Week 45, updated 2 Nov 2026

Research & web data STORM

Is STORM safe?

Short answer: Caution. StackGrade's weekly scan of stanford-oval/storm gives it a Caution label for 9 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 54 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove STORM is exploitable in your setup. Automated scan of commit fb951af on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed. Checked again on 2 Nov 2026, no change.

Stanford research system that researches a topic and writes a full-length report with citations.

  • 31,768 stars
  • pushed 30 Sept 2025
  • MIT
  • Python

github.com/stanford-oval/storm · storm.genie.stanford.edu

26score out of 100

#49of 52 overall#6in Research & web datasame score as Week 44

  • Maintenance 30%4
  • Adoption 30%20
  • Docs 20%69
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 27, 26, 26, 26.

Caution

9 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 30 Sept 2025. Last 6 GitHub releases within 275 days, counted as 0 because the latest is older than 180 days, latest release 23 Jan 2025. Issue close time: fewer than 5 closed issues, so not used.
  • Adoption: 31,768 stars (70%), 2,999 forks (30%).
  • Docs: README 20,083 characters, 40 headings, 10 code blocks, install section: yes.

Methodology

#6 of 6 in Research & web data

Ranked by score. The yellow row is this tool.

Research & web data, Week 45score 0–100, safety
  1. 1Firecrawl#1 overall78No issues found
  2. 2Browser Use#15 overall62Caution
  3. 3MarkItDown#22 overall54No dependencies scanned
  4. 4Crawl4AI#26 overall52Caution
  5. 5GPT Researcher#46 overall31Caution
  6. 6STORM#49 overall26Caution

Safety scan, 2 Nov 2026

Automated scan of commit fb951af, 61 files. Not a manual audit.

Caution

  • 9Critical dependency advisories54 high, 36 medium, 6 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 0Agent files checked0 phrases flagged for review.
  • 0curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 9 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 9 critical, 54 high, 36 medium, 6 low, 2 unrated

  • certifi@2026.7.22 (PYSEC-2026-4320) in frontend/demo_light/requirements.txt
  • pillow@9.5.0 (PYSEC-2026-4330) in frontend/demo_light/requirements.txt
  • pillow@9.5.0 (PYSEC-2026-4332) in frontend/demo_light/requirements.txt
  • pillow@9.5.0 (PYSEC-2026-457) in frontend/demo_light/requirements.txt
  • pillow@9.5.0 (GHSA-332p-7hrc-92wf) in frontend/demo_light/requirements.txt

Also found (informational, does not change the label):

  • 54 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Critical advisories counted once per package: 11 matches across 2 lockfiles

Notes:

  • Telemetry/analytics references in code: telemetry

Automated scan of commit fb951af on 2 Nov 2026, not a manual audit. 61 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 0Releases, 90 daysLatest v1.1.0, 23 Jan 2025
  • –Median issue closeFewer than 5 closed issues
  • 31.8kStars+79 since 26 Oct
  • 3kForks116 open issues
  • 2024Repo created24 Mar 2024
30 days ago2 Nov
0 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

0 releases in the last 30 days (GitHub releases feed, last 10 entries).

Questions about STORM

Answers use this week's StackGrade data.

Is STORM safe to use?

Caution. StackGrade's weekly scan of stanford-oval/storm gives it a Caution label for 9 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 54 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove STORM is exploitable in your setup. Automated scan of commit fb951af on 2 Nov 2026, not a manual audit.

How does StackGrade score STORM?

STORM scores 26 out of 100 in Week 45: #49 of 52 tracked tools overall and #6 in Research & web data. The score combines maintenance (4), adoption (20) and docs (69) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to STORM?

The highest-scored other tools in Research & web data this week: Firecrawl (78, No issues found), Browser Use (62, Caution), MarkItDown (54, No dependencies scanned), Crawl4AI (52, Caution). StackGrade has not tested them hands-on.

What licence does STORM use?

The licence listed for stanford-oval/storm is MIT. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
AI tool
License
MIT
Language
Python
Created
24 Mar 2024
Owner
stanford-oval (Organization)
Forks
2,999

GitHub description: “An LLM-powered knowledge curation system that researches a topic and generates a full-length report with citations.”

Sources: github.com/stanford-oval/storm, api.github.com/repos/stanford-oval/storm, raw.githubusercontent.com/stanford-oval/storm/main/README.md. Fetched 2 Nov 2026.

Know when STORM changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.