Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,346
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
647B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
crates.io
WithSecureOpenSource/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
GPL-3.0Oct 18, 2026 · metrics 2.10.0
npm · PyPI
samuelgursky/davinci-resolve-mcp
MCP server integration for DaVinci Resolve Studio
MITOct 22, 2026 · metrics 2.10.0
crates.io
str4d/rage
A simple, secure and modern file encryption tool (and Rust library) with small explicit keys, no config options, and UNIX-style composability.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Maven
networknt/light-4j
A fast, lightweight and more productive microservices framework
Apache-2.0Oct 20, 2026 · metrics 2.10.0
npm · Maven
aws/aws-sdk-js-v3
Modularized AWS SDK for JavaScript.
Apache-2.0Oct 22, 2026 · metrics 2.10.0
—
libopencm3/libopencm3
Open source ARM Cortex-M microcontroller library
GPL-3.0Oct 23, 2026 · metrics 2.10.0
RubyGems
aws/aws-sdk-ruby
The official AWS SDK for Ruby
Apache-2.0Oct 20, 2026 · metrics 2.10.0
PyPI
copier-org/copier
Library and command-line utility for rendering projects templates.
MITOct 20, 2026 · metrics 2.10.0
npm · PyPI
roflcoopter/viseron
Self-hosted, local only NVR and AI Computer Vision software. With features such as object detection, motion detection, face recognition and more, it gives you the power to keep an eye on your home, office or any other place you want to monitor.
MITOct 21, 2026 · metrics 2.10.0
Maven · npm
apache/logging-log4j2
Apache Log4j is a versatile, feature-rich, efficient logging API and backend for Java.
Apache-2.0Oct 22, 2026 · metrics 2.10.0
Maven
AxonIQ/AxonFramework
Framework for Evolutionary Message-Driven Microservices on the JVM
Apache-2.0Oct 22, 2026 · metrics 2.10.0
npm
enactic/openarm
A fully open-source humanoid arm for physical AI research and deployment in contact-rich environments.
Apache-2.0Oct 22, 2026 · metrics 2.10.0
npm
TinyAGI/tinyagi
TinyAGI is the agent teams orchestrator for One Person Company. (fka TinyClaw)
MITOct 20, 2026 · metrics 2.10.0
Go
alicebob/miniredis
Pure Go Redis server for Go unittests
MITOct 21, 2026 · metrics 2.10.0
crates.io
aws/aws-lambda-rust-runtime
A Rust runtime for AWS Lambda
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Packagist · npm
craftcms/cms
Build bespoke content experiences with Craft.
Custom licenseOct 20, 2026 · metrics 2.10.0
PyPI
pytorch/rl
A modular, primitive-first, python-first PyTorch library for Reinforcement Learning.
MITOct 22, 2026 · metrics 2.10.0
Go · npm
ory/oathkeeper
A cloud native Identity & Access Proxy / API (IAP) and Access Control Decision API that authenticates, authorizes, and mutates incoming HTTP(s) requests. Inspired by the BeyondCorp / Zero Trust white paper. Written in Go.
Apache-2.0Oct 22, 2026 · metrics 2.10.0
Go · PyPI
grafana/mcp-grafana
MCP server for Grafana
Apache-2.0Oct 22, 2026 · metrics 2.10.0
—
joernio/joern
Open-source code analysis platform for C/C++/Java/Binary/Javascript/Python/Kotlin based on code property graphs. Discord https://discord.gg/vv4MH284Hc
Apache-2.0Oct 23, 2026 · metrics 2.10.0
npm
histoire-dev/histoire
⚡ Fast and beautiful interactive component playgrounds, powered by Vite
MITOct 22, 2026 · metrics 2.10.0
PyPI
sdv-dev/SDV
Synthetic data generation for tabular data
Custom licenseOct 22, 2026 · metrics 2.10.0
crates.io
maciejhirsz/logos
Create ridiculously fast Lexers
Apache-2.0Oct 20, 2026 · metrics 2.10.0
—
Netflix/atlas
In-memory dimensional time series database.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Maven · npm
Loophole-LLC/Bastillion
Bastillion gives you a clean, browser-based way to manage SSH access across all your systems—like a bastion host with a friendly dashboard.
Custom licenseOct 20, 2026 · metrics 2.10.0
Packagist
matomo-org/device-detector
The Universal Device Detection library will parse any User Agent and detect the browser, operating system, device used (desktop, tablet, mobile, tv, cars, console, etc.), brand and model.
LGPL-3.0Oct 22, 2026 · metrics 2.10.0
Go
go-ini/ini
Package ini provides INI file read and write functionality in Go
Apache-2.0Oct 20, 2026 · metrics 2.10.0
NuGet
Megabit/Blazorise
Blazorise is a component library built on top of Blazor with support for CSS frameworks like Bootstrap, Tailwind, Bulma, AntDesign, and Material.
Custom licenseOct 22, 2026 · metrics 2.10.0
PyPI
googleanalytics/google-analytics-mcp
No repository description published.
Apache-2.0Oct 22, 2026 · metrics 2.10.0
crates.io
claration/impactor
Cross-platform & feature rich iOS/iPadOS/tvOS sideloading application. Formerly known as PlumeImpactor.
MITOct 20, 2026 · metrics 2.10.0