-jm89-4g65, GHSA-fr8x-3vfx-f45h, GHSA-p3hw-mv63-rf9w, GHSA-pg4w-g64p-qwhj
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.gix-fs@0.19.2: 1 known vulnerabilityGHSA-f89h-2fjh-2r9q
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.gix-pack@0.68.0: 1 known vulnerabilityGHSA-x494-mj8g-cj27
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.gix-validate@0.11.0: 1 known vulnerabilityGHSA-p3hw-mv63-rf9w
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.hickory-proto@0.25.2: 2 known vulnerabilitiesRUSTSEC-2026-0118, RUSTSEC-2026-0119
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.hickory-resolver@0.25.2: 2 known vulnerabilitiesGHSA-5j98-2g5x-46v6, GHSA-6f2x-v7q7-m7m5
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.openssl@0.10.75: 8 known vulnerabilitiesGHSA-8c75-8mhr-p7r9, GHSA-ghm9-cr32-g9qj, GHSA-hppc-g8h3-xhp3, GHSA-phqj-4mhp-q6mq, GHSA-pqf5-4pqq-29f5 +3 more
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.quinn-proto@0.11.15: 5 known vulnerabilitiesRUSTSEC-2026-0338, RUSTSEC-2026-0339, RUSTSEC-2026-0340, RUSTSEC-2026-0341, RUSTSEC-2026-0342
vendor/openai-codex/codex-rs/Cargo.lock - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@: 1 known vulnerabilityCVE-2026-87766
vendor/openai-codex/codex-rs/vendor/bubblewrap - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
alta-src/test/credential-control.test.mjs:34 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
vendor/openai-codex/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs:303 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key
vendor/openai-codex/codex-rs/app-server/README.md:2419 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: generic-api-key2 matches in this file
vendor/openai-codex/codex-rs/cli/tests/login.rs:202 - lowLow. Minor, or common in normal tools. Shown for information.Possible example credential in docs/tests: jwt
vendor/openai-codex/codex-rs/exec/tests/suite/apply_patch.rs:200 - lowLow. Minor, or common in normal tools. Shown for information.setuptools@83.0.0: 1 known vulnerabilityGHSA-xmj3-9gf7-h52w
alta-runtime/capital-python/uv.lock - lowLow. Minor, or common in normal tools. Shown for information.@hono/node-server@2.1.1: 1 known vulnerabilityGHSA-rmxm-3fg6-px4f
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.deepmerge@4.3.1: 1 known vulnerabilityGHSA-gcqx-w48m-w2h4
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.hono@4.13.5: 2 known vulnerabilitiesGHSA-5r4p-p66f-jhc7, GHSA-hxh3-vqpv-xpqv
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.ip-address@10.5.0: 5 known vulnerabilitiesGHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.js-yaml@5.2.2: 1 known vulnerabilityGHSA-r3ph-w7gj-g6xm
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.katex@0.16.47: 1 known vulnerabilityGHSA-238p-pmpm-9mq7
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.6: 1 known vulnerabilityGHSA-g3hv-75wg-m249
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.postcss-selector-parser@7.1.5: 1 known vulnerabilityGHSA-rj75-hqrm-r3gf
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.qs@6.16.0: 1 known vulnerabilityGHSA-6pq8-jhm2-2vcw
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.smol-toml@1.7.1: 1 known vulnerabilityGHSA-r4xh-jqrq-34v2
pnpm-lock.yaml - lowLow. Minor, or common in normal tools. Shown for information.actix-http@3.11.2: 1 known vulnerabilityGHSA-xhj4-vrgc-hr34
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.atomic-polyfill@1.0.3: 1 known vulnerabilityRUSTSEC-2023-0089
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.basic-toml@0.1.10: 1 known vulnerabilityRUSTSEC-2026-0374
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.bincode@1.3.3: 1 known vulnerabilityRUSTSEC-2025-0141
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.block-buffer@0.12.0: 1 known vulnerabilityGHSA-qwgh-2vcv-g2f7
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.cmov@0.5.3: 1 known vulnerabilityGHSA-3rjw-m598-pq24
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.crypto-bigint@0.5.5: 1 known vulnerabilityRUSTSEC-2026-0387
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.ctutils@0.4.2: 1 known vulnerabilityRUSTSEC-2026-0385
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.derivative@2.2.0: 1 known vulnerabilityRUSTSEC-2024-0388
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.faster-hex@0.10.0: 1 known vulnerabilityRUSTSEC-2026-0306
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.fxhash@0.2.1: 1 known vulnerabilityRUSTSEC-2025-0057
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.gix-packetline@0.21.2: 1 known vulnerabilityGHSA-2vh6-hw4j-32ww
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.gix-sec@0.13.2: 1 known vulnerabilityGHSA-7rhf-42qf-vrvc
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.gix-transport@0.55.1: 1 known vulnerabilityGHSA-9857-6mw7-fq2m
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.jsonwebtoken@9.3.1: 1 known vulnerabilityGHSA-h395-gr6q-cpjc
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.opentelemetry_sdk@0.31.0: 1 known vulnerabilityGHSA-w9wp-h8wv-79jx
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.paste@1.0.15: 1 known vulnerabilityRUSTSEC-2024-0436
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.pin-utils@0.1.0: 1 known vulnerabilityRUSTSEC-2026-0441
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.proc-macro-error2@2.0.1: 1 known vulnerabilityRUSTSEC-2026-0173
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.rustls@0.23.36: 4 known vulnerabilitiesRUSTSEC-2026-0285, RUSTSEC-2026-0346, RUSTSEC-2026-0348, RUSTSEC-2026-0349
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.rustls-webpki@0.103.13: 1 known vulnerabilityRUSTSEC-2026-0382
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.serde_with@3.17.0: 1 known vulnerabilityGHSA-7gcf-g7xr-8hxj
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.tar@0.4.45: 1 known vulnerabilityGHSA-3pv8-6f4r-ffg2
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.tokio@1.52.3: 1 known vulnerabilityRUSTSEC-2026-0386
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.unsafe-libyaml@0.2.11: 1 known vulnerabilityRUSTSEC-2024-0449
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.webpki-root-certs@1.0.5: 1 known vulnerabilityRUSTSEC-2026-0383
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.webpki-roots@1.0.5: 1 known vulnerabilityRUSTSEC-2026-0381
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.yaml-rust@0.4.5: 1 known vulnerabilityRUSTSEC-2024-0320
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.zbus_names@3.0.0: 1 known vulnerabilityRUSTSEC-2026-0371
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.zstd@0.13.3: 1 known vulnerabilityRUSTSEC-2026-0391
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.zstd-safe@7.2.4: 12 known vulnerabilitiesRUSTSEC-2026-0395, RUSTSEC-2026-0396, RUSTSEC-2026-0397, RUSTSEC-2026-0398, RUSTSEC-2026-0399 +7 more
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.zstd-sys@2.0.16+zstd.1.5.7: 1 known vulnerabilityRUSTSEC-2026-0410
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.zvariant@4.2.0: 1 known vulnerabilityRUSTSEC-2026-0370
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.zvariant_derive@4.2.0: 1 known vulnerabilityRUSTSEC-2026-0372
vendor/openai-codex/codex-rs/Cargo.lock - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
- infoInfo. A note about the project, not a problem.Ignored the repo's scanner suppression config (1 file).gitleaks.toml
Network activity
During install
registry.npmjs.org
While running
Not run — the code wasn't started in this scan
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
ALTA alternatives
View more →Similar ai agents in Finance & Trading, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| ALTA (this page) kyky2347 | 1.1k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| Daily Stock Analysis ZhuLinsen | 67k | MIT | Oct 31, 2026 | Scanned, no flagged issues |
| Vibe Trading HKUDS | 37k | MIT | Oct 30, 2026 | Scanned, no flagged issues |
| FinceptTerminal Fincept-Corporation | 33k | None found | Oct 26, 2026 | Not scanned yet |
| A Stock Data simonlin1212 | 11k | Apache-2.0 | Oct 30, 2026 | Scanned, no flagged issues |
| Bindu GetBindu | 10k | None found | Sep 6, 2026 | Not scanned yet |