Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,998
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
651B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
Packagist
qiniu/php-sdk
Qiniu Resource (Cloud) Storage SDK for PHP
MITSep 11, 2026 · metrics 2.10.0
Go
flashbots/mev-geth
Go implementation of MEV-Auction for Ethereum
LGPL-3.0Sep 13, 2026 · metrics 2.10.0
Packagist · npm
whitecube/nova-flexible-content
Flexible Content & Repeater Fields for Laravel Nova
MITSep 10, 2026 · metrics 2.10.0
PyPI
FuzzingLabs/secpipe
MCP server for AI-driven security pipelines
Custom licenseAug 4, 2026 · metrics 2.10.0
npm · Go
vshulcz/deja-vu
One memory shared by Claude Code, Codex, Cursor, Copilot CLI, OpenClaw and 20 more coding agents, built from the session history already on disk. A fix found in one agent comes back in any of them, including months of sessions from before you installed it. No LLM, no embeddings, one local Go binary.
MITSep 12, 2026 · metrics 2.10.0
npm
mathiasbynens/jsesc
Given some data, jsesc returns the shortest possible stringified & ASCII-safe representation of that data.
MITSep 16, 2026 · metrics 2.10.0
npm
LottieFiles/lottie-react
lottie web player as a react component
MITSep 15, 2026 · metrics 2.10.0
crates.io
LukeMathWalker/wiremock-rs
HTTP mocking to test Rust applications.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
npm · PyPI
TankerHQ/sdk-js
Tanker client-side encryption SDK for JavaScript
Custom licenseOct 21, 2026 · metrics 2.10.0
npm
js-sdsl/js-sdsl
A javascript standard data structure library which benchmark against C++ STL.
MITSep 23, 2026 · metrics 2.10.0
Go
lesovsky/noisia
Harmful workload generator for PostgreSQL
BSD-3-ClauseSep 13, 2026 · metrics 2.10.0
RubyGems
copiousfreetime/launchy
A helper for launching cross-platform applications in a fire and forget manner.
ISCSep 12, 2026 · metrics 2.10.0
RubyGems
rails/rails-perftest
Benchmark and profile your Rails apps
MITSep 11, 2026 · metrics 2.10.0
PyPI
googleapis/python-bigquery
This library has moved to https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-bigquery
Apache-2.0Oct 23, 2026 · metrics 2.10.0
PyPI
googleapis/oauth2client
This is a Python library for accessing resources protected by OAuth 2.0.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Maven
hrldcpr/pcollections
A Persistent Java Collections Library
Custom licenseOct 19, 2026 · metrics 2.10.0
RubyGems
Envek/after_commit_everywhere
Use ActiveRecord transactional callbacks outside of models, literally everywhere in your application.
MITSep 11, 2026 · metrics 2.10.0
npm
github/webauthn-json
🔏 A small WebAuthn API wrapper that translates to/from pure JSON using base64url.
MITSep 30, 2026 · metrics 2.10.0
Packagist
krakjoe/pcov
PCOV - CodeCoverage compatible driver for PHP
Custom licenseSep 16, 2026 · metrics 2.10.0
Maven · PyPI
mandiant/Ghidrathon
The FLARE team's open-source extension to add Python 3 scripting to Ghidra.
Apache-2.0Sep 15, 2026 · metrics 2.10.0
—
tiagofumo/vim-nerdtree-syntax-highlight
Extra syntax and highlight for nerdtree files
GPL-3.0Sep 18, 2026 · metrics 2.10.0
—
NASAWorldWind/WorldWindJava
The NASA WorldWind Java SDK (WWJ) is for building cross-platform 3D geospatial desktop applications in Java.
Custom licenseOct 21, 2026 · metrics 2.10.0
PyPI
Infinidat/munch
A Munch is a Python dictionary that provides attribute-style access (a la JavaScript objects).
MITSep 14, 2026 · metrics 2.10.0
crates.io
RustCrypto/block-ciphers
Collection of block cipher algorithms written in pure Rust
No licenseOct 23, 2026 · metrics 2.10.0
npm · PyPI
quisquous/cactbot
FFXIV TypeScript Raiding Overlay
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Go
muesli/reflow
A collection of (ANSI-sequence aware) text reflow operations & algorithms
MITSep 14, 2026 · metrics 2.10.0
npm
lukeed/dset
A tiny (197B) utility for safely writing deep Object values~!
MITSep 23, 2026 · metrics 2.10.0
Hex
thmsmlr/instructor_ex
Structured outputs for LLMs in Elixir
No licenseSep 9, 2026 · metrics 2.10.0
crates.io
sourcegraph/sg.nvim
Experimental Sourcegraph + Cody plugin for Neovim
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Maven
findbugsproject/findbugs
The new home of the FindBugs project
No licenseOct 20, 2026 · metrics 2.10.0