Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
98,336
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
650B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
npm
isaacs/proto-list
A list of objects bound by prototype chain
BlueOak-1.0.0Oct 20, 2026 · metrics 2.10.0
npm
istanbuljs/caching-transform
Wraps a transform and provides caching
MITSep 23, 2026 · metrics 2.10.0
npm
jonschlinkert/collection-visit
Visit a method over the items in an object, or map visit over the objects in an array. This is an alternative approach to using extend or merge, useful when events are emitted on a method like get or set.
MITSep 15, 2026 · metrics 2.10.0
npm
jonschlinkert/map-cache
Basic cache object for storing key-value pairs. Based on MapCache in Lo-dash 3.0
MITSep 15, 2026 · metrics 2.10.0
—
jow-/local-lvm-provisioner
Use local LVM for persistent storage with Kubernetes
Apache-2.0Oct 23, 2026 · metrics 2.10.0
Hex · npm
jsonmaur/phoenix-turnstile
Use Cloudflare Turnstile in Phoenix
MITOct 25, 2026 · metrics 2.10.0
npm
karma-runner/karma-safari-launcher
A Karma plugin. Launcher for Safari.
MITOct 18, 2026 · metrics 2.10.0
npm
kuler90/activate-unity
GitHub Action to activate Unity Personal or Professional license on Ubuntu, macOS or Windows
MITOct 14, 2026 · metrics 2.10.0
—
matrix-io/matrix-creator-malos
MATRIX Creator abstraction for MOS
GPL-3.0Sep 11, 2026 · metrics 2.10.0
npm
microsoft/boll
monorepo linting tool
MITSep 16, 2026 · metrics 2.10.0
npm
microsoft/vscode-docker-extensibility
Docker for Visual Studio Code: Extensibility Model
MITSep 12, 2026 · metrics 2.10.0
npm · PyPI
opnfv/samplevnf
Mirror of the OPNFV Sample Virtual Network Function Project
Custom licenseSep 17, 2026 · metrics 2.10.0
RubyGems
piotrmurach/benchmark-malloc
Trace memory allocations and collect stats
MITSep 11, 2026 · metrics 2.10.0
RubyGems
piotrmurach/strings-ansi
Handle ANSI escape codes in strings
MITSep 11, 2026 · metrics 2.10.0
npm
request/promise-core
Core Promise support implementation for the simplified HTTP request client 'request'.
ISCSep 15, 2026 · metrics 2.10.0
RubyGems
ruby-syntax-tree/prettier_print
A drop-in replacement for the prettyprint gem with more functionality
MITSep 11, 2026 · metrics 2.10.0
npm
sindresorhus/is-finite
ES2015 Number.isFinite() ponyfill
MITSep 23, 2026 · metrics 2.10.0
PyPI
sphinx-contrib/sphinxcontrib-towncrier
An RST directive for injecting a Towncrier-generated changelog draft containing fragments for the unreleased (next) project version. Demo: https://ansible-pylibssh.rtfd.io/changelog. Docs: https://sphinxcontrib-towncrier.rtfd.io
BSD-3-ClauseSep 10, 2026 · metrics 2.10.0
—
svaarala/duktape-releases
Duktape release binaries
No licenseOct 18, 2026 · metrics 2.10.0
npm
syntax-tree/mdast-util-directive
mdast extension to parse and serialize generic directives (`:cite[smith04]`)
MITSep 15, 2026 · metrics 2.10.0
crates.io
tikv/importer
tikv-importer is a front-end to help ingesting large number of KV pairs into a TiKV cluster
Apache-2.0Sep 19, 2026 · metrics 2.10.0
—
tmdarwen/AudioLib
A C++ library for audio specific components.
No licenseOct 23, 2026 · metrics 2.10.0
Maven
valtimo-platform/valtimo-backend-libraries
Welcome at the Valtimo repository. Valtimo is the less-code platform for Business Process Automation. Built on top of business process orchestrator Camunda. Valtimo's goal is to make implementing business process automation and case management easy. Valtimo is the server side component for business process automation.
Custom licenseOct 23, 2026 · metrics 2.10.0
Go
vmihailenco/tagparser
Opinionated Golang tag parser
BSD-2-ClauseSep 14, 2026 · metrics 2.10.0
NuGet
wwwlicious/servicestack-seq-requestlogsfeature
Servicestack plugin that logs requests to seq
MPL-2.0Sep 11, 2026 · metrics 2.10.0
npm
yargs/require-main-filename
shim for require.main.filename() that works in as many environments as possible
ISCOct 20, 2026 · metrics 2.10.0
PyPI
Azure/msrestazure-for-python
The runtime library "msrestazure" for AutoRest generated Python clients.
MITSep 12, 2026 · metrics 2.10.0
Go
DE-labtory/bifrost
P2P network library suppoting it-chain 📨
Apache-2.0Sep 19, 2026 · metrics 2.10.0
—
EVerest/libslac
Simple ISO15118-3 SLAC implementation
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
Finschia/iavl
Merkleized IAVL+ Tree implementation in Go forked from cosmos/iavl(https://github.com/cosmos/iavl)
Apache-2.0Sep 19, 2026 · metrics 2.10.0