# inspect.software

> A public record of open-source software health. Repositories are measured
> against a transparent, versioned methodology spanning maintainability,
> engineering quality, security posture, ecosystem adoption, and governance;
> results are published as reports, 1–100 health indices, and embeddable
> badges. Results are signals, not warranties, and are independent of payment.

Every page below is served as source Markdown at the linked .md URL; the same
content renders as HTML without the extension (e.g. /methodology.md → /methodology).
The full corpus in one file: https://inspect.software/llms-full.txt

## Institution

- [About inspect.software](https://inspect.software/about.md): A public record of open-source software health — every repository inspected by one published method, versioned methodology, results independent of payment.
- [Methodology](https://inspect.software/methodology.md): The complete inspect.software methodology — versioned formulas, category weights, rating bands, missing-data rules, the organization assessment, and the open-source engine that computes them.
- [Certification & pricing](https://inspect.software/pricing.md): Free public-interest inspection for high-value open-source repositories; paid certification for private and niche repositories. Payment never changes a result.
- [GitHub badges](https://inspect.software/badges.md): Embeddable inspect.software badges — a live health signal for any inspected repository, updated automatically after every scan. Markdown and HTML snippets.
- [Frequently asked questions](https://inspect.software/faq.md): Answers about inspect.software — how repositories are inspected, what results mean, free vs. paid coverage, badges, corrections, and independence.
- [Contact](https://inspect.software/contact.md): How to reach inspect.software — certification enquiries, data corrections, security disclosures, and general questions.
- [Press & brand assets](https://inspect.software/press.md): Logos, colours, boilerplate texts and usage rules for inspect.software — the media kit for journalists, directories, conference organizers and integration documentation.

## Concepts

- [The health index](https://inspect.software/wiki/health-index.md): How inspect.software computes the 1–100 open-source health index — components, metrics, weighted categories, and the rules for missing data.
- [Rating bands](https://inspect.software/wiki/scoring-bands.md): The seven standardized rating bands — exceptional, excellent, good, moderate, weak, at risk, critical — and the letter grades used across every inspect.software health metric and category.
- [Certification levels](https://inspect.software/wiki/certification-levels.md): The three inspect.software certification levels — Certified (A), Certified with Excellence (AA), and Certified AAA — how each maps to the calibrated health index, what a level asserts, and how levels change.
- [Signals, not warranties](https://inspect.software/wiki/signals-not-warranties.md): What an inspect.software result does and does not claim — the honest boundary between visible practice signals and a formal audit or guarantee.
- [Methodology versions](https://inspect.software/wiki/methodology-versions.md): The complete version history of the inspect.software metrics methodology — every formula, weight, and threshold change, dated and documented.
- [Supported package ecosystems](https://inspect.software/wiki/supported-ecosystems.md): The package ecosystems inspect.software reads — nine registries with published-package facts, plus dependency manifests across all of them.
- [Software classification](https://inspect.software/wiki/software-classification.md): How inspect.software determines what a repository builds — the multi-label reading of whether software is consumed as code, run as a program, or installed into a host.
- [Scan configuration](https://inspect.software/wiki/scan-configuration.md): How parts of the inspect.software methodology can be switched off per scan — and how every report documents exactly what was and was not measured.

## Scoring categories

- [Vitality](https://inspect.software/wiki/vitality.md): The Vitality category of the inspect.software health index — whether code is actively written and versioned releases actually ship. Weight: 21% of the overall index.
- [Community & Adoption](https://inspect.software/wiki/community-adoption.md): The Community & Adoption category — users, downloads, attention, and a welcoming contributor setup. Weight: 17% of the inspect.software health index.
- [Sustainability & Governance](https://inspect.software/wiki/sustainability-governance.md): The heaviest category of the inspect.software health index (23%) — bus factor, responsiveness, organizational stewardship, and package upkeep.
- [Engineering Quality](https://inspect.software/wiki/engineering-quality.md): The Engineering Quality category — CI, tests, linting, and documentation practice. Weight: 19% of the inspect.software health index.
- [Security](https://inspect.software/wiki/security.md): The Security category — visible OpenSSF Scorecard hygiene and known-vulnerable dependencies, under two red-flag policies. Weight: 16% of the inspect.software health index.
- [AI Readiness](https://inspect.software/wiki/ai-readiness.md): The AI Readiness badge — how well a repository supports AI coding agents: agent context, verify loop, code legibility, machine-readable interfaces.

## Repository metrics

- [Development activity](https://inspect.software/wiki/development-activity.md): How inspect.software measures development activity — push recency, weekly commit cadence, and commit volume. 12.6% of the overall health index.
- [Release discipline](https://inspect.software/wiki/release-discipline.md): How inspect.software measures release discipline — whether versioned releases ship, how recently, and on what cadence. 8.4% of the overall health index.
- [Popularity](https://inspect.software/wiki/popularity.md): How inspect.software measures repository popularity — stars, forks, and watchers on a logarithmic scale. 6.8% of the overall health index.
- [Community health](https://inspect.software/wiki/community-health.md): How inspect.software measures community health — README, license, contributing guide, code of conduct, and issue/PR templates. 5.95% of the overall index.
- [Ecosystem adoption](https://inspect.software/wiki/ecosystem-adoption.md): How inspect.software measures real package adoption — registry downloads and dependents across npm, PyPI, Packagist, and more. 4.25% of the overall index.
- [Maintainer resilience](https://inspect.software/wiki/maintainer-resilience.md): How inspect.software measures bus factor, contributor concentration, and breadth — whether a project can survive losing its top maintainer. 6.9% of the index.
- [Responsiveness](https://inspect.software/wiki/responsiveness.md): How inspect.software measures responsiveness — issue resolution, lifetime pull-request acceptance, and how a project treats first-time contributors. 5.75% of the overall index.
- [Stewardship](https://inspect.software/wiki/stewardship.md): How inspect.software measures who stands behind a repository — organization vs. personal ownership, verified domain, reach, and track record. 5.75% of the index.
- [Package maintenance](https://inspect.software/wiki/package-maintenance.md): How inspect.software measures registry upkeep — publish recency, version history, and deprecation state of published packages. 4.6% of the overall index.
- [Engineering practices](https://inspect.software/wiki/engineering-practices.md): How inspect.software measures baseline engineering hygiene — CI, tests, linting, pre-commit hooks, and editorconfig. 11.4% of the overall health index.
- [Documentation](https://inspect.software/wiki/documentation.md): How inspect.software measures documentation — README, docs directory, documentation site, description, topics, and wiki. 7.6% of the overall health index.
- [Security posture](https://inspect.software/wiki/security-posture.md): How inspect.software measures security posture with the OpenSSF Scorecard — risk-weighted, tool-agnostic checks with a documented fallback. 16% of the index.
- [Dependency advisories](https://inspect.software/wiki/dependency-advisories.md): How inspect.software matches a repository's resolved dependencies against the OSV advisory database — severity, fix versions, coverage, and the limits of the signal. 20% of the Security category.

## AI Readiness metrics

- [AI agent context](https://inspect.software/wiki/ai-agent-context.md): How inspect.software measures agent guidance — CLAUDE.md, AGENTS.md, Cursor rules, Copilot instructions, llms.txt, and whether the commit history states its intent. Part of the AI Readiness badge.
- [AI verify loop](https://inspect.software/wiki/ai-verify-loop.md): How inspect.software measures the agent verify loop — one-command bootstrap, tests, lint, type checking, reproducible environments. The heaviest AI Readiness metric.
- [AI code legibility](https://inspect.software/wiki/ai-code-legibility.md): How inspect.software measures code legibility for AI models — type-checkable code and manageable file sizes. Part of the AI Readiness badge.
- [AI interfaces](https://inspect.software/wiki/ai-interfaces.md): How inspect.software measures machine-readable interfaces — API schemas, MCP servers, and runnable examples. Part of the AI Readiness badge.

## Red flags and policies

- [Abandonment](https://inspect.software/wiki/abandonment.md): How inspect.software decides a project has been left unmaintained — why silence alone is never the finding, what counts as an unmet obligation, and what holds the assessment back.
- [Malicious dependencies](https://inspect.software/wiki/malicious-dependencies.md): How inspect.software identifies dependencies reported as malicious packages by the OpenSSF corpus, why they are scored apart from vulnerabilities, and what the finding does and does not claim.
- [High-Risk Jurisdiction Exposure](https://inspect.software/wiki/jurisdiction-exposure.md): How inspect.software turns public repository-profile evidence into an explainable high-risk jurisdiction exposure signal for repository review.
- [Growth Authenticity](https://inspect.software/wiki/growth-authenticity.md): How inspect.software reads a repository's day-by-day star and fork history for growth that organic attention does not produce, and what the Inorganic Growth Policy does about it.

## Organization assessment

- [Organization assessment](https://inspect.software/wiki/organization-assessment.md): How inspect.software assesses GitHub organizations — portfolio activity, community reach, and profile completeness on the same 1–100 scale and bands.
- [Portfolio activity](https://inspect.software/wiki/portfolio-activity.md): How inspect.software measures an organization's portfolio activity — recently active repos, yearly activity, portfolio size, and original work. 45% of the org index.
- [Community reach](https://inspect.software/wiki/community-reach.md): How inspect.software measures an organization's community reach — followers and portfolio-wide stars on logarithmic scales. 30% of the organization index.
- [Profile completeness](https://inspect.software/wiki/profile-completeness.md): How inspect.software measures organization profile completeness — verified domain, description, homepage, contact, and identity fields. 25% of the org index.

## Inspection reports

The record itself — one report per inspected repository, ~26,000 of them. Every
report page is served as Markdown at the same .md convention used above:

- Report (Markdown): https://inspect.software/software/{owner}/{name}.md — the health index, every category and metric, the per-criterion breakdown behind each number, and the repository facts they were derived from
- Report (HTML): https://inspect.software/software/{owner}/{name} — the same report rendered for readers
- Browse or filter the record: https://inspect.software/api/catalog (JSON), or https://inspect.software/sitemap.xml for every report URL

## Machine-readable data

- [OpenAPI schema](https://inspect.software/api/openapi.json): machine-readable description of every endpoint below
- [Sitemap](https://inspect.software/sitemap.xml): every published page and inspection record
- [Catalogue API](https://inspect.software/api/catalog): JSON list of inspected repositories (filters: q, ecosystem, language, band, scanned_within_days, growth, sort)
- [Insights API](https://inspect.software/api/insights): aggregate statistics over the record — health distribution, practice adoption, stewardship, ecosystem comparison (optional ?ecosystem=; rendered at /insights)
- Report API: https://inspect.software/api/repositories/{owner}/{name}/report — the full JSON inspection report, including every metric's inputs and per-component points
- Related API: https://inspect.software/api/repositories/{owner}/{name}/related — inspected repositories sharing this one's catalogue tags and ecosystems
- Badge: https://inspect.software/badge/v1/{owner}/{name}.svg — live health badge for any repository in the record

## Optional

- [Terms of service](https://inspect.software/terms.md): The terms under which inspect.software publishes inspection results, issues badges, and accepts public-repository submissions.
- [Privacy](https://inspect.software/privacy.md): What personal data inspect.software processes, on what legal basis, how long it is kept, who receives it, and the rights that apply.