Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
82,175
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
622B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
—
raphaelmor/Polyline
Polyline encoder / decoder in swift
MITSep 18, 2026 · metrics 2.10.0
crates.io
pola-rs/pyo3-polars
Plugins/extension for Polars
MITSep 17, 2026 · metrics 2.10.0
Go · npm · RubyGems
werf/trdl
The universal solution for delivering your software updates securely from a trusted The Update Framework (TUF) repository.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
Packagist
nullivex/lib-array2xml
Array2XML conversion library credit to lalit.org
GPL-3.0Sep 16, 2026 · metrics 2.10.0
npm
webpack/loader-runner
Runs (webpack) loaders
MITSep 16, 2026 · metrics 2.10.0
npm
Raynos/xtend
extend like a boss
MITSep 16, 2026 · metrics 2.10.0
PyPI
bytedance/neurst
Neural end-to-end Speech Translation Toolkit
Custom licenseSep 19, 2026 · metrics 2.10.0
crates.io
smol-rs/concurrent-queue
Concurrent multi-producer multi-consumer queue
Apache-2.0Sep 17, 2026 · metrics 2.10.0
npm
A11yance/aria-query
Programmatic access to the ARIA specification
Apache-2.0Sep 16, 2026 · metrics 2.10.0
—
Instabug/Instabug-iOS
In-app feedback and bug reporting tool for apps.
Custom licenseSep 19, 2026 · metrics 2.10.0
Packagist
shetabit/multipay
simple PHP payment package , supports multiple drivers
MITSep 15, 2026 · metrics 2.10.0
npm
floatdrop/require-from-string
Load module from string
MITSep 16, 2026 · metrics 2.10.0
Packagist
minkphp/MinkGoutteDriver
Goutte driver for Mink framework
MITSep 18, 2026 · metrics 2.10.0
—
PortSwigger/dastardly-github-action
Runs a scan using Dastardly by Burp Suite against a target site and creates a JUnit XML report for the scan on completion.
No licenseSep 16, 2026 · metrics 2.10.0
npm
carbon-design-system/carbon-for-ibm-dotcom
Carbon for IBM.com is based on the Carbon Design System for IBM
Apache-2.0Sep 16, 2026 · metrics 2.10.0
crates.io
softprops/atty
are you or are you not a tty?
MITSep 17, 2026 · metrics 2.10.0
npm
bafolts/tplant
Typescript to plantuml
GPL-3.0Sep 19, 2026 · metrics 2.10.0
crates.io
cbreeden/fxhash
A fast, non-secure, hashing algorithm derived from an internal hasher in FireFox.
No licenseSep 17, 2026 · metrics 2.10.0
crates.io
Byron/jwalk
Filesystem walk performed in parallel with streamed and sorted results
MITSep 17, 2026 · metrics 2.10.0
PyPI
algorand/pyteal
Algorand Smart Contracts in Python
MITSep 17, 2026 · metrics 2.10.0
NuGet
Calabonga/Microservice-Template
Templates for microservice architecture. Nimble Microservice Framework contains two modules. The first with OpenIddict and the second without OpenIddict. Templates are built on ASP.NET Core platform with different versions Core3.1, NET6, NET7 and NET8. You can create a new project extremely fast: in Visual Studio, Rider, dotnet CLI.
MITSep 16, 2026 · metrics 2.10.0
npm
ehmicky/human-signals
Human-friendly process signals
Apache-2.0Sep 16, 2026 · metrics 2.10.0
npm
recharts/react-smooth
react animation
MITSep 16, 2026 · metrics 2.10.0
NuGet
FirelyTeam/spark
Firely and Incendi's open source FHIR server
BSD-3-ClauseSep 19, 2026 · metrics 2.10.0
npm
jonschlinkert/is-number
JavaScript/Node.js utility. Returns `true` if the value is a number or string number. Useful for checking regex match results, user input, parsed strings, etc.
MITSep 16, 2026 · metrics 2.10.0
Go
pulumi/esc
Pulumi ESC is a centralized, secure service for environments, secrets, and configuration management, optimized for multi-cloud infrastructures and applications.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
npm
zertosh/loose-envify
Like envify but much faster
MITSep 16, 2026 · metrics 2.10.0
crates.io
chronotope/chrono-tz
TimeZone implementations for rust-chrono from the IANA database
Custom licenseSep 17, 2026 · metrics 2.10.0
npm
then/is-promise
Test whether an object looks like a promises-a+ promise
MITSep 16, 2026 · metrics 2.10.0
PyPI
moderngl/moderngl-window
A cross platform utility library for ModernGL making window creation and resource loading simple
MITSep 17, 2026 · metrics 2.10.0