Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
67,730
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
547B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
60 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
RubyGems
treasure-data/serverengine
A framework to implement robust multiprocess servers like Unicorn
Apache-2.0Aug 22, 2026 · metrics 2.10.0
npm
mozilla/node-client-sessions
secure sessions stored in cookies
MPL-2.0Aug 3, 2026 · metrics 2.10.0
npm
NV/CSSOM
Unmaintained! ⚠️ CSS Object Model implemented in pure JavaScript. Also, a CSS parser.
MITAug 31, 2026 · metrics 2.10.0
—
gregjones/httpcache
A Transport for http.Client that will cache responses according to the HTTP RFC
MITAug 29, 2026 · metrics 2.10.0
PyPI
SAML-Toolkits/python3-saml
No repository description published.
MITAug 27, 2026 · metrics 2.10.0
—
boxcutter/ubuntu
Virtual machine templates for Ubuntu written in legacy JSON
Apache-2.0Jul 21, 2026 · metrics 2.10.0
PyPI
invl/retry
easy to use retry decorator in python
Custom licenseAug 27, 2026 · metrics 2.10.0
npm
aws-samples/aws-secure-environment-accelerator
ASEA developer support has ended, and the ASEA github repo will be marked Archived (read-only) by the end of 2025.
Apache-2.0Aug 4, 2026 · metrics 2.10.0
PyPI
erdewit/nest_asyncio
Patch asyncio to allow nested event loops
BSD-2-ClauseJul 21, 2026 · metrics 2.10.0
PyPI
django-ordered-model/django-ordered-model
Get your Django models in order
Custom licenseAug 8, 2026 · metrics 2.10.0
—
jplattel/obsidian-clipper
A Chrome extension that easily clips selections to Obsidian
No licenseJul 26, 2026 · metrics 2.10.0
crates.io
RustCrypto/traits
Collection of cryptography-related traits
No licenseAug 4, 2026 · metrics 2.10.0
PyPI
opentracing/opentracing-python
OpenTracing API for Python. 🛑 This library is DEPRECATED! https://github.com/opentracing/specification/issues/163
Apache-2.0Aug 8, 2026 · metrics 2.10.0
—
RapidScada/scada
Contains Rapid SCADA sources
Apache-2.0Jul 22, 2026 · metrics 2.10.0
npm
expo/vector-icons
No repository description published.
MITSep 8, 2026 · metrics 2.10.0
PyPI · npm
mindsdb/anton
self-improving agent
MITAug 21, 2026 · metrics 2.10.0
crates.io
dirs-dev/dirs-rs
moved to https://codeberg.org/dirs/dirs-rs
Apache-2.0Aug 8, 2026 · metrics 2.10.0
—
gosuri/uitable
A go library to improve readability in terminal apps using tabular data
MITAug 29, 2026 · metrics 2.10.0
RubyGems
DmitryTsepelev/ar_lazy_preload
Lazy loading associations for the ActiveRecord models
MITJul 20, 2026 · metrics 2.10.0
Packagist
mustangostang/spyc
A simple YAML loader/dumper class for PHP
MITAug 22, 2026 · metrics 2.10.0
RubyGems · npm
rmagick/rmagick
Ruby bindings for ImageMagick
MITJul 20, 2026 · metrics 2.10.0
Go
gorilla/securecookie
Package gorilla/securecookie encodes and decodes authenticated and optionally encrypted cookie values for Go web applications.
BSD-3-ClauseAug 29, 2026 · metrics 2.10.0
Go
jonboulle/clockwork
a fake clock for golang
Apache-2.0Jul 27, 2026 · metrics 2.10.0
npm
microsoft/botbuilder-js
Welcome to the Bot Framework SDK for JavaScript repository, which is the home for the libraries and packages that enable developers to build sophisticated bot applications using JavaScript.
MITAug 27, 2026 · metrics 2.10.0
Go
rivo/uniseg
Unicode Text Segmentation, Word Wrapping, and String Width Calculation in Go
MITJul 28, 2026 · metrics 2.10.0
Packagist
dflydev/dflydev-dot-access-data
Given a deep data structure representing a configuration, access configuration by dot notation.
MITAug 27, 2026 · metrics 2.10.0
npm
lisaogren/axios-cache-adapter
Caching adapter for axios. Store request results in a configurable store to prevent unneeded network requests.
MITAug 2, 2026 · metrics 2.10.0
Maven
SciProgCentre/kmath
Kotlin mathematics extensions library
Custom licenseJul 26, 2026 · metrics 2.10.0
PyPI
taskipy/taskipy
the complementary task runner for python
MITJul 30, 2026 · metrics 2.10.0
npm
mhart/aws4
Signs and prepares Node.js requests using AWS Signature Version 4
MITAug 31, 2026 · metrics 2.10.0