Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,266
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
647B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
Maven
OpenIdentityPlatform/OpenAM
OpenAM is an open-source access management solution for identity authentication, authorization, and federation. It provides single sign-on, adaptive authentication, and centralized policy control, enabling secure access to web, mobile, and cloud applications
Custom licenseOct 19, 2026 · metrics 2.10.0
Go
nytimes/gziphandler
Go middleware to gzip HTTP responses
Apache-2.0Oct 21, 2026 · metrics 2.10.0
PyPI
jazzband/django-nose
Django test runner using nose
BSD-3-ClauseOct 19, 2026 · metrics 2.10.0
PyPI
scikit-fuzzy/scikit-fuzzy
Fuzzy Logic SciKit (Toolkit for SciPy)
Custom licenseOct 21, 2026 · metrics 2.10.0
Maven
BluSunrize/ImmersiveEngineering
Wires, transformers, high voltage! Bzzzzt!
Custom licenseOct 21, 2026 · metrics 2.10.0
crates.io
jonhoo/bus
Efficient, lock-free, bounded Rust broadcast channel
Apache-2.0Oct 22, 2026 · metrics 2.10.0
npm · PyPI
TankerHQ/sdk-js
Tanker client-side encryption SDK for JavaScript
Custom licenseOct 21, 2026 · metrics 2.10.0
Maven
hrldcpr/pcollections
A Persistent Java Collections Library
Custom licenseOct 19, 2026 · metrics 2.10.0
—
NASAWorldWind/WorldWindJava
The NASA WorldWind Java SDK (WWJ) is for building cross-platform 3D geospatial desktop applications in Java.
Custom licenseOct 21, 2026 · metrics 2.10.0
Maven
findbugsproject/findbugs
The new home of the FindBugs project
No licenseOct 20, 2026 · metrics 2.10.0
Go
jcmturner/gokrb5
Pure Go Kerberos library for clients and services
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Go
hajimehoshi/go-mp3
An MP3 decoder in pure Go
Apache-2.0Oct 22, 2026 · metrics 2.10.0
Go
otiai10/copy
Go copy directory recursively
MITOct 21, 2026 · metrics 2.10.0
npm
webpack/loader-utils
utils for webpack loaders
MITOct 20, 2026 · metrics 2.10.0
RubyGems
treasure-data/serverengine
A framework to implement robust multiprocess servers like Unicorn
Apache-2.0Oct 20, 2026 · metrics 2.10.0
PyPI
Cyberdrop-DL/cyberdrop-dl
Bulk asynchronous downloader for multiple file hosts
GPL-3.0Oct 17, 2026 · metrics 2.10.0
npm
NV/CSSOM
Unmaintained! ⚠️ CSS Object Model implemented in pure JavaScript. Also, a CSS parser.
MITOct 21, 2026 · metrics 2.10.0
PyPI · npm
mindsdb/anton
self-improving agent
MITOct 19, 2026 · metrics 2.10.0
—
gregjones/httpcache
A Transport for http.Client that will cache responses according to the HTTP RFC
MITOct 21, 2026 · metrics 2.10.0
—
gosuri/uitable
A go library to improve readability in terminal apps using tabular data
MITOct 21, 2026 · metrics 2.10.0
PyPI
ispras/dedoc
Dedoc is a library (service) for automate documents parsing and bringing to a uniform format. It automatically extracts content, logical structure, tables, and meta information from textual electronic documents. (Parse document; Document content extraction; Logical structure extraction; PDF parser; Scanned document parser; DOCX parser; HTML parser
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go
gorilla/securecookie
Package gorilla/securecookie encodes and decodes authenticated and optionally encrypted cookie values for Go web applications.
BSD-3-ClauseOct 21, 2026 · metrics 2.10.0
Packagist
mustangostang/spyc
A simple YAML loader/dumper class for PHP
MITOct 20, 2026 · metrics 2.10.0
Maven
odnoklassniki/one-nio
Unconventional I/O library for Java
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go
vmware-archive/kubecfg
A tool for managing complex enterprise Kubernetes environments as code.
Apache-2.0Oct 18, 2026 · metrics 2.10.0
npm
mhart/aws4
Signs and prepares Node.js requests using AWS Signature Version 4
MITOct 21, 2026 · metrics 2.10.0
Maven
tony-framework/TonY
TonY is a framework to natively run deep learning frameworks on Apache Hadoop.
Custom licenseOct 22, 2026 · metrics 2.10.0
Maven
java-json-tools/json-patch
An RFC 6902 (JSON Patch) and reverse, plus RFC 7386 (JSON Merge Patch), implementation in Java using Jackson (2.2.x)
Custom licenseOct 19, 2026 · metrics 2.10.0
npm
mdevils/html-entities
Fastest HTML entities encode/decode library
MITOct 20, 2026 · metrics 2.10.0
npm
microsoft/typed-rest-client
Node Rest and Http Clients with typings for use with TypeScript
Custom licenseOct 20, 2026 · metrics 2.10.0