Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
82,178
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
622B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
Packagist
GoogleCloudPlatform/grpc-gcp-php
No repository description published.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
npm
pillarjs/parseurl
parse a url with memoization
MITSep 16, 2026 · metrics 2.10.0
Packagist
netflie/laravel-notification-whatsapp
Laravel notification channel for Whatsapp Cloud API
MITSep 17, 2026 · metrics 2.10.0
npm
mcollina/reusify
Reuse objects and functions with style
MITSep 16, 2026 · metrics 2.10.0
npm · PyPI
pomo-mondreganto/ForcAD
Pure-python distributable Attack-Defence CTF platform, created to be easily set up.
GPL-3.0Sep 16, 2026 · metrics 2.10.0
crates.io
sagebind/castaway
Safe, zero-cost downcasting for limited compile-time specialization.
MITSep 17, 2026 · metrics 2.10.0
npm
erc6551/reference
ERC-6551 reference implementation
No licenseSep 18, 2026 · metrics 2.10.0
—
qbs/qbs
Modern build tool for software projects
Custom licenseSep 20, 2026 · metrics 2.10.0
Packagist
yiisoft/yii2-coding-standards
Yii 2 coding standards
No licenseSep 16, 2026 · metrics 2.10.0
Maven
OWASP/passfault
OWASP Passfault evaluates passwords and enforces password policy in a completely different way.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
—
dmage/co2mon
CLI for MasterKit CO2 Monitor
GPL-3.0Sep 16, 2026 · metrics 2.10.0
—
osminogin/docker-tor-simple
Simplest minimal container for Tor anonymity software based on Alpine
MITSep 16, 2026 · metrics 2.10.0
Packagist
yiisoft/yii2-sphinx
Yii 2 Sphinx extension.
BSD-3-ClauseSep 18, 2026 · metrics 2.10.0
—
ztangent/Julog.jl
A Julia package for Prolog-style logic programming.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
npm
mathiask88/node-snap7
node.js wrapper for snap7
MITSep 16, 2026 · metrics 2.10.0
Packagist
medz/id-card-of-china
🆔一个基于「公民身份号码」规则获取身份证号码中包含的基础信息组件（PHP）
MITSep 19, 2026 · metrics 2.10.0
npm
kevinbeaty/any-promise
NOTE: You probably want native promises now
MITSep 16, 2026 · metrics 2.10.0
—
notaryproject/specifications
Cross tooling and interoperability specifications
Apache-2.0Sep 19, 2026 · metrics 2.10.0
Packagist
ActiveCampaign/postmark-php
The official PHP library for Postmark.
MITSep 17, 2026 · metrics 2.10.0
npm
mathiasbynens/cssesc
A JavaScript library for escaping CSS strings and identifiers while generating the shortest possible ASCII-only output.
MITSep 16, 2026 · metrics 2.10.0
PyPI
chtd/psycopg2cffi
Port to cffi with some speed improvements
Custom licenseSep 17, 2026 · metrics 2.10.0
Packagist
jawira/case-converter
Convert strings between 13 naming conventions: Snake case, Camel case, Kebab case, Pascal case, Ada case, Train case, Cobol case, Macro case, Upper case, Lower case, Title case, Sentence case and Dot notation.
MITSep 18, 2026 · metrics 2.10.0
Go
Antonboom/testifylint
The Golang linter that checks usage of github.com/stretchr/testify.
MITSep 16, 2026 · metrics 2.10.0
npm
micromatch/to-regex-range
Pass two numbers, get a regex-compatible source string for matching ranges. Fast compiler, optimized regex, and validated against more than 2.78 million test assertions. Useful for creating regular expressions to validate numbers, ranges, years, etc.
MITSep 16, 2026 · metrics 2.10.0
npm
arleyGuoLei/wechat-app-words-pk
微信小程序 云开发 毕业设计「 单词天天斗 」，好友/匹配/人机 对战，单词 本科毕设 typescript 原生微信小程序
Apache-2.0Sep 19, 2026 · metrics 2.10.0
crates.io
trifectatechfoundation/bzip2-rs
libbz2 (bzip2 compression) bindings for Rust
Apache-2.0Sep 17, 2026 · metrics 2.10.0
npm
sindresorhus/run-applescript
Run AppleScript and get the result
MITSep 16, 2026 · metrics 2.10.0
npm
teambition/merge2
Merge multiple streams into one stream in sequence or parallel (~119M/month downloads).
MITSep 16, 2026 · metrics 2.10.0
npm
thlorenz/convert-source-map
Converts a source-map from/to different formats.
MITSep 16, 2026 · metrics 2.10.0
—
w1hkj/fldigi
Amateur Radio digital modem application [SF mirror]
GPL-3.0Sep 20, 2026 · metrics 2.10.0