Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
82,166
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
622B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
npm
recharts/react-smooth
react animation
MITSep 16, 2026 · metrics 2.10.0
npm
jonschlinkert/is-number
JavaScript/Node.js utility. Returns `true` if the value is a number or string number. Useful for checking regex match results, user input, parsed strings, etc.
MITSep 16, 2026 · metrics 2.10.0
Go
pulumi/esc
Pulumi ESC is a centralized, secure service for environments, secrets, and configuration management, optimized for multi-cloud infrastructures and applications.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
npm
zertosh/loose-envify
Like envify but much faster
MITSep 16, 2026 · metrics 2.10.0
crates.io
chronotope/chrono-tz
TimeZone implementations for rust-chrono from the IANA database
Custom licenseSep 17, 2026 · metrics 2.10.0
npm
then/is-promise
Test whether an object looks like a promises-a+ promise
MITSep 16, 2026 · metrics 2.10.0
PyPI
moderngl/moderngl-window
A cross platform utility library for ModernGL making window creation and resource loading simple
MITSep 17, 2026 · metrics 2.10.0
Packagist
amphp/parallel-functions
Simplified parallel processing for PHP based on Amp.
MITSep 18, 2026 · metrics 2.10.0
PyPI
grantjenks/py-tree-sitter-languages
Binary Python wheels for all tree sitter languages.
Custom licenseSep 17, 2026 · metrics 2.10.0
crates.io
SergioBenitez/yansi
A dead simple ANSI terminal color painting library for Rust.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
npm
luniehq/lunie
Lunie is staking, simplified ✨
Apache-2.0Sep 18, 2026 · metrics 2.10.0
PyPI
finalduty/cis-benchmarks-audit
Simple command line tool to check for compliance against CIS Benchmarks
Custom licenseSep 16, 2026 · metrics 2.10.0
PyPI
scrapy-plugins/scrapy-deltafetch
Scrapy spider middleware to ignore requests to pages containing items seen in previous crawls
No licenseSep 20, 2026 · metrics 2.10.0
npm
sindresorhus/callsites
Get callsites from the V8 stack trace API
MITSep 16, 2026 · metrics 2.10.0
crates.io
KokaKiwi/rust-hex
A basic crate to encode values to hexadecimal representation. Originally extracted from rustc-serialize.
Apache-2.0Sep 16, 2026 · metrics 2.10.0
—
dart-archive/html
Dart port of html5lib. For parsing HTML/HTML5 with Dart. Works in the client and on the server.
Custom licenseSep 19, 2026 · metrics 2.10.0
npm
MetaMask/providers
An Ethereum Provider that connects over a stream, as injected into websites by MetaMask
MITSep 20, 2026 · metrics 2.10.0
—
MrCMS/MrCMS
Mr CMS is an open source C# MVC CMS Framework
No licenseSep 20, 2026 · metrics 2.10.0
PyPI
bigdata-ustc/EduKTM
The Model Zoo of Knowledge Tracing Models
Apache-2.0Sep 18, 2026 · metrics 2.10.0
npm
jshttp/etag
Create simple HTTP ETags
MITSep 16, 2026 · metrics 2.10.0
Maven
eclipse-tahu/tahu
Eclipse Tahu addresses the existence of legacy SCADA/DCS/ICS protocols and infrastructures and provides a much-needed definition of how best to apply MQTT into these existing industrial operational environments.
EPL-2.0Sep 19, 2026 · metrics 2.10.0
crates.io
nox/serde_urlencoded
x-www-form-urlencoded meets Serde
Apache-2.0Sep 16, 2026 · metrics 2.10.0
crates.io
polyfloyd/rust-id3
Moved to https://codeberg.org/polyfloyd/rust-id3
MITSep 20, 2026 · metrics 2.10.0
npm
octokit/webhooks
machine-readable, always up-to-date GitHub Webhooks specifications
MITSep 16, 2026 · metrics 2.10.0
crates.io
tokio-rs/tls
A collection of Tokio based TLS libraries.
MITSep 17, 2026 · metrics 2.10.0
npm
kornelski/http-cache-semantics
RFC 7234 in JavaScript. Parses HTTP headers to correctly compute cacheability of responses, even in complex cases
BSD-2-ClauseSep 16, 2026 · metrics 2.10.0
PyPI
schodet/nxt-python
NXT-Python is a python driver/interface for the Lego Mindstorms NXT robot based on NXT_python.
GPL-3.0Sep 18, 2026 · metrics 2.10.0
crates.io
tokio-rs/valuable
No repository description published.
MITSep 16, 2026 · metrics 2.10.0
npm
micromatch/braces
Faster brace expansion for node.js. Besides being faster, braces is not subject to DoS attacks like minimatch, is more accurate, and has more complete support for Bash 4.3.
MITSep 16, 2026 · metrics 2.10.0
npm
sindresorhus/load-json-file
Read and parse a JSON file
MITSep 16, 2026 · metrics 2.10.0