superplane
Open source factory for one-shot engineering Publisher: superplanehq.
Publisher unconfirmed: the evidence below is shown but not counted in the governance score, because nothing yet ties this listing to superplanehq beyond repository or Hub account ownership. A vendor-domain page, marketplace listing, ARD manifest or A2A card would confirm it.
Evidence available — not a safety certification. Suitability depends on your task, deployment and permissions. Rows marked vendor-level describe superplanehq, not this agent specifically.
Traces — under attack, in defence, in incidents
none public · what a trace isNo public trace found. Nobody has published what superplane does when its inputs carry instructions it should not follow, when a tool asks for credentials, or when a task invites a destructive command. Defenders can't learn from what they can't see: run it in a sandbox before the pilot and keep the transcript, or ask the vendor to publish one.
● third-party or vendor report · ◎ this registry's own probe transcript · ⚠ data left the environment. A trace describes one version on one date; it is evidence of behaviour, never a certification. Rows marked unreviewed have not yet been checked against their source by the maintainer.
CVEs — on the official record
none linked · the registryNo CVE in the registry names this agent or its listed product. That reads "none linked in the products checked", never as a finding: a product that is not on the registry's list, or a record that names it differently, is not seen. The vendor's own advisories remain the source of truth.
Compliance evidence
4 frameworks shown"Unknown" means nothing was found in the sources checked — registries, marketplaces and the vendor's own pages. It is not a finding of non-compliance; ask the vendor.
About the vendor — inherited, not agent-specific
1 record matched at organisation levelA vendor-level registry entry proves the organisation was assessed; whether this agent is inside that scope is a question for the vendor. These rows do not count toward the agent's evidence tier.
GDPR, assembled from checks
News and chatter
last 90 days · linked with confidence ≥ 0.85Headline, link and a summary attributed to the outlet. News never changes trust or domain scores.
Technology & Software Engineering score
70Raw component / maximum, then weighted by the technology profile (adoption 30, trust 20, project 20, ecosystem 15, domain 10, governance 0, docs 5). Trust and governance are computed from the evidence on this page (vendor-level rows at half credit); the other components come from the curated workbook, whose order is the rank. Unknown components count as 0 and are never imputed.
Before you deploy
Derived from the evidence ledger. This agent is not yet in the reference set, so deployment questions (credentials, approval, data handling) are not answered here — ask the vendor.
Rules: config/deploy_rules.json. Advice for a bounded pilot, not a verdict.
Provenance
res_47130c69f8a9e878