Public record
Software health reportschema 0.11.0 · metrics 2.10.0 · 2026-07-16 06:27 UTC

aws / sagemaker-python-sdk

A library for training and deploying machine learning models on Amazon SageMaker

PythonApache-2.0★ 2,253 stars⑂ 1,282 forkssince Nov 2017View on GitHub ↗

aws/sagemaker-python-sdk holds a health index of 98 out of 100, placing it in the Exceptional band. It scores highest on Sustainability & Governance (95/100) and lowest on Security (55/100). It was last updated today. 17 contributors account for most of its recent work.

98
overall / 100
Exceptional

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.

98
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
VitalityCommunity &AdoptionSustainability &GovernanceEngineeringQualitySecurityAI Readiness

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

The weighted overall 86 is calibrated to 98 on the published index scale (record calibration 2026-08-02).

Ownership

16,076 followers551 public repossince Aug 2012

This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.

Package ecosystems

RegistryPackageVersionDownloads / moVersionsLast publishTags
PyPIsagemaker3.16.0-6830 days agoaiawsamazonmlmxnettensorflowpytorchhuggingface
PyPIsagemaker-core2.16.0-1060 days ago
PyPIsagemaker-mlops1.16.0-240 days ago
PyPIsagemaker-serve1.16.0-250 days ago
PyPIsagemaker-train1.16.01,331,416240 days agoaiawsamazonmlmxnettensorflowpytorchhuggingface

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

93Exceptional · 21% of overall
How it's scored
36/36Push recencylast push 0 days ago
24.9/36Commit cadence36/52 weeks with commits
18/18Commit volume304 commits in the last year
10/10OpenSSF Scorecard: Maintained30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
Inputs used
commits_last_year304
human_commit_share
days_since_last_push0
active_weeks_last_year36

Release discipline

100Exceptional
How it's scored
27/27Ships releases100 releases published
36/36Release recencylatest release 1 days ago
27/27Release cadencea release every ~7.5 days
0/10OpenSSF Scorecard: Signed-Releasesno data
Inputs used
releases_count100
latest_release_tagv2.257.5
releases_from_tagsno
days_since_latest_release1
mean_days_between_releases7.5
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

94Exceptional · 17% of overall
How it's scored
54.4/60Stars2,253 stars
25/25Forks1,282 forks
11.7/15Watchers126 watchers
Inputs used
forks1,282
stars2,253
watchers126
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Community health

92Excellent
How it's scored
22.5/22.5README
22.5/22.5Licenserecognized license (Apache-2.0)
18/18CONTRIBUTING guide
13.5/13.5Code of conduct
0/7.2Issue template
6.3/6.3PR template
Inputs used
has_readmeyes
has_licenseyes
readme_badges
has_contributingyes
has_issue_templateno
has_code_of_conductyes
readme_badge_services
has_pull_request_templateyes
How it's scored
80/80Monthly downloads1,331,416 downloads/month across pypi
0/20Registry dependentsnot reported by this ecosystem
Inputs used
packagessagemaker, sagemaker-core, sagemaker-train
dependents
ecosystemspypi
total_downloads
monthly_downloads1,331,416
unverified_packages_excludedsagemaker-mlops, sagemaker-serve
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

95Exceptional · 23% of overall
How it's scored
54/54Bus factor17 contributor(s) cover half of all commits
19.7/22.5Commit distributiontop contributor authored 12% of commits
13.5/13.5Contributor breadth100 contributors
10/10OpenSSF Scorecard: Contributorsproject has 12 contributing companies or organizations
Inputs used
bus_factor17
contributors_sampled100
top_contributor_share0.125
How it's scored
34.6/42Issue resolution82% of issues closed
24.9/30PR acceptance3,262/3,935 decided PRs merged
0/13Newcomer PR acceptanceno first-time contributor's PR decided in 30d
13.5/15OpenSSF Scorecard: Code-ReviewFound 29/30 approved changesets -- score normalized to 9
Inputs used
merged_prs3,262
open_issues300
closed_issues1,401
prs_merged_7d
prs_decided_7d
prs_merged_30d
prs_decided_30d
issue_closed_ratio0.824
closed_unmerged_prs673
first_time_authors_30d
first_time_prs_merged_30d
first_time_prs_decided_30d
Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.
How it's scored
30/30Ownership backingorganization-owned
0/20Verified domainverified-domain status not read for this organization
25/25Owner reach16,076 followers of aws
25/25Track record551 public repos, account ~13 yr old
Inputs used
followers16,076
owner_typeOrganization
is_verified
owner_loginaws
public_repos551
account_age_days5,070
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.

Package maintenance

100Exceptional
How it's scored
25/25Published & resolvable5 package(s) on pypi
35/35Publish recencylatest publish 0 days ago
20/20Version history683 published versions
20/20Not deprecatedactive, not deprecated or yanked
Inputs used
packagessagemaker, sagemaker-core, sagemaker-mlops, sagemaker-serve, sagemaker-train
ecosystemspypi
any_deprecatedno
min_days_since_publish0

Engineering Quality

Are baseline engineering and documentation practices in place?

85Excellent · 19% of overall
How it's scored
24/24CI workflows9 workflow(s)
24/24Tests present
16/16Linter config.pylintrc, tox.ini
0/9.6Pre-commit hooks
0/6.4.editorconfig
18/20OpenSSF Scorecard: CI-Tests29 out of 30 merged PRs checked by a CI test -- score normalized to 9
Inputs used
has_ciyes
has_testsyes
has_editorconfigno
has_linter_configyes
has_precommit_configno

Documentation

90Excellent
How it's scored
30/30README
25/25Documentation directory
15/15Documentation / homepage sitehttps://sagemaker.readthedocs.io/
10/10Repository description
10/10Topics8 topics
0/10Wiki
Inputs used
topicsaws, mxnet, tensorflow, machine-learning, python, pytorch, sagemaker, huggingface
has_wikino
homepagehttps://sagemaker.readthedocs.io/
docs_sitehttps://sagemaker.readthedocs.io/
has_readmeyes
has_docs_diryes
has_descriptionyes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

55Moderate · 16% of overall
How it's scored
7.5/7.5Binary-Artifactsno binaries found in the repo
5.2/7.5Branch-Protectionbranch protection is not maximal on development and all release branches
2.2/2.5CI-Tests29 out of 30 merged PRs checked by a CI test -- score normalized to 9
0/2.5CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
6.8/7.5Code-ReviewFound 29/30 approved changesets -- score normalized to 9
2.5/2.5Contributorsproject has 12 contributing companies or organizations
0/10Dangerous-Workflowdangerous workflow patterns detected
7.5/7.5Dependency-Update-Toolupdate tool detected
0/5Fuzzingproject is not fuzzed
2.5/2.5Licenselicense file detected
7.5/7.5Maintained30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
0/5Packagingno data
0/5Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
4.5/5SASTSAST tool detected but not run on all commits
5/5Security-Policysecurity policy file detected
0/7.5Signed-Releasesno data
0/7.5Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities146 existing vulnerabilities detected
Inputs used
sourceopenssf_scorecard
checks_evaluated16
scorecard_versionv5.5.0
checks_inconclusive2
scorecard_aggregate5.5
Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.

83Excellent · 4% of overall
How it's scored
45/45Agent instructionsAGENTS.md
15/15Machine-readable docs (llms.txt)llms.txt present
0/40Legible commit historyno data
Inputs used
has_llms_txtyes
llms_txt_url
legible_history_share
agent_instruction_filesAGENTS.md
agent_instruction_max_bytes7,702
Excluded from scoring (no data or not applicable): Legible commit history. Remaining weights renormalized.
How it's scored
18/18One-command bootstrapdocs/Makefile, sagemaker-core/docs/Makefile
22/22Automated tests
11/11Lint / format config.pylintrc, tox.ini
0/11Static type checking
10/10Reproducible environmentDockerfile
0/10Demonstrated agent practiceno data
0/8Automated maintenanceno data
0/10OpenSSF Scorecard: Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
Inputs used
has_nixno
has_testsyes
lockfiles
has_dockerfileyes
typed_languageno
bootstrap_filesdocs/Makefile, sagemaker-core/docs/Makefile
has_devcontainerno
has_linter_configyes
typecheck_configs
agent_commit_share
toolchain_manifests
dependency_bot_commit_share
Excluded from scoring (no data or not applicable): Demonstrated agent practice, Automated maintenance. Remaining weights renormalized.
How it's scored
0/45Type-checkable codePython without a type-check config
53.3/55Manageable file sizes38/1,197 source files over 60KB
Inputs used
primary_languagePython
largest_source_bytes1,579,353
source_files_sampled1,197
oversized_source_files38
How it's scored
0/40API schema (OpenAPI/GraphQL/proto)not applicable to this kind of software
0/20MCP servernot applicable to this kind of software
40/40Runnable examplesnotebooks, sample
Inputs used
example_dirsnotebooks, sample
has_mcp_signalno
api_schema_files
interfaces_expected_of
Excluded from scoring (no data or not applicable): API schema (OpenAPI/GraphQL/proto), MCP server. Remaining weights renormalized.

Key facts

2,253GitHub stars
100contributors
304commits, last 12 months
0days since last push
100releases
17bus factor
300open issues
PyPIpackage ecosystems

More detail

OpenSSF Scorecard 5.5 / 10
5.5aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-16 06:25 UTC

10Binary-Artifactsno binaries found in the repo
7Branch-Protectionbranch protection is not maximal on development and all release branches
9CI-Tests29 out of 30 merged PRs checked by a CI test -- score normalized to 9
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
9Code-ReviewFound 29/30 approved changesets -- score normalized to 9
10Contributorsproject has 12 contributing companies or organizations
0Dangerous-Workflowdangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
n/aPackagingpackaging workflow not detected
0Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
9SASTSAST tool detected but not run on all commits
10Security-Policysecurity policy file detected
n/aSigned-Releasesno releases found
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities146 existing vulnerabilities detected
Direct dependencies 63
RegistryPackageVersion constraintManifest
PyPIsagemaker-core>=2.16.0,<3.0.0pyproject.toml
PyPIsagemaker-train>=1.16.0,<2.0.0pyproject.toml
PyPIsagemaker-serve>=1.16.0,<2.0.0pyproject.toml
PyPIsagemaker-mlops>=1.16.0,<2.0.0pyproject.toml
PyPIboto3>=1.42.2,<2.0.0sagemaker-core/pyproject.toml
PyPIpydantic>=2.0.0,<3.0.0sagemaker-core/pyproject.toml
PyPIPyYAML>=6.0, <7.0sagemaker-core/pyproject.toml
PyPIjsonschema<5.0.0sagemaker-core/pyproject.toml
PyPIplatformdirs>=4.0.0, <5.0.0sagemaker-core/pyproject.toml
PyPIrich>=13.0.0, <15.0.0sagemaker-core/pyproject.toml
PyPImock>4.0, <5.0sagemaker-core/pyproject.toml
PyPIimportlib-metadata<7.0,>=1.4.0sagemaker-core/pyproject.toml
PyPItyping_extensions>=4.9.0sagemaker-core/pyproject.toml
PyPIpytz>=2021.1sagemaker-core/pyproject.toml
PyPIrequests>=2.20.0,<3.0.0sagemaker-core/pyproject.toml
PyPIattrs>=20.3.0sagemaker-core/pyproject.toml
PyPIpackaging>=20.0sagemaker-core/pyproject.toml
PyPIprotobuf>=3.12,<7.0.0sagemaker-core/pyproject.toml
PyPIpandas>=1.0.0sagemaker-core/pyproject.toml
PyPInumpy>=1.9.0sagemaker-core/pyproject.toml
PyPIsmdebug_rulesconfig>=1.0.1sagemaker-core/pyproject.toml
PyPIschema>=0.7.5sagemaker-core/pyproject.toml
PyPIomegaconf>=2.1.0sagemaker-core/pyproject.toml
PyPIscipy>=1.5.0sagemaker-core/pyproject.toml
PyPIcloudpickle>=2.0.0sagemaker-core/pyproject.toml
PyPIparamiko>=2.11.0sagemaker-core/pyproject.toml
PyPItblib>=1.7.0sagemaker-core/pyproject.toml
PyPIcryptography>=46.0.0sagemaker-core/pyproject.toml
PyPIsagemaker-core>=2.16.0sagemaker-mlops/pyproject.toml
PyPIsagemaker-train>=1.16.0sagemaker-mlops/pyproject.toml
PyPIsagemaker-serve>=1.16.0sagemaker-mlops/pyproject.toml
PyPIcryptography>=46.0.0sagemaker-mlops/pyproject.toml
PyPIboto3>=1.42.2,<2.0sagemaker-mlops/pyproject.toml
PyPIbotocore>=1.42.2,<2.0sagemaker-mlops/pyproject.toml
PyPIpyiceberg>=0.8.0sagemaker-mlops/pyproject.toml
PyPIpyarrow>=14.0.0sagemaker-mlops/pyproject.toml
PyPIs3fssagemaker-mlops/pyproject.toml
PyPIsagemaker-core>=2.16.0sagemaker-serve/pyproject.toml
PyPIsagemaker-train>=1.16.0sagemaker-serve/pyproject.toml
PyPIboto3>=1.42.2,<2.0sagemaker-serve/pyproject.toml
PyPIbotocore>=1.35.75,<2.0sagemaker-serve/pyproject.toml
PyPIdeepdiffsagemaker-serve/pyproject.toml
PyPImlflowsagemaker-serve/pyproject.toml
PyPIsagemaker_schema_inference_artifactssagemaker-serve/pyproject.toml
PyPIpytestsagemaker-serve/pyproject.toml
PyPItqdmsagemaker-serve/pyproject.toml
PyPIpsutilsagemaker-serve/pyproject.toml
PyPItritonclientsagemaker-serve/pyproject.toml
PyPIonnxsagemaker-serve/pyproject.toml
PyPIonnxruntimesagemaker-serve/pyproject.toml
PyPItorch>=2.0.0sagemaker-serve/pyproject.toml
PyPIsagemaker-core>=2.16.0sagemaker-train/pyproject.toml
PyPIgraphene>=3,<4sagemaker-train/pyproject.toml
PyPItyping_extensions>=4.9.0sagemaker-train/pyproject.toml
PyPItblib>=1.7.0sagemaker-train/pyproject.toml
PyPIPyYAML>=6.0,<7.0sagemaker-train/pyproject.toml
PyPIparamiko>=2.11.0sagemaker-train/pyproject.toml
PyPIjinja2>=3.0,<4.0sagemaker-train/pyproject.toml
PyPIsagemaker-mlflow>=0.0.1,<1.0.0sagemaker-train/pyproject.toml
PyPImlflow>=3.0.0,<4.0.0sagemaker-train/pyproject.toml
PyPInest_asyncio>=1.5.0sagemaker-train/pyproject.toml
PyPIrequests>=2.28.0sagemaker-train/pyproject.toml
PyPIpydantic>=2.0.0sagemaker-train/pyproject.toml
All dependencies 149

Full resolved dependency set from the GitHub dependency graph: 46 direct and 103 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

RegistryPackageVersionRelation
PyPIattrsdirect
PyPIboto3direct
PyPIbotocoredirect
PyPIcloudpickledirect
PyPIcloudpickle2.2.1direct
PyPIcryptographydirect
PyPIgraphenedirect
PyPIimportlib-metadatadirect
PyPIjinja2direct
PyPIjsonschemadirect
PyPImlflowdirect
PyPImockdirect
PyPInest-asynciodirect
PyPInumpydirect
PyPIomegaconfdirect
PyPIpackagingdirect
PyPIpandasdirect
PyPIpandas1.3.4direct
PyPIparamikodirect
PyPIplatformdirsdirect
PyPIprotobufdirect
PyPIpyarrowdirect
PyPIpydanticdirect
PyPIpydantic2.11.9direct
PyPIpyicebergdirect
PyPIpytestdirect
PyPIpytzdirect
PyPIpyyamldirect
PyPIrequestsdirect
PyPIrichdirect
PyPIsagemaker-coredirect
PyPIsagemaker-mlflowdirect
PyPIsagemaker-mlopsdirect
PyPIsagemaker-servedirect
PyPIsagemaker-traindirect
PyPIschemadirect
PyPIscipydirect
PyPIscipy1.10.1direct
PyPIscipy1.13.0direct
PyPIsmdebug-rulesconfigdirect
PyPItblibdirect
PyPItorchdirect
PyPItorch2.0.1+cpudirect
PyPItorch2.7.0direct
PyPItqdmdirect
PyPItyping-extensionsdirect
PyPIaltairindirect
PyPIanyioindirect
PyPIastroid3.0.2indirect
PyPIawscliindirect
PyPIblackindirect
PyPIblack24.3.0indirect
PyPIblinkerindirect
PyPIbuildindirect
PyPIbuild1.2.1indirect
PyPIcachetoolsindirect
PyPIcertifi2024.7.4indirect
PyPIcharset-normalizerindirect
PyPIclickindirect
PyPIcoloramaindirect
PyPIcontextlib2indirect
PyPIdatasetsindirect
PyPIdecoratorindirect
PyPIdillindirect
PyPIdoc81.1.2indirect
PyPIdockerindirect
PyPIdocutilsindirect
PyPIdoes-not-existindirect
PyPIentrypointsindirect
PyPIfastapiindirect
PyPIfilelockindirect
PyPIflake87.1.2indirect
PyPIflake8-future-import0.4.7indirect
PyPIgitdbindirect
PyPIgitpythonindirect
PyPIgunicornindirect
PyPIh11indirect
PyPIhttpxindirect
PyPIhuggingface-hubindirect
PyPIidnaindirect
PyPIipywidgetsindirect
PyPIjmespathindirect
PyPImarkdown-it-pyindirect
PyPImarkupsafeindirect
PyPImatplotlibindirect
PyPImdurlindirect
PyPImpmathindirect
PyPImultiprocessindirect
PyPImypy0.942indirect
PyPImyst-nbindirect
PyPImyst-parserindirect
PyPInbsphinxindirect
PyPInetworkxindirect
PyPIpathosindirect
PyPIpillowindirect
PyPIpoxindirect
PyPIppftindirect
PyPIprotobuf3-to-dictindirect
PyPIpyasn1indirect
PyPIpydantic-core2.33.2indirect
PyPIpydeckindirect
PyPIpydocstyle6.1.1indirect
PyPIpyenchant3.2.2indirect
PyPIpygmentsindirect
PyPIpygments2.18.0indirect
PyPIpylintindirect
PyPIpylint3.0.3indirect
PyPIpymplerindirect
PyPIpyrsistentindirect
PyPIpyspark3.5.1indirect
PyPIpytest-covindirect
PyPIpytest-rerunfailuresindirect
PyPIpytest-xdistindirect
PyPIpython-dateutilindirect
PyPIpytz-deprecation-shimindirect
PyPIregexindirect
PyPIrsaindirect
PyPIs3transferindirect
PyPIsagemakerindirect
PyPIsagemaker-feature-store-pysparkindirect
PyPIsagemaker-feature-store-pyspark2.0.0indirect
PyPIscikit-learn1.6.1indirect
PyPIsetuptoolsindirect
PyPIsixindirect
PyPIsmmap5.0.0indirect
PyPIsniffioindirect
PyPIsphinxindirect
PyPIsphinx7.4.7indirect
PyPIsphinx-autobuildindirect
PyPIsphinx-book-themeindirect
PyPIsphinx-copybuttonindirect
PyPIsphinx-designindirect
PyPIsphinx-rtd-theme2.0.0indirect
PyPIstarletteindirect
PyPIstreamlitindirect
PyPIsympyindirect
PyPItensorflowindirect
PyPItokenizersindirect
PyPItomlindirect
PyPItoolzindirect
PyPItornadoindirect
PyPItransformersindirect
PyPItwine5.0.0indirect
PyPItzdataindirect
PyPItzlocalindirect
PyPIurllib3indirect
PyPIuvicornindirect
PyPIvalidatorsindirect
PyPIzippindirect
Raw JSON report machine-readable

Feedback

Spotted something off in this report, or have thoughts to share? Wrong measurements, missed tooling, ideas, questions — anything is welcome. Every message is read and gets a response.

The message is kept through sign-in.

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.10.0, schema v0.11.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statisticsPyPI.