Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
67,562
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
586B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
60 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
crates.io
serde-rs/serde
Serialization framework for Rust
Apache-2.0Sep 8, 2026 · metrics 2.10.0
npm
ai/size-limit
Calculate the real cost to run your JS app or lib to keep good performance. Show error in pull request if the cost exceeds the limit.
MITSep 6, 2026 · metrics 2.10.0
Packagist
zephir-lang/zephir
Zephir is a compiled high-level language aimed to ease the creation of C-extensions for PHP
MITSep 5, 2026 · metrics 2.10.0
Go
docker/docker-agent
AI Agent Builder and Runtime by Docker Engineering
Apache-2.0Sep 10, 2026 · metrics 2.10.0
PyPI
lncrawl/lightnovel-crawler
Generate and download e-books from online sources.
GPL-3.0Sep 11, 2026 · metrics 2.10.0
Hex
ash-project/ash
A declarative, extensible framework for building Elixir applications.
Custom licenseSep 9, 2026 · metrics 2.10.0
crates.io
rust-random/rand
A Rust library for random number generation.
Custom licenseSep 5, 2026 · metrics 2.10.0
Go
anyproto/any-sync
An open-source protocol enabling high-performance, local-first, peer-to-peer, end-to-end encrypted collaborative apps.
MITSep 10, 2026 · metrics 2.10.0
NuGet
bezzad/Downloader
Fast, cross-platform and reliable multipart downloader with asynchronous progress events for .NET applications.
MITSep 10, 2026 · metrics 2.10.0
Go
kovetskiy/mark
Sync your markdown files with Confluence pages.
Apache-2.0Sep 9, 2026 · metrics 2.10.0
npm
ghost1372/HandyControls
Contains some simple and commonly used WPF controls based on HandyControl
MITSep 7, 2026 · metrics 2.10.0
NuGet
VahidN/EFCoreSecondLevelCacheInterceptor
EF Core Second Level Cache Interceptor
Apache-2.0Sep 10, 2026 · metrics 2.10.0
npm
wp-statistics/GeoLite2-City
Free MaxMind GeoLite2-City database for IP geolocation. Auto-updated, served via jsDelivr CDN. No API keys required.
No licenseSep 9, 2026 · metrics 2.10.0
Hex
elixir-waffle/waffle
Flexible file upload and attachment library for Elixir
No licenseSep 9, 2026 · metrics 2.10.0
NuGet
VahidN/iTextSharp.LGPLv2.Core
iTextSharp.LGPLv2.Core is an unofficial port of the last LGPL version of the iTextSharp (V4.1.6) to .NET Core
Custom licenseSep 6, 2026 · metrics 2.10.0
NuGet
KeRNeLith/QuikGraph
Generic Graph Data Structures and Algorithms for .NET
MS-PLSep 11, 2026 · metrics 2.10.0
NuGet
kniEngine/kni
KNI is a cross-platform C# game framework.
Custom licenseSep 11, 2026 · metrics 2.10.0
Packagist · PyPI
aVadim483/fast-excel-writer
Lightweight and very fast XLSX Excel Spreadsheet Writer in PHP. Supports full XLSX-file functionality - cell formatting, formulas, styles, charts, etc.
MITSep 11, 2026 · metrics 2.10.0
NuGet
dodobrands/WebAuthn.Net
WebAuthn (Passkeys) library for .NET.
MITSep 7, 2026 · metrics 2.10.0
PyPI
openpmix/openpmix
OpenPMIx Project Repository
Custom licenseSep 11, 2026 · metrics 2.10.0
Packagist · npm
neos/neos-ui
Neos CMS UI written in ReactJS with Immutable data structures.
GPL-3.0Sep 5, 2026 · metrics 2.10.0
crates.io
input-output-hk/rust-byron-cardano
rust client libraries to deal with the current cardano mainnet (byron / cardano-sl)
MITSep 10, 2026 · metrics 2.10.0
NuGet
VahidN/DNTCaptcha.Core
DNTCaptcha.Core is a captcha generator and validator for ASP.NET Core applications
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Maven
yandex/yatagan
Dependency Injection framework based on Google's Dagger2 API, optimized for fast builds and for managing large graphs with optional dependencies
Apache-2.0Sep 6, 2026 · metrics 2.10.0
npm
wp-statistics/GeoLite2-Country
Free MaxMind GeoLite2-Country database for IP geolocation. Ultra-lightweight (~2MB), auto-updated via jsDelivr CDN.
No licenseSep 9, 2026 · metrics 2.10.0
npm
audiojs/decode
Minimal audio decoders layer
MITSep 9, 2026 · metrics 2.10.0
npm · Maven
adaptyteam/AdaptySDK-React-Native
React Native SDK for growing in-app subscriptions
MITSep 8, 2026 · metrics 2.10.0
NuGet
Octonica/ClickHouseClient
ClickHouse .NET Core driver
Apache-2.0Sep 11, 2026 · metrics 2.10.0
Go · Maven · PyPI
seqra/opentaint
The open source taint analysis engine for the AI era. A formal dataflow analysis tool you can customize and self-host, built so AI agents drive your application security analysis without burning tokens on every scan. AI-ready open source alternative to Semgrep Pro and CodeQL.
Apache-2.0Sep 10, 2026 · metrics 2.10.0
Packagist
skeeks-semenov/yii2-assets-auto-compress
Automatic compilation of js + css + html
BSD-3-ClauseSep 4, 2026 · metrics 2.10.0