free-coding-models 0.3.34 → 0.3.35

package/CHANGELOG.md

@@ -1,6 +1,23 @@
 # Changelog
 ---
 
+## [0.3.35] - 2026-04-07
+
+### Added
+- **OVHcloud AI Endpoints** — new European sovereign AI provider (8 models: Qwen3 Coder 30B MoE, GPT OSS 120B, GPT OSS 20B, Llama 3.3 70B, Qwen3 32B, R1 Distill 70B, Mistral Small 3.2, Llama 3.1 8B)
+- Free sandbox mode: 2 req/min per IP per model (no API key needed), 400 RPM with API key
+- **Now 238 models across 25 providers** (was 230/24)
+
+### SECURITY.md
+- **SECURITY.md** — full security policy with vulnerability reporting, architecture, and supply chain docs
+- **CODEOWNERS** — all changes require @vava-nessa review
+- **Dependabot** — weekly automated dependency + GitHub Actions updates (`.github/dependabot.yml`)
+- **Security Audit CI** — `npm audit` + lockfile lint on every push/PR + weekly schedule (`.github/workflows/security-audit.yml`)
+- **npm Provenance** — release workflow now publishes with `--provenance` (Sigstore-signed)
+- **SBOM generation** — Software Bill of Materials attached to every GitHub Release
+- **README trust badges** — dependency count, provenance, supply chain badges
+- **README 🛡️ Security section** — what the tool does/doesn't do, supply chain table
+
 ## [0.3.34] - 2026-04-06
 
 ### Added

package/README.md

@@ -2,8 +2,12 @@
   <img src="https://img.shields.io/npm/v/free-coding-models?color=76b900&label=npm&logo=npm" alt="npm version">
   <img src="https://img.shields.io/node/v/free-coding-models?color=76b900&logo=node.js" alt="node version">
   <img src="https://img.shields.io/npm/l/free-coding-models?color=76b900" alt="license">
-  <img src="https://img.shields.io/badge/models-230-76b900?logo=nvidia" alt="models count">
-  <img src="https://img.shields.io/badge/providers-24-blue" alt="providers count">
+  <img src="https://img.shields.io/badge/models-238-76b900?logo=nvidia" alt="models count">
+  <img src="https://img.shields.io/badge/providers-25-blue" alt="providers count">
+  <br>
+  <img src="https://img.shields.io/badge/dependencies-1-76b900?logo=npm" alt="1 dependency">
+  <img src="https://img.shields.io/badge/provenance-sigstore-blueviolet?logo=signstore" alt="npm provenance">
+  <img src="https://img.shields.io/badge/supply_chain-verified-brightgreen" alt="supply chain verified">
 </p>
 
 <h1 align="center">free-coding-models</h1>
@@ -14,7 +18,7 @@
 
 <p align="center">
   <strong>Find the fastest free coding model in seconds</strong><br>
-  <sub>Ping 230 models across 24 AI Free providers in real-time </sub><br><sub> Install Free API endpoints to your favorite AI coding tool: <br>📦 OpenCode, 🦞 OpenClaw, 💘 Crush, 🪿 Goose, 🛠 Aider, 🐉 Qwen Code, 🤲 OpenHands, ⚡ Amp, π Pi, 🦘 Rovo or ♊ Gemini in one keystroke</sub>
+  <sub>Ping 238 models across 25 AI Free providers in real-time </sub><br><sub> Install Free API endpoints to your favorite AI coding tool: <br>📦 OpenCode, 🦞 OpenClaw, 💘 Crush, 🪿 Goose, 🛠 Aider, 🐉 Qwen Code, 🤲 OpenHands, ⚡ Amp, π Pi, 🦘 Rovo or ♊ Gemini in one keystroke</sub>
 </p>
 
 
@@ -51,7 +55,7 @@ create a free account on one of the [providers](#-list-of-free-ai-providers)
 
 ## 💡 Why this tool?
 
-There are **230+ free coding models** scattered across 24 providers. Which one is fastest right now? Which one is actually stable versus just lucky on the last ping?
+There are **238+ free coding models** scattered across 25 providers. Which one is fastest right now? Which one is actually stable versus just lucky on the last ping?
 
 This CLI pings them all in parallel, shows live latency, and calculates a **live Stability Score (0-100)**. Average latency alone is misleading if a model randomly spikes to 6 seconds; the stability score measures true reliability by combining **p95 latency** (30%), **jitter/variance** (30%), **spike rate** (20%), and **uptime** (20%). 
 
@@ -65,7 +69,7 @@ It then writes the model you pick directly into your coding tool's config — so
 
 Create a free account on one provider below to get started:
 
-**230 coding models** across 24 providers, ranked by [SWE-bench Verified](https://www.swebench.com).
+**238 coding models** across 25 providers, ranked by [SWE-bench Verified](https://www.swebench.com).
 
 | Provider | Models | Tier range | Free tier | Env var |
 |----------|--------|-----------|-----------|--------|
@@ -86,6 +90,7 @@ Create a free account on one provider below to get started:
 | [SiliconFlow](https://cloud.siliconflow.cn/account/ak) | 6 | S+ → A | Free models: usually 100 RPM, varies by model | `SILICONFLOW_API_KEY` |
 | [Cerebras](https://cloud.cerebras.ai) | 4 | S+ → B | Generous free tier (developer tier 10× higher limits) | `CEREBRAS_API_KEY` |
 | [Perplexity API](https://www.perplexity.ai/settings/api) | 4 | A+ → B | Tiered limits by spend (default ~50 RPM) | `PERPLEXITY_API_KEY` |
+| [OVHcloud AI Endpoints](https://endpoints.ai.cloud.ovh.net) | 8 | S → B | Free sandbox: 2 req/min/IP (no key). 400 RPM with key | `OVH_AI_ENDPOINTS_ACCESS_TOKEN` |
 | [Chutes AI](https://chutes.ai) | 4 | S → A | Free (community GPU-powered, no credit card) | `CHUTES_API_KEY` |
 | [DeepInfra](https://deepinfra.com/login) | 4 | A- → B+ | 200 concurrent requests (default) | `DEEPINFRA_API_KEY` |
 | [Fireworks AI](https://fireworks.ai) | 4 | S → B+ | $1 credits – 10 req/min without payment | `FIREWORKS_API_KEY` |
@@ -284,7 +289,7 @@ When a tool mode is active (via `Z`), models incompatible with that tool are hig
 
 ## ✨ Features
 
-- **Parallel pings** — all 230 models tested simultaneously via native `fetch`
+- **Parallel pings** — all 238 models tested simultaneously via native `fetch`
 - **Adaptive monitoring** — 2s burst for 60s → 10s normal → 30s idle
 - **Stability score** — composite 0–100 (p95 latency, jitter, spike rate, uptime)
 - **Smart ranking** — top 3 highlighted 🥇🥈🥉
@@ -322,7 +327,7 @@ We welcome contributions — issues, PRs, new provider integrations.
 
 ## ⚖️ Model Licensing & Commercial Use
 
-**Short answer:** All 230 models allow **commercial use of generated output (including code)**. You own what the models generate for you.
+**Short answer:** All 238 models allow **commercial use of generated output (including code)**. You own what the models generate for you.
 
 ### Output Ownership
 
@@ -354,6 +359,40 @@ For every model in this tool, **you own the generated output** — code, text, o
 
 ---
 
+## 🛡️ Security & Trust
+
+### Supply Chain
+
+| Signal | Status |
+|--------|--------|
+| **npm Provenance** | ✅ Published with Sigstore-signed provenance |
+| **SBOM** | ✅ Software Bill of Materials attached to every GitHub Release |
+| **Dependencies** | ✅ 1 runtime dependency (`chalk`) |
+| **Lockfile** | ✅ `pnpm-lock.yaml` committed and tracked |
+| **Security Policy** | ✅ [`SECURITY.md`](SECURITY.md) |
+| **Code Owners** | ✅ [`CODEOWNERS`](CODEOWNERS) — all changes require maintainer review |
+| **Dependabot** | ✅ Weekly automated dependency + GitHub Actions updates |
+| **Audit CI** | ✅ `npm audit` runs on every push/PR + weekly scheduled scan |
+| **License** | ✅ MIT |
+
+### What This Tool Does
+
+- Pings public API endpoints to measure latency and check availability
+- Reads your API keys from `.env` files (only if you configure them)
+- Opens configuration files for editing (with your permission)
+- Reports anonymous usage data (no personal information — see footer)
+
+### What This Tool Does NOT Do
+
+- ❌ Does **not** send your API keys, code, or personal data to any third party
+- ❌ Does **not** install or execute arbitrary code beyond `chalk` (the only dependency)
+- ❌ Does **not** modify any files outside its own config directory
+- ❌ Does **not** require `sudo`, root, or elevated permissions
+
+> To report a vulnerability, see [`SECURITY.md`](SECURITY.md).
+
+---
+
 ## 📧 Support
 
 [GitHub Issues](https://github.com/vava-nessa/free-coding-models/issues) · [Discord](https://discord.gg/ZTNFHvvCkU)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "free-coding-models",
-  "version": "0.3.34",
+  "version": "0.3.35",
   "description": "Find the fastest coding LLM models in seconds — ping free models from multiple providers, pick the best one for OpenCode, Cursor, or any AI coding assistant.",
   "keywords": [
     "nvidia",

package/sources.js

@@ -422,6 +422,21 @@ export const chutes = [
   ['Qwen/Qwen2.5-Coder-32B-Instruct',          'Qwen2.5 Coder 32B',    'A',  '46.0%', '32k'],
 ]
 
+// 📖 OVHcloud AI Endpoints - https://endpoints.ai.cloud.ovh.net
+// 📖 OpenAI-compatible API with European data sovereignty (GDPR)
+// 📖 Free sandbox: 2 req/min per IP per model (no API key needed), 400 RPM with API key
+// 📖 Env var: OVH_AI_ENDPOINTS_ACCESS_TOKEN
+export const ovhcloud = [
+  ['Qwen3-Coder-30B-A3B-Instruct',             'Qwen3 Coder 30B MoE',  'A+', '55.0%', '256k'],
+  ['gpt-oss-120b',                              'GPT OSS 120B',         'S',  '60.0%', '131k'],
+  ['gpt-oss-20b',                               'GPT OSS 20B',          'A',  '42.0%', '131k'],
+  ['Meta-Llama-3_3-70B-Instruct',               'Llama 3.3 70B',        'A-', '39.5%', '131k'],
+  ['Qwen3-32B',                                 'Qwen3 32B',            'A+', '50.0%', '32k'],
+  ['DeepSeek-R1-Distill-Llama-70B',             'R1 Distill 70B',       'A-', '40.0%', '131k'],
+  ['Mistral-Small-3.2-24B-Instruct-2506',       'Mistral Small 3.2',    'B+', '34.0%', '131k'],
+  ['Llama-3.1-8B-Instruct',                     'Llama 3.1 8B',         'B',  '28.8%', '131k'],
+]
+
 // 📖 Rovo Dev CLI source - https://www.atlassian.com/rovo
 // 📖 CLI tool only - no API endpoint - requires 'acli rovodev run'
 // 📖 Install: https://support.atlassian.com/rovo/docs/install-and-run-rovo-dev-cli-on-your-device/
@@ -596,6 +611,11 @@ export const sources = {
     url: 'https://chutes.ai/v1/chat/completions',
     models: chutes,
   },
+  ovhcloud: {
+    name: 'OVHcloud AI 🆕',
+    url: 'https://oai.endpoints.kepler.ai.cloud.ovh.net/v1/chat/completions',
+    models: ovhcloud,
+  },
 }
 
 // 📖 Flatten all models from all sources — each entry includes providerKey as 6th element

package/src/provider-metadata.js

@@ -60,6 +60,7 @@ export const ENV_VAR_NAMES = {
   zai:        'ZAI_API_KEY',
   gemini:     'GEMINI_API_KEY',
   chutes:     'CHUTES_API_KEY',
+  ovhcloud:   'OVH_AI_ENDPOINTS_ACCESS_TOKEN',
 }
 
 // 📖 OPENCODE_MODEL_MAP: sparse table of model IDs that differ between sources.js and OpenCode's
@@ -257,4 +258,11 @@ export const PROVIDER_METADATA = {
     signupHint: 'Sign up and generate an API key',
     rateLimits: 'Free (community GPU-powered), no hard cap',
   },
+  ovhcloud: {
+    label: 'OVHcloud AI 🆕',
+    color: chalk.rgb(100, 149, 205),
+    signupUrl: 'https://endpoints.ai.cloud.ovh.net',
+    signupHint: 'Manager → Public Cloud → AI Endpoints → API keys (optional: sandbox works without key)',
+    rateLimits: 'Free sandbox: 2 req/min per IP per model (no key). With API key: 400 RPM',
+  },
 }