Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
53,109
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
400B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.5.0 — a reference point for reading any individual result.
npm
microsoft/eslint-plugin-sdl
ESLint Plugin focused on common security issues and misconfigurations.
MITJul 20, 2026 · metrics 2.5.0
npm
microsoft/powerbi-models
Contains JavaScript & TypeScript object models for Microsoft Power BI JavaScript SDK
Custom licenseJul 21, 2026 · metrics 2.5.0
—
navikt/copilot
All things Copilot, Agents, MCPs, Skills, and coding related AI features for the Norwegian Government
MITJul 17, 2026 · metrics 2.5.0
crates.io
near/near-jsonrpc-client-rs
Lower-level API for interfacing with the NEAR Protocol via JSONRPC.
Apache-2.0Jul 14, 2026 · metrics 2.5.0
Packagist
nfephp-org/sped-mdfe
API para geração e comunicação dos MDFe com as SEFAZ autorizadoras
Custom licenseJul 31, 2026 · metrics 2.5.0
Packagist · npm
outl1ne/nova-notes-field
This Laravel Nova package adds a notes field to Nova's arsenal of fields.
MITJul 14, 2026 · metrics 2.5.0
crates.io · npm · PyPI
owenlamont/ryl
Fast YAML linter written in Rust (drop in replacement for yamllint - but with additional rules and features)
MITJul 21, 2026 · metrics 2.5.0
npm
panguard-ai/panguard-ai
Open-source security platform for AI agents -- audits skills before install, monitors 24/7, shares threat intelligence across all users. | AI Agent 開源安全平台 -- 安裝前審計 skill、24/7 即時監控、社群共享威脅情報。
MITJul 15, 2026 · metrics 2.5.0
npm · RubyGems · Go +2
passiv/snaptrade-sdks
No repository description published.
MITJul 21, 2026 · metrics 2.5.0
Packagist
patchlevel/event-sourcing-bundle
An event sourcing bundle, complete with all the essential features, powered by the reliable Doctrine ecosystem and focused on developer experience.
MITJul 14, 2026 · metrics 2.5.0
npm
platformatic/undici-cache-redis
No repository description published.
Apache-2.0Jul 15, 2026 · metrics 2.5.0
RubyGems
plivo/plivo-ruby
Plivo Ruby Helper Library
MITJul 28, 2026 · metrics 2.5.0
PyPI
polm/unidic-lite
A small version of UniDic for easy pip installs.
MITJul 21, 2026 · metrics 2.5.0
Maven
praxis-live/praxiscore
PraxisCORE
LGPL-3.0Jul 25, 2026 · metrics 2.5.0
npm
processing/p5.sound.js
p5.sound.js extends the musical and sonic capabilities of p5.js. It is designed to be a minimal abstraction of the Tone.js library with a feature set that is inspired by p5.js's approach to accessible and poetic creative coding. Key functionalities include audio input, sound file playback and manipulation, effects, synthesis and analysis.
LGPL-2.1Aug 6, 2026 · metrics 2.5.0
Go · PyPI
pulumi/pulumi-keycloak
A KeyCloak Pulumi resource package, providing multi-language access to KeyCloak
Apache-2.0Jul 16, 2026 · metrics 2.5.0
PyPI
py-vobject/vobject
A full-featured Python package for parsing and creating iCalendar and vCard files
Custom licenseJul 21, 2026 · metrics 2.5.0
PyPI
pyasn1/pyasn1
Generic ASN.1 library for Python
BSD-2-ClauseJul 16, 2026 · metrics 2.5.0
Packagist
rawilk/filament-password-input
Enhanced password input component for filament.
MITJul 23, 2026 · metrics 2.5.0
npm
release-it/bumper
Version read/write plugin for release-it
MITAug 6, 2026 · metrics 2.5.0
npm
reuters-graphics/graphics-components
Graphics components for projects
No licenseJul 14, 2026 · metrics 2.5.0
npm
rse/blessed-xterm
XTerm Widget for Blessed Curses Environment
No licenseJul 24, 2026 · metrics 2.5.0
Go
runapi-ai/cli
RunAPI command-line client
Apache-2.0Jul 19, 2026 · metrics 2.5.0
PyPI
sbrunner/sphinx-prompt
Sphinx directive to add unselectable prompt
BSD-3-ClauseJul 21, 2026 · metrics 2.5.0
crates.io · npm
sdsrss/code-graph-mcp
AST knowledge graph MCP server for Claude Code — semantic search, call graph traversal, HTTP route tracing, impact analysis. Auto-indexes 10 languages via Tree-sitter.
No licenseJul 13, 2026 · metrics 2.5.0
npm
sharkdp/purescript-quantities
Physical quantities and units
MITJul 20, 2026 · metrics 2.5.0
—
sisong/tinyuz
tiny code & ram requires when decompress on embedded systems,MCU,NB-IoT,...
MITJul 20, 2026 · metrics 2.5.0
Packagist
symfony/ai-platform
PHP library for interacting with AI platform provider.
MITJul 15, 2026 · metrics 2.5.0
PyPI
tableau/tabcmd
A Python based app that replicates the functionality of the existing TabCMD command line utility
MITJul 27, 2026 · metrics 2.5.0
Go
terminaldotshop/terminal-sdk-go
No repository description published.
Apache-2.0Jul 24, 2026 · metrics 2.5.0