OpenSSF AI-readiness

[sevansdell]

I would propose at the TAC level a review of all tools and technical capabilities OpenSSF drives or supports to be evaluated for agentic development readiness.

Objective: Assure that the OpenSSF tool chain is a capability for any coding assistant or model using modern interfaces etc.

• Do the tools have the right APIs, how can they be expressed to an agentic coder?
• Are there any connective tissue to the existing AI coding assistants and foundation models?

I am happy to help actively participate in this effort. How should we best initiate it?

[TracyRagan]

I think this is an important direction, especially as agentic workflows increasingly sit between developers and the security toolchain. Ensuring OpenSSF tools remain usable from coding assistants and model-driven environments makes sense strategically.

That said, there are some concerns from the perspective of constrained or volunteer-driven projects. “Agentic readiness” isn’t yet clearly defined and could imply anything from structured APIs to MCP-style descriptors or IDE integrations. Retrofitting those capabilities could be a significant lift for smaller projects without additional maintainer capacity.

There’s also a risk of optimizing too early for a rapidly evolving interface layer, or unintentionally creating expectations that shift project priorities from supply chain security outcomes toward assistant-facing ergonomics.

It would help to clarify whether this effort is intended as an informational capability inventory or something more normative. Starting with a lightweight, voluntary readiness rubric and piloting with a few already API-forward tools could make this much easier for constrained projects to participate in.

[sevansdell]

Thanks for great conversation in the TAC meeting today on this topic. I think a potential take-away is:

Can we drive this through AI/ML WG? Mihai (@mihaimaruseac) and Sarah (@sevansdell) willing to lead/ create guidance. Then expand guidance more broadly through OpenSSF (e.g. TAC lifecycle) and then out into others in ecosystem.