Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
35,537
Monthly downloads under inspection
378B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
1,168 recordsRanked by popularity · browse by tag · record statistics
crates.io
40At riskhealth index
clap-rs/clap
A full featured, fast Command Line Argument Parser for Rust
Rust★ 16.6K↓ 244M/moJul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
PyPI
49At riskhealth index
aio-libs/aiohttp
Asynchronous HTTP client/server framework for asyncio and Python
Python★ 16.5KJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
PyPI
31At riskhealth index
piskvorky/gensim
Topic Modelling for Humans
Python★ 16.5KJul 21, 2026
LGPL-2.1Jul 21, 2026 · metrics 1.13.0
npm · PyPI
39At riskhealth index
cvat-ai/cvat
Computer Vision Annotation Tool (CVAT) is a leading platform for building high-quality visual datasets for vision AI. It offers open-source, cloud, and enterprise products, as well as labeling services, for image, video, and 3D annotation with AI-assisted labeling, quality assurance, team collaboration, analytics, and developer APIs.
Python · TypeScript · JavaScript★ 16.3KJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Go
40At riskhealth index
goreleaser/goreleaser
Release engineering, simplified
Go★ 15.9KJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
40At riskhealth index
sympy/sympy
A computer algebra system written in pure Python
Python★ 14.8K↓ 158M/moJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
PyPI
38At riskhealth index
nltk/nltk
NLTK Source
Python★ 14.7K↓ 66M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist · npm
41At riskhealth index
yiisoft/yii2
Yii 2: The Fast, Secure and Professional PHP Framework
PHP★ 14.3K↓ 448.9K/moJul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0
npm
49At riskhealth index
rabbitmq/rabbitmq-server
Open source RabbitMQ: core server and tier 1 (built-in) plugins
JavaScript · Shell · Makefile★ 13.8KJul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
siteboon/claudecodeui
Use Claude Code, OpenCode, Cursor CLI, and Codex on mobile and web with CloudCLI (aka Claude Code UI). CloudCLI is a free open source webui/GUI that helps you manage your Claude Code session and projects remotely.
TypeScript · JavaScript★ 12.7K↓ 30.1K/moJul 19, 2026
AGPL-3.0Jul 19, 2026 · metrics 1.13.0
PyPI
49At riskhealth index
redpanda-data/redpanda
Redpanda is a streaming data platform for developers. Kafka API compatible. 10x faster. No ZooKeeper. No JVM!
C++ · Python★ 12.4KJul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
Maven · npm
29Criticalhealth index
provectus/kafka-ui
Open-Source Web UI for Apache Kafka Management
Java · TypeScript★ 12.2KJul 21, 2026
Apache-2.0Jul 21, 2026 · metrics 1.13.0
npm
49At riskhealth index
paulmillr/chokidar
Minimal and efficient cross-platform file watching library
TypeScript★ 12.2K↓ 836M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
PyPI
34At riskhealth index
coleifer/peewee
a small, expressive orm -- supports postgresql, mysql, sqlite, now with asyncio
Python★ 12K↓ 49.1M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Maven
35At riskhealth index
jhy/jsoup
jsoup: the Java HTML parser, built for HTML editing, cleaning, scraping, and XSS safety.
Java · HTML★ 11.4KJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
49At riskhealth index
siderolabs/talos
Talos Linux is a modern Linux distribution built for Kubernetes.
Go★ 10.8KJul 21, 2026
MPL-2.0Jul 21, 2026 · metrics 1.13.0
crates.io
34At riskhealth index
serde-rs/serde
Serialization framework for Rust
Rust★ 10.7K↓ 233M/moJul 19, 2026
Apache-2.0Jul 19, 2026 · metrics 1.13.0
npm
36At riskhealth index
unovue/shadcn-vue
Vue port of shadcn-ui
TypeScript · Vue★ 10.3KJul 19, 2026
MITJul 19, 2026 · metrics 1.13.0
npm
28Criticalhealth index
lukeed/clsx
A tiny (239B) utility for constructing `className` strings conditionally.
JavaScript★ 9,817↓ 442M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
36At riskhealth index
gorse-io/gorse
AI powered open source recommender system engine supports classical/LLM rankers and multimodal content via embedding
Go · Assembly★ 9,761Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
PyPI
44At riskhealth index
pymc-devs/pymc
Bayesian Modeling and Probabilistic Programming in Python
Python★ 9,679Jul 22, 2026
Custom licenseJul 22, 2026 · metrics 1.13.0
npm
36At riskhealth index
terser/terser
🗜 JavaScript parser, mangler and compressor toolkit for ES6+
JavaScript★ 9,310↓ 281M/moJul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
npm
36At riskhealth index
yagop/node-telegram-bot-api
Telegram Bot API for NodeJS
TypeScript★ 9,188↓ 907.5K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI · npm
38At riskhealth index
LearningCircuit/local-deep-research
~95% on SimpleQA (e.g. Qwen3.6-27B on a 3090). Supports all local and cloud LLMs (llama.cpp, Ollama, Google, ...). 10+ search engines - arXiv, PubMed, your private documents. Everything Local & Encrypted.
Python · JavaScript★ 8,752↓ 10.3K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
npm
37At riskhealth index
Shopify/react-native-skia
High-performance React Native Graphics using Skia
TypeScript · C++★ 8,457Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
—
37At riskhealth index
SixLabors/ImageSharp
:camera: A modern, cross-platform, 2D Graphics library for .NET
C#★ 8,012Jul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
PyPI
34At riskhealth index
PyMySQL/PyMySQL
MySQL client library for Python
Python★ 7,844Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
37At riskhealth index
Laravel-Lang/lang
List of 128 languages for Laravel Framework, Laravel Jetstream, Laravel Fortify, Laravel Breeze, Laravel Cashier, Laravel Nova and Laravel UI.
PHP★ 7,777↓ 400K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
37At riskhealth index
predis/predis
A flexible and feature-complete Redis/Valkey client for PHP.
PHP★ 7,774↓ 6.8M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
35At riskhealth index
webmozarts/assert
Assertions to validate method input/output with nice error messages.
PHP★ 7,651↓ 12.3M/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0