Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
52,847
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
399B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.5.0 — a reference point for reading any individual result.
npm
awslabs/aws-crt-nodejs
NodeJS bindings for the AWS Common Runtime.
Apache-2.0Jul 30, 2026 · metrics 2.5.0
npm
bedlaj/openfonts
NPM packages for all graduated Google Fonts typefaces including non-english subsets.
MITAug 6, 2026 · metrics 2.5.0
NuGet
benjamin-bader/stiletto
Compile-time dependency Injection for .Net, Mono, and MonoTouch
Apache-2.0Jul 27, 2026 · metrics 2.5.0
Packagist
beste/json
A simple JSON helper to decode and encode JSON
MITJul 24, 2026 · metrics 2.5.0
PyPI
biglocalnews/warn-scraper
Command-line interface for downloading WARN Act notices of qualified plant closings and mass layoffs from state government websites
Custom licenseAug 2, 2026 · metrics 2.5.0
PyPI · crates.io
biotite-dev/fastpdb
A high performance drop-in replacement for Biotite's PDBFile.
BSD-3-ClauseJul 15, 2026 · metrics 2.5.0
Packagist · RubyGems
boundwize/structarmed
🛡️ Configurable PHP architecture guards — define your layers and rules, then keep them enforced
MITJul 14, 2026 · metrics 2.5.0
Packagist
cakephp/validation
[READ-ONLY] Validation library from CakePHP. This repo is a split of the main code that can be found in https://github.com/cakephp/cakephp
Custom licenseJul 14, 2026 · metrics 2.5.0
npm
carbon-design-system/carbon-labs
An innovation space for the creation of components leveraging Carbon Design System
Apache-2.0Jul 18, 2026 · metrics 2.5.0
npm
cdklabs/awscdk-service-spec
No repository description published.
Apache-2.0Jul 17, 2026 · metrics 2.5.0
Go · npm
conforma/cli
Conforma verifies that software supply chain policies are met.
Apache-2.0Jul 17, 2026 · metrics 2.5.0
crates.io
cool-japan/oxifft
OxiFFT is a 99% Rust port of FFTW3, the world's most respected FFT library. It brings FFTW's sophisticated algorithms, planning system, and performance optimizations to the Rust ecosystem while leveraging Rust's safety guarantees and modern language features.
Apache-2.0Jul 27, 2026 · metrics 2.5.0
crates.io
coralogix/protofetch
A source dependency management tool for Protobuf modules.
Apache-2.0Jul 17, 2026 · metrics 2.5.0
npm
cyberconnecthq/cybercontracts
No repository description published.
GPL-3.0Aug 1, 2026 · metrics 2.5.0
npm
dearlordylord/huly-mcp
Huly MCP: Feature-complete MCP server for Huly platform
MITJul 18, 2026 · metrics 2.5.0
npm
deephaven/web-client-ui
Deephaven Web Client UI
Apache-2.0Jul 13, 2026 · metrics 2.5.0
Packagist
descope/descope-php
PHP library used to integrate with Descope
MITJul 30, 2026 · metrics 2.5.0
NuGet
diadoc/diadocsdk-csharp
Official Diadoc SDK for C#
MITJul 28, 2026 · metrics 2.5.0
PyPI
djouallah/duckrun
No repository description published.
MITJul 16, 2026 · metrics 2.5.0
—
dotnet/maintenance-packages
Repository that hosts packages from the .NET platform whose original home/branch is not building any longer.
MITJul 16, 2026 · metrics 2.5.0
npm · RubyGems
e0ipso/strikethroo
Task management for AI coding assistants
MITJul 22, 2026 · metrics 2.5.0
Go
ekristen/gcp-nuke
Nuke Everything in GCP Project
MITAug 2, 2026 · metrics 2.5.0
Hex
elixir-unicode/unicode
Unicode codepoint introspection and fast detection (lower, upper, alpha, numeric, whitespace, ...) in Elixir
Custom licenseJul 17, 2026 · metrics 2.5.0
Go · npm
enterprise-contract/ec-cli
Conforma verifies that software supply chain policies are met.
Apache-2.0Jul 17, 2026 · metrics 2.5.0
npm
es-shims/array-includes
Array.prototype.includes spec-compliant polyfill
MITAug 4, 2026 · metrics 2.5.0
Go
etcenter/c4go
Go package implementation of C4 Asset ID
Apache-2.0Jul 16, 2026 · metrics 2.5.0
—
folsom-project/folsom
metrics library for erlang
Apache-2.0Jul 17, 2026 · metrics 2.5.0
Packagist · npm
frankdekker/symfony-log-viewer-bundle
A log viewer for Symfony
MITJul 26, 2026 · metrics 2.5.0
npm
getsentry/platformicons
A platform and framework icon font.
Custom licenseAug 5, 2026 · metrics 2.5.0
—
googleapis/python-dlp
This library has moved to https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-dlp
Apache-2.0Jul 29, 2026 · metrics 2.5.0