Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
71,237
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
620B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
60 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Go
NotHimmel/go-tdx
No repository description published.
No licenseSep 14, 2026 · metrics 2.10.0
NuGet · npm
Notallthatevil/NTComponents
Material 3-inspired Blazor components for .NET 9–11, supporting Web Apps, WebAssembly, interactive render modes, static SSR, theming, Native AOT, analyzers, generated documentation, and an MCP-powered component catalog.
MITAug 3, 2026 · metrics 2.10.0
—
Notify-AI/bigfoot-backend
No repository description published.
No licenseAwaiting first inspection
—
NoumenaDigital/platform
No repository description published.
No licenseAwaiting first inspection
—
NousC/nous
No repository description published.
No licenseAwaiting first inspection
Go
Nox-HQ/nox-plugin-api-abuse
Detect API authorization flaws, BOLA vulnerabilities, and abuse patterns in server code.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-attack-surface
Extract HTTP endpoints and map the attack surface of your application.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-container
Scan Dockerfiles for security misconfigurations, dangerous patterns, and best practice violations.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-dast
Nox security scanner plugin
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-depconfusion
Dependency confusion guard for supply chain security.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-grc
Nox GRC compliance plugin — governance, risk & compliance framework assessment
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-k8s-runtime
Nox plugin: Kubernetes runtime security scanner
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-llm-triage
Optional LLM second-opinion triage plugin for nox. Annotates findings with true/false-positive verdicts via a configured chat endpoint; opt-in, never gates the deterministic core.
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-reachability
Nox plugin: Import-based vulnerability reachability analysis
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-red-team
Nox plugin: Attack chain detection and HTTP validation
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-remediate
Deterministic code-fixer plugin for nox: SEC-001/002/003, AI-LOG-001, WEB-SEC-001 with policy-driven blast-radius controls and auto-rollback verify.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-risk-score
Nox plugin: EPSS/KEV risk scoring and vulnerability prioritization
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-taint-analysis
Nox plugin: Intraprocedural source-to-sink taint tracking
Apache-2.0Sep 13, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-threat-enrich
Threat intelligence enrichment with CWE, OWASP Top 10, and MITRE ATT&CK metadata.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-threat-explain
Threat pattern detection with audience-targeted impact explanations for developers, executives, and compliance teams.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-threat-model
STRIDE-based threat pattern detection in source code for automated threat modeling.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
Go
Nox-HQ/nox-plugin-triage-agent
Automated security finding triage and prioritization for review workflows.
Apache-2.0Sep 14, 2026 · metrics 2.10.0
—
NucleusNova/anima-ds
No repository description published.
No licenseAwaiting first inspection
Go
Nujitu/protobuf-go
No repository description published.
No licenseAug 24, 2026 · metrics 2.10.0
Go
Null-nil/cosmos-sdk
:chains: A Framework for Building High Value Public Blockchains :sparkles:
Apache-2.0Sep 4, 2026 · metrics 2.10.0
Go
NullPrivate/dnsproxy
No repository description published.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
npm
NullVoxPopuli/ember-estree
ESTree generator for gjs and gts file used by ember
No licenseSep 12, 2026 · metrics 2.10.0
PyPI
Nuosis/tau-by-clarity
Python port of pi-mono: fully-aligned coding agent with TUI, ai, agent, and coding-agent packages
No licenseAug 23, 2026 · metrics 2.10.0
Go
NuperSu/bubblepprof
Per-pprof-label heap memory attribution for Go. Drop-in /debug/memusage HTTP endpoint compatible with standard runtime/pprof labels — no wrapper required.
BSD-3-ClauseSep 15, 2026 · metrics 2.10.0
Go
NurPech/hannah-proto-go
No repository description published.
No licenseSep 13, 2026 · metrics 2.10.0