Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,294
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
647B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
npm · Packagist
humhub/humhub
HumHub is an Open Source Enterprise Social Network. Easy to install, intuitive to use and extendable with countless freely available modules.
Custom licenseOct 19, 2026 · metrics 2.10.0
PyPI
mesonbuild/meson
The Meson Build System
Apache-2.0Aug 27, 2026 · metrics 2.10.0
PyPI
espressif/esptool
Serial utility for flashing, provisioning, and interacting with Espressif SoCs
GPL-2.0Aug 28, 2026 · metrics 2.10.0
RubyGems · npm
hanami/hanami
A flexible framework for maintainable Ruby apps
MITAug 28, 2026 · metrics 2.10.0
npm
svaarala/duktape
Duktape - embeddable Javascript engine with a focus on portability and compact footprint
MITAug 28, 2026 · metrics 2.10.0
NuGet
nissl-lab/npoi
a .NET library that can read/write Office formats without Microsoft Office installed. No COM+, no interop.
Apache-2.0Sep 22, 2026 · metrics 2.10.0
npm · RubyGems
redmine/redmine
Mirror of redmine code source - Official Subversion repository is at https://svn.redmine.org/redmine - contact: @vividtone or maeda (at) farend (dot) jp
Custom licenseAug 28, 2026 · metrics 2.10.0
PyPI
aiogram/aiogram
aiogram is a modern and fully asynchronous framework for Telegram Bot API written in Python using asyncio
MITAug 28, 2026 · metrics 2.10.0
npm
piotrwitek/utility-types
Collection of utility types, complementing TypeScript built-in mapped types and aliases (think "lodash" for static types).
MITSep 17, 2026 · metrics 2.10.0
Go
disintegration/imaging
Imaging is a simple image processing package for Go
MITAug 28, 2026 · metrics 2.10.0
RubyGems
dependabot/dependabot-core
🤖 Dependabot's core logic for creating update PRs.
MITAug 28, 2026 · metrics 2.10.0
NuGet · PyPI
ClosedXML/ClosedXML
ClosedXML is a .NET library for reading, manipulating and writing Excel 2007+ (.xlsx, .xlsm) files. It aims to provide an intuitive and user-friendly interface to dealing with the underlying OpenXML API.
MITAug 28, 2026 · metrics 2.10.0
PyPI · RubyGems
google/clusterfuzz
Scalable fuzzing infrastructure.
Apache-2.0Aug 28, 2026 · metrics 2.10.0
npm
kangax/html-minifier
Javascript-based HTML compressor/minifier (with Node.js support)
MITSep 17, 2026 · metrics 2.10.0
npm
frangoteam/FUXA
Web-based Process Visualization (SCADA/HMI/Dashboard) software
MITSep 18, 2026 · metrics 2.10.0
PyPI · npm
dpgaspar/Flask-AppBuilder
Simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more. Demo (login with guest/welcome) - http://flaskappbuilder.pythonanywhere.com/
BSD-3-ClauseSep 17, 2026 · metrics 2.10.0
Go
mailru/easyjson
Fast JSON serializer for golang.
MITAug 28, 2026 · metrics 2.10.0
Packagist
Codeception/Codeception
Full-stack testing PHP framework
MITAug 28, 2026 · metrics 2.10.0
PyPI
geopy/geopy
Geocoding library for Python.
MITAug 27, 2026 · metrics 2.10.0
npm
effector/effector
Business logic with ease ☄️
MITOct 21, 2026 · metrics 2.10.0
PyPI
lk-geimfari/mimesis
Mimesis is a Python library for generating fake but realistic data in multiple languages and locales.
MITAug 27, 2026 · metrics 2.10.0
Packagist
yiisoft/yii
Yii PHP Framework 1.1.x
BSD-3-ClauseAug 28, 2026 · metrics 2.10.0
Packagist · npm
Studio-42/elFinder
📁 Open-source file manager for web, written in JavaScript using jQuery and jQuery UI
Custom licenseAug 28, 2026 · metrics 2.10.0
Packagist · npm
orchidsoftware/platform
Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards.
MITAug 28, 2026 · metrics 2.10.0
npm · Hex
blockscout/blockscout
Blockchain explorer for Ethereum based network and a tool for inspecting and analyzing EVM based blockchains.
Custom licenseOct 21, 2026 · metrics 2.10.0
Go · RubyGems
werf/werf
A solution for implementing efficient and consistent software delivery to Kubernetes facilitating best practices.
Apache-2.0Aug 28, 2026 · metrics 2.10.0
Maven
h2database/h2database
H2 is an embeddable RDBMS written in Java.
Custom licenseAug 28, 2026 · metrics 2.10.0
Packagist
php-amqplib/php-amqplib
The most widely used PHP client for RabbitMQ
LGPL-2.1Aug 27, 2026 · metrics 2.10.0
PyPI
fixie-ai/ultravox
A fast multimodal LLM for real-time voice
MITSep 18, 2026 · metrics 2.10.0
PyPI
JonathanSalwan/ROPgadget
This tool lets you search your gadgets on your binaries to facilitate your ROP exploitation. ROPgadget supports ELF, PE and Mach-O format on x86, x64, ARM, ARM64, PowerPC, SPARC, MIPS, RISC-V 64, and RISC-V Compressed architectures.
Custom licenseSep 17, 2026 · metrics 2.10.0