Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
38,257
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
1,690 recordsRanked by popularity · browse by tag · record statistics
Maven
30At riskhealth index
dma-ais/AisLib
DMA AisLib - Java library for handling AIS messages
Java★ 194Jul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0
RubyGems
22Criticalhealth index
rspec/rspec-collection_matchers
Collection cardinality matchers, extracted from rspec-expectations
Ruby★ 193Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
28Criticalhealth index
amphp/sync
Non-blocking synchronization primitives for PHP based on Amp and Revolt.
PHP★ 192↓ 2.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
32At riskhealth index
gristlabs/asttokens
Annotate Python AST trees with source text and token information
Python★ 192Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Packagist
44At riskhealth index
mck89/peast
JavaScript parser written in PHP that generates AST from your code according to ECMAScript specification
PHP★ 192↓ 1.4M/moJul 21, 2026
BSD-3-ClauseJul 21, 2026 · metrics 1.13.0
RubyGems
17Criticalhealth index
ruby-concurrency/thread_safe
Thread-safe collections for Ruby (merged with concurrent-ruby)
Java · Ruby★ 192Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
39At riskhealth index
feross/queue-microtask
fast, tiny `queueMicrotask` shim for modern engines
JavaScript★ 189↓ 488M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
29Criticalhealth index
kbrew-dev/kbrew
kbrew is homebrew for Kubernetes
Go · Shell★ 189Jul 25, 2026
Apache-2.0Jul 25, 2026 · metrics 1.13.0
npm
39At riskhealth index
pillarjs/parseurl
parse a url with memoization
JavaScript★ 189↓ 386M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
RubyGems
14Criticalhealth index
jetrockets/attrio
Attributes for plain old Ruby objects. No dependencies, only simplicity and clearness.
Ruby★ 187Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
11Criticalhealth index
sergey-dryabzhinsky/python-zstd
Simple python bindings to Yann Collet ZSTD compression library
C · Python★ 187Jul 21, 2026
BSD-2-ClauseJul 21, 2026 · metrics 1.13.0
Go
22Criticalhealth index
amimof/node-cert-exporter
An SSL certificate Prometheus exporter
Go · Makefile★ 186Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
PyPI
38At riskhealth index
annetutil/annet
Configuration generation and deploying utility for network equipment
Python★ 186↓ 7,685/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
—
29Criticalhealth index
adplug/adplug
Hardware-independent AdLib sound player library
C++ · C★ 184Jul 19, 2026
LGPL-2.1Jul 19, 2026 · metrics 1.13.0
PyPI
30At riskhealth index
bryzgaloff/airflow-clickhouse-plugin
The most popular ClickHouse plugin for Airflow. 🔝 Top-1% downloads on PyPI: https://pypi.org/project/airflow-clickhouse-plugin! Based on mymarilyn/clickhouse-driver.
Python★ 184↓ 690.1K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
30At riskhealth index
Salamek/cron-descriptor
A Python library that converts cron expressions into human readable strings.
Python★ 183Jul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
Hex
26Criticalhealth index
absinthe-graphql/absinthe_relay
Absinthe support for the Relay framework
Elixir★ 183↓ 169.5K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
29Criticalhealth index
yiisoft/yii2-bootstrap
Yii 2 Bootstrap 3 Extension
PHP★ 183↓ 212.2K/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0
PyPI
18Criticalhealth index
core-api/python-client
Python client library for Core API.
Python★ 182↓ 1.5M/moJul 21, 2026
Custom licenseJul 21, 2026 · metrics 1.13.0
npm
33At riskhealth index
kurkle/chartjs-chart-sankey
Chart.js module for creating sankey diagrams
TypeScript · JavaScript★ 182↓ 176.5K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Go
37At riskhealth index
philchia/agollo
agollo is a golang client for ctrip apollo config center 🚀
Go★ 182Jul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
Go
37At riskhealth index
ydb-platform/ydb-go-sdk
Pure Go native and database/sql driver for YDB
Go★ 182Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
npm
40At riskhealth index
jshttp/methods
HTTP verbs that node supports
JavaScript★ 181↓ 239M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
24Criticalhealth index
kevinbeaty/any-promise
NOTE: You probably want native promises now
JavaScript★ 181↓ 262M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
37At riskhealth index
makenowjust/heredoc
Package heredoc provides the here-document with keeping indent.
Go★ 180Jul 25, 2026
MITJul 25, 2026 · metrics 1.13.0
npm
24Criticalhealth index
mathiasbynens/cssesc
A JavaScript library for escaping CSS strings and identifiers while generating the shortest possible ASCII-only output.
HTML · JavaScript★ 176↓ 377M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
crates.io
22Criticalhealth index
tailcallhq/gh-workflow
Write your github workflows in rust
Rust★ 176↓ 23.6K/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Maven
30At riskhealth index
FTBTeam/FTB-Quests
Quests is one of the best Questing mods for Minecraft out there. It has a highly customisable questing system and an easy to use interface.
Java★ 174Jul 21, 2026
No licenseJul 21, 2026 · metrics 1.13.0
Maven
34At riskhealth index
eclipse-vertx/vertx-auth
Authentication and authorization providers for Eclipse Vert.x
Java★ 174Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Packagist
33At riskhealth index
laminas/laminas-mvc
Laminas's event-driven MVC layer, including MVC Applications, Controllers, and Plugins
PHP★ 173↓ 460.7K/moJul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0