Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,252
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
647B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
Go
hanzoai/sqlcipher
Pure-Go SQLCipher 4 page format — codec, KDF, per-page HMAC. Byte-compatible with SQLCipher 4.
BSD-3-ClauseOct 22, 2026 · metrics 2.10.0
Go
hanzoai/sqlite
Hanzo SQLite
Custom licenseOct 22, 2026 · metrics 2.10.0
Go
hanzoai/stream
Kafka protocol adapter that lets standard Kafka clients run against Hanzo's NATS-based pub/sub.
MITOct 22, 2026 · metrics 2.10.0
Go
hanzoai/types
Values the Hanzo fleet shares. Standard library only.
MITOct 18, 2026 · metrics 2.10.0
crates.io
hanzoai/zen
Zen LM, the open model family from Zoo Labs Foundation (501(c)(3)). Use it on api.hanzo.ai.
No licenseOct 18, 2026 · metrics 2.10.0
Go
hanzoai/zip
DEPRECATED — dead fork. Canonical: github.com/zap-proto/zip. Do not import.
MITOct 18, 2026 · metrics 2.10.0
Packagist
kanopi/wordpress-core
No repository description published.
Custom licenseOct 19, 2026 · metrics 2.10.0
Go
kruzhok-team/gotalent
Клиент TalentAPI для Go
MITOct 20, 2026 · metrics 2.10.0
Go
ksanderer/go-micro
A Go agent harness and service framework
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go · npm
luxfi/bft
Lux BFT primitives: state machine replication interfaces and utilities for building Byzantine-tolerant Go services.
BSD-3-ClauseOct 20, 2026 · metrics 2.10.0
Go
luxfi/node
Lux node — Go, Rust and C++ runtimes at parity behind one Makefile and one conformance corpus. ZAP-native, BSD-3-Clause.
BSD-3-ClauseOct 21, 2026 · metrics 2.10.0
Go
mehrdad-masoumi/go-packages
No repository description published.
No licenseOct 18, 2026 · metrics 2.10.0
—
mpeterv/luarocks
LuaRocks is a deployment and management system for Lua modules.
MITOct 18, 2026 · metrics 2.10.0
npm · Go
nick-sergeev/tls-client
net/http.Client like HTTP Client with options to select specific client TLS Fingerprints to use for requests.
BSD-4-ClauseOct 19, 2026 · metrics 2.10.0
npm
novinvision/inertia-bootstrap-forms
Create bootstrap forms with inertia and twitter bootstrap
MITOct 20, 2026 · metrics 2.10.0
Packagist
phplrt/position-factory-contracts
[READ ONLY] Subtree split of the phplrt lexer component (see phplrt/phplrt)
MITOct 22, 2026 · metrics 2.10.0
Packagist
phplrt/source-factory-contracts
[READ ONLY] Subtree split of the phplrt source factory contracts component (see phplrt/phplrt)
MITOct 22, 2026 · metrics 2.10.0
Go
podvoyskiy/fuzzymatch
Fuzzy Matching Library for Go
MITOct 22, 2026 · metrics 2.10.0
npm
qatrehai/persian-normalize
Normalize Persian and Arabic-script text — ZWNJ, Arabic yeh/kaf, three digit sets, diacritics. Zero dependencies, TypeScript types.
MITOct 18, 2026 · metrics 2.10.0
Packagist · npm
rasuvaeff/property-testing-core
Framework-agnostic property-based testing engine: generators, shrinking, runner, regression corpus, events
BSD-3-ClauseOct 20, 2026 · metrics 2.10.0
Packagist · npm
rasuvaeff/understudy
Test doubles for PHP 8.3–8.5 with a call-closure API, matchers, expectations, sequences, verification, and Testo/PHPUnit/Psalm/PHPStan adapters.
BSD-3-ClauseOct 21, 2026 · metrics 2.10.0
npm
shaker-quiz/utilities
Modular utilities to simplify development
MITOct 22, 2026 · metrics 2.10.0
Go
sinashahoveisi/resilium
Composable resilience policies for Go — retry, circuit breaker, timeout, and rate limiting behind a single type-safe API.
MITOct 20, 2026 · metrics 2.10.0
crates.io
uael/wgpu
Cross-platform, safe, pure-rust graphics api.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go
vodolaz095/pkg
shared golang packages
MITOct 22, 2026 · metrics 2.10.0
Go
yablizzard/workspace_lib
No repository description published.
No licenseOct 19, 2026 · metrics 2.10.0
npm · Go
zap-proto/mcp
Model Context Protocol over ZAP — mutually authenticated, non-repudiable
Custom licenseOct 19, 2026 · metrics 2.10.0