Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,754
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
650B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
PyPI · npm
OpenCTI-Platform/opencti
Open Cyber Threat Intelligence Platform
Custom licenseAug 28, 2026 · metrics 2.10.0
npm
webdriverio/webdriverio
Next-gen browser and mobile automation test framework for Node.js
MITOct 23, 2026 · metrics 2.10.0
Go
gomodule/redigo
Go client for Redis
Apache-2.0Sep 23, 2026 · metrics 2.10.0
npm
goofychris/art-template
High performance JavaScript templating engine
MITAug 28, 2026 · metrics 2.10.0
PyPI
pycaret/pycaret
Open-source, low-code AutoML platform for Python. PyCaret 4.0: sklearn-native engine + React control plane.
Custom licenseSep 17, 2026 · metrics 2.10.0
PyPI
huggingface/accelerate
🚀 A simple way to launch, train, and use PyTorch models on almost any device and distributed configuration, automatic mixed precision (including fp8), and easy-to-configure FSDP and DeepSpeed support
Apache-2.0Aug 28, 2026 · metrics 2.10.0
npm
lukeed/clsx
A tiny (239B) utility for constructing `className` strings conditionally.
MITSep 16, 2026 · metrics 2.10.0
npm
vercel/ncc
Compile a Node.js project into a single file. Supports TypeScript, binary addons, dynamic requires.
MITSep 15, 2026 · metrics 2.10.0
PyPI
paramiko/paramiko
The leading native Python SSHv2 protocol library.
LGPL-2.1Aug 28, 2026 · metrics 2.10.0
NuGet · npm
Humanizr/Humanizer
Humanizer meets all your .NET needs for manipulating and displaying strings, enums, dates, times, timespans, numbers and quantities
Custom licenseAug 28, 2026 · metrics 2.10.0
Packagist
bobthecow/psysh
A REPL for PHP
MITOct 20, 2026 · metrics 2.10.0
crates.io
phiresky/ripgrep-all
rga: ripgrep, but also search in PDFs, E-Books, Office documents, zip, tar.gz, etc.
Custom licenseAug 28, 2026 · metrics 2.10.0
NuGet
MahApps/MahApps.Metro
A framework that allows developers to cobble together a better UI for their own WPF applications with minimal effort.
MITAug 28, 2026 · metrics 2.10.0
NuGet · npm
restsharp/RestSharp
Simple REST and HTTP API Client for .NET
Apache-2.0Oct 21, 2026 · metrics 2.10.0
Go · Maven · npm
spinnaker/spinnaker
Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes with high velocity and confidence.
Apache-2.0Oct 22, 2026 · metrics 2.10.0
Packagist
symfony/console
Eases the creation of beautiful and testable command line interfaces
MITOct 20, 2026 · metrics 2.10.0
Packagist
googleapis/php-jwt
PHP package for JWT
BSD-3-ClauseAug 28, 2026 · metrics 2.10.0
Packagist
googleapis/google-api-php-client
A PHP client library for accessing Google APIs
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Go
gorse-io/gorse
AI powered open source recommender system engine supports classical/LLM rankers and multimodal content via embedding
Apache-2.0Aug 28, 2026 · metrics 2.10.0
Go · npm
gruntwork-io/terragrunt
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu/Terraform to scale.
MITAug 28, 2026 · metrics 2.10.0
PyPI · npm
google/re2
RE2 is a fast, safe, thread-friendly alternative to backtracking regular expression engines like those used in PCRE, Perl, and Python. It is a C++ library.
BSD-3-ClauseSep 17, 2026 · metrics 2.10.0
Maven
OpenFeign/feign
Feign makes writing java http clients easier
Apache-2.0Aug 28, 2026 · metrics 2.10.0
Go
alireza0/s-ui
An advanced Web Panel • Built for SagerNet/Sing-Box
GPL-3.0Aug 28, 2026 · metrics 2.10.0
PyPI
falconry/falcon
The no-magic web API and microservices framework for Python developers, with a focus on reliability and performance at scale.
Apache-2.0Aug 28, 2026 · metrics 2.10.0
Go
etcd-io/bbolt
An embedded key/value database for Go.
MITOct 21, 2026 · metrics 2.10.0
—
wireshark/wireshark
Read-only mirror of Wireshark's Git repository at https://gitlab.com/wireshark/wireshark. You're welcome to submit pull requests there.
GPL-2.0Aug 28, 2026 · metrics 2.10.0
PyPI
FluentValidation/FluentValidation
A popular .NET validation library for building strongly-typed validation rules.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
npm
sinonjs/sinon
Test spies, stubs and mocks for JavaScript.
Custom licenseSep 18, 2026 · metrics 2.10.0
Maven · PyPI
NVIDIA/cudf
cuDF - GPU DataFrame Library
Apache-2.0Sep 17, 2026 · metrics 2.10.0
—
owasp-modsecurity/ModSecurity
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.
Apache-2.0Aug 28, 2026 · metrics 2.10.0