# gxed/gogo-protobuf — health index 10/100 (Critical)

> Inspection of the public repository gxed/gogo-protobuf by inspect.software. It holds a health index of 10 out of 100, placing it in the Critical band. The index is a signal derived from publicly visible practice, not a warranty, a security audit, or an endorsement, and it is independent of payment.

- Repository: https://github.com/gxed/gogo-protobuf
- Report page: https://inspect.software/software/gxed/gogo-protobuf
- Full JSON report: https://inspect.software/api/repositories/gxed/gogo-protobuf/report
- Badge: https://raw.githubusercontent.com/inspect-software/badges/main/v1/g/gxed/gogo-protobuf.svg
- Inspected: 2026-07-26
- Methodology: metrics 1.13.0, report schema 0.27.0 (https://inspect.software/methodology.md)

## Category summary

| Category | Weight | Index | Band |
|---|---|---|---|
| Vitality | 22% | 17/100 | Critical |
| Community & Adoption | 18% | 9/100 | Critical |
| Sustainability & Governance | 24% | 31/100 | At risk |
| Engineering Quality | 20% | 18/100 | Critical |
| Security | 16% | 14/100 | Critical |
| AI Readiness | not counted | 61/100 | Moderate |

High-Risk Jurisdiction Policy applies a 50% multiplier to weighted overall health and gives it an At risk ceiling of 49.

## Repository facts

| Field | Value |
|---|---|
| Description | Protocol Buffers for Go with Gadgets |
| Primary language | Go |
| Stars | 0 |
| Forks | 0 |
| Created | 2019-02-18 |
| Last push | 2019-02-18 |
| Latest release | v1.2.1 |
| Commits (last year) | 0 |
| Bus factor | 1 |
| Fork | yes |

## Published packages

| Registry | Package | Latest | Monthly downloads |
|---|---|---|---|
| go | github.com/gogo/protobuf | v1.3.2 | — |

## Vitality — 17/100 (Critical)

Is the project alive — is code being written and are releases shipping? Weight: 22% of the overall index.

### Development activity — 1/100 (Critical)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Push recency | not met | 0 / 36 | last push 2715 days ago |
| Commit cadence | not met | 0 / 36 | 0/52 weeks with commits |
| Commit volume | not met | 0 / 18 | 0 commits in the last year |
| OpenSSF Scorecard: Maintained | not met | 0 / 10 | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |

### Release discipline — 40/100 (At risk)

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Ships releases | partial | 16.2 / 27 | 5 version tags (no GitHub releases) |
| Release recency | not met | 0 / 36 | latest release 2715 days ago |
| Release cadence | partial | 19.8 / 27 | a release every ~95.1 days |
| OpenSSF Scorecard: Signed-Releases | excluded | 0 / 10 | no releases found |

### Abandonment — 85/100 (Excellent)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Project is still maintained | partial | 85 / 100 | no human commit for 2715 days; 2 unmet obligation(s): releases stalled, Scorecard reports it unmaintained |

## Community & Adoption — 9/100 (Critical)

Does the project have users, downloads, attention, and a welcoming setup for contributors? Weight: 18% of the overall index.

### Popularity & adoption — 1/100 (Critical)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Stars | not met | 0 / 60 | 0 stars |
| Forks | not met | 0 / 25 | 0 forks |
| Watchers | not met | 0 / 15 | 2 watchers |

### Community health — 19/100 (Critical)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| README | not met | 0 / 22.5 | — |
| License | partial | 16.9 / 22.5 | license file present, not a recognized license |
| CONTRIBUTING guide | not met | 0 / 18 | — |
| Code of conduct | not met | 0 / 13.5 | — |
| Issue template | not met | 0 / 7.2 | — |
| PR template | not met | 0 / 6.3 | — |

## Sustainability & Governance — 31/100 (At risk)

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep? Weight: 24% of the overall index.

### Maintainer resilience (bus factor) — 37/100 (At risk)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Bus factor | partial | 9 / 54 | 1 contributor(s) cover half of all commits |
| Commit distribution | partial | 4.8 / 22.5 | top contributor authored 79% of commits |
| Contributor breadth | met | 13.5 / 13.5 | 48 contributors |
| OpenSSF Scorecard: Contributors | met | 10 / 10 | project has 19 contributing companies or organizations |

### Issue & PR responsiveness — 1/100 (Critical)

Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Issue resolution | excluded | 0 / 46.8 | no issues or no data |
| PR acceptance | excluded | 0 / 38.2 | no decided pull requests or no data |
| OpenSSF Scorecard: Code-Review | not met | 0 / 15 | Found 0/30 approved changesets -- score normalized to 0 |

### Ownership & stewardship — 55/100 (Moderate)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Ownership backing | met | 30 / 30 | organization-owned |
| Verified domain | not met | 0 / 20 | — |
| Owner reach | not met | 0 / 25 | 0 followers of gxed |
| Track record | met | 25 / 25 | 115 public repos, account ~10 yr old |

## Engineering Quality — 18/100 (Critical)

Are baseline engineering and documentation practices in place? Weight: 20% of the overall index.

### Engineering practices — 30/100 (At risk)

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.

| Criterion | Status | Points | Detail |
|---|---|---|---|
| CI workflows | not met | 0 / 24 | — |
| Tests present | met | 24 / 24 | — |
| Linter config | not met | 0 / 16 | — |
| Pre-commit hooks | not met | 0 / 9.6 | — |
| .editorconfig | not met | 0 / 6.4 | — |
| OpenSSF Scorecard: CI-Tests | excluded | 0 / 20 | no pull request found |

### Documentation — 1/100 (Critical)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| README | not met | 0 / 30 | — |
| Documentation directory | not met | 0 / 25 | — |
| Documentation / homepage site | not met | 0 / 15 | — |
| Repository description | not met | 0 / 10 | — |
| Topics | not met | 0 / 10 | — |
| Wiki | not met | 0 / 10 | — |

## Security — 14/100 (Critical)

Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure? Weight: 16% of the overall index.

### Security posture — 14/100 (Critical)

Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized. High-Risk Jurisdiction Policy applies a 50% multiplier to Security posture and gives it an At risk ceiling of 49.

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Binary-Artifacts | met | 7.5 / 7.5 | no binaries found in the repo |
| Branch-Protection | not met | 0 / 7.5 | branch protection not enabled on development/release branches |
| CI-Tests | excluded | 0 / 2.5 | no pull request found |
| CII-Best-Practices | not met | 0 / 2.5 | no effort to earn an OpenSSF best practices badge detected |
| Code-Review | not met | 0 / 7.5 | Found 0/30 approved changesets -- score normalized to 0 |
| Contributors | met | 2.5 / 2.5 | project has 19 contributing companies or organizations |
| Dangerous-Workflow | excluded | 0 / 10 | no workflows found |
| Dependency-Update-Tool | not met | 0 / 7.5 | no update tool detected |
| Fuzzing | not met | 0 / 5 | project is not fuzzed |
| License | partial | 2.2 / 2.5 | license file detected |
| Maintained | not met | 0 / 7.5 | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
| Packaging | excluded | 0 / 5 | packaging workflow not detected |
| Pinned-Dependencies | excluded | 0 / 5 | no dependencies found |
| SAST | not met | 0 / 5 | no SAST tool detected |
| Security-Policy | not met | 0 / 5 | security policy file not detected |
| Signed-Releases | excluded | 0 / 7.5 | no releases found |
| Token-Permissions | excluded | 0 / 7.5 | No tokens found |
| Vulnerabilities | met | 7.5 / 7.5 | 0 existing vulnerabilities detected |

### High-Risk Jurisdiction Exposure — 50/100 (Moderate)

Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Policy exposure multiplier | partial | 50 / 100 | Russia: top_contributor (1) |

## AI Readiness — 61/100 (Moderate)

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

### Agent context & guidance — 27/100 (Critical)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Agent instructions | not met | 0 / 45 | no CLAUDE.md / AGENTS.md / editor rules |
| Machine-readable docs (llms.txt) | not met | 0 / 15 | — |
| Legible commit history | partial | 27.2 / 40 | 51 of 100 human commits state their intent (structured subject or explanatory body) |

### Verify loop (build / test / typecheck) — 68/100 (Moderate)

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.

| Criterion | Status | Points | Detail |
|---|---|---|---|
| One-command bootstrap | met | 18 / 18 | Makefile, conformance/Makefile, gogoproto/Makefile, jsonpb/jsonpb_test_proto/Makefile, proto/Makefile, proto/proto3_proto/Makefile, proto/test_proto/Makefile, protobuf/Makefile, protoc-gen-gogo/Makefile, protoc-gen-gogo/descriptor/Makefile, protoc-gen-gogo/plugin/Makefile, protoc-gen-gogo/testdata/Makefile, test/Makefile, test/asymetric-issue125/Makefile, test/cachedsize/Makefile, test/casttype/Makefile, test/castvalue/Makefile, test/custombytesnonstruct/Makefile, test/data/Makefile, test/deterministic/Makefile, test/empty-issue70/Makefile, test/enumcustomname/Makefile, test/enumdecl/Makefile, test/enumdecl_all/Makefile, test/enumprefix/Makefile, test/enumstringer/Makefile, test/example/Makefile, test/filedotname/Makefile, test/fuzztests/Makefile, test/group/Makefile, test/importcustom-issue389/Makefile, test/importcustom-issue389/imported/Makefile, test/importcustom-issue389/importing/Makefile, test/importdedup/Makefile, test/importduplicate/Makefile, test/indeximport-issue72/Makefile, test/int64support/Makefile, test/issue260/Makefile, test/issue261/Makefile, test/issue262/Makefile, test/issue312/Makefile, test/issue312/events/Makefile, test/issue322/Makefile, test/issue330/Makefile, test/issue34/Makefile, test/issue411/Makefile, test/issue427/Makefile, test/issue42order/Makefile, test/issue435/Makefile, test/issue438/Makefile, test/issue444/Makefile, test/issue449/Makefile, test/issue498/Makefile, test/issue503/Makefile, test/issue8/Makefile, test/mapdefaults/Makefile, test/mapsproto2/Makefile, test/merge/Makefile, test/moredefaults/Makefile, test/nopackage/Makefile, test/oneof/Makefile, test/oneof3/Makefile, test/oneofembed/Makefile, test/packed/Makefile, test/proto3extension/Makefile, test/protosize/Makefile, test/registration/Makefile, test/required/Makefile, test/sizeunderscore/Makefile, test/stdtypes/Makefile, test/tags/Makefile, test/theproto3/Makefile, test/typedecl/Makefile, test/typedecl_all/Makefile, test/typedeclimport/Makefile, test/types/Makefile, test/unmarshalmerge/Makefile, test/unrecognized/Makefile, test/unrecognizedgroup/Makefile, test/xxxfields/Makefile, vanity/test/Makefile |
| Automated tests | met | 22 / 22 | — |
| Lint / format config | not met | 0 / 11 | — |
| Static type checking | met | 11 / 11 | Go (statically typed) |
| Reproducible environment | met | 10 / 10 | lockfile |
| Demonstrated agent practice | not met | 0 / 10 | no agent-authored commits among the last 100 |
| Automated maintenance | not met | 0 / 8 | no automated dependency updates observed |
| OpenSSF Scorecard: Pinned-Dependencies | excluded | 0 / 10 | no dependencies found |

### Code legibility for models — 94/100 (Excellent)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| Type-checkable code | met | 45 / 45 | Go (statically typed) |
| Manageable file sizes | partial | 48.9 / 55 | 50/449 source files over 60KB |

### Machine-readable interfaces — 80/100 (Good)

| Criterion | Status | Points | Detail |
|---|---|---|---|
| API schema (OpenAPI/GraphQL/proto) | met | 40 / 40 | conformance/internal/conformance_proto/conformance.proto, gogoproto/gogo.proto, jsonpb/jsonpb_test_proto/more_test_objects.proto, jsonpb/jsonpb_test_proto/test_objects.proto, proto/proto3_proto/proto3.proto, proto/test_proto/test.proto, protobuf/google/protobuf/any.proto, protobuf/google/protobuf/api.proto, protobuf/google/protobuf/compiler/plugin.proto, protobuf/google/protobuf/descriptor.proto, protobuf/google/protobuf/duration.proto, protobuf/google/protobuf/empty.proto, protobuf/google/protobuf/field_mask.proto, protobuf/google/protobuf/source_context.proto, protobuf/google/protobuf/struct.proto, protobuf/google/protobuf/timestamp.proto, protobuf/google/protobuf/type.proto, protobuf/google/protobuf/wrappers.proto, protoc-gen-gogo/testdata/deprecated/deprecated.proto, protoc-gen-gogo/testdata/extension_base/extension_base.proto, protoc-gen-gogo/testdata/extension_extra/extension_extra.proto, protoc-gen-gogo/testdata/extension_user/extension_user.proto, protoc-gen-gogo/testdata/grpc/grpc.proto, protoc-gen-gogo/testdata/import_public/a.proto, protoc-gen-gogo/testdata/import_public/b.proto, protoc-gen-gogo/testdata/import_public/importing/importing.proto, protoc-gen-gogo/testdata/import_public/sub/a.proto, protoc-gen-gogo/testdata/import_public/sub/b.proto, protoc-gen-gogo/testdata/imports/fmt/m.proto, protoc-gen-gogo/testdata/imports/test_a_1/m1.proto, protoc-gen-gogo/testdata/imports/test_a_1/m2.proto, protoc-gen-gogo/testdata/imports/test_a_2/m3.proto, protoc-gen-gogo/testdata/imports/test_a_2/m4.proto, protoc-gen-gogo/testdata/imports/test_b_1/m1.proto, protoc-gen-gogo/testdata/imports/test_b_1/m2.proto, protoc-gen-gogo/testdata/imports/test_import_a1m1.proto, protoc-gen-gogo/testdata/imports/test_import_a1m2.proto, protoc-gen-gogo/testdata/imports/test_import_all.proto, protoc-gen-gogo/testdata/multi/multi1.proto, protoc-gen-gogo/testdata/multi/multi2.proto, protoc-gen-gogo/testdata/multi/multi3.proto, protoc-gen-gogo/testdata/my_test/test.proto, protoc-gen-gogo/testdata/proto3/proto3.proto, test/asymetric-issue125/asym.proto, test/cachedsize/cachedsize.proto, test/casttype/casttype.proto, test/casttype/combos/both/casttype.proto, test/casttype/combos/marshaler/casttype.proto, test/casttype/combos/neither/casttype.proto, test/casttype/combos/unmarshaler/casttype.proto, test/castvalue/castvalue.proto, test/castvalue/combos/both/castvalue.proto, test/castvalue/combos/marshaler/castvalue.proto, test/castvalue/combos/unmarshaler/castvalue.proto, test/combos/both/thetest.proto, test/combos/marshaler/thetest.proto, test/combos/unmarshaler/thetest.proto, test/custombytesnonstruct/proto.proto, test/dashfilename/dash-filename.proto, test/data/data.proto, test/defaultconflict/df.proto, test/defaultconflict/dg.proto, test/defaultconflict/nc.proto, test/defaultconflict/ne.proto, test/defaultconflict/nx.proto, test/deterministic/deterministic.proto, test/embedconflict/eb.proto, test/embedconflict/ec.proto, test/embedconflict/ee.proto, test/embedconflict/em.proto, test/embedconflict/en.proto, test/embedconflict/er.proto, test/empty-issue70/empty.proto, test/enumcustomname/enumcustomname.proto, test/enumdecl/enumdecl.proto, test/enumdecl_all/enumdeclall.proto, test/enumprefix/enumprefix.proto, test/enumstringer/enumstringer.proto, test/example/example.proto, test/filedotname/file.dot.proto, test/fuzztests/fuzz.proto, test/group/group.proto, test/importcustom-issue389/imported/a.proto, test/importcustom-issue389/importing/c.proto, test/importdedup/proto.proto, test/importdedup/subpkg/subproto.proto, test/importduplicate/importduplicate.proto, test/importduplicate/proto/proto.proto, test/importduplicate/sortkeys/sortable.proto, test/indeximport-issue72/index/index.proto, test/indeximport-issue72/indeximport.proto, test/int64support/object.proto, test/issue260/issue260.proto, test/issue261/issue261.proto, test/issue262/timefail.proto, test/issue270/a/a1.proto, test/issue270/a/a2.proto, test/issue270/b/b.proto, test/issue312/events/events.proto, test/issue312/issue312.proto, test/issue322/issue322.proto, test/issue330/issue330.proto, test/issue34/proto.proto, test/issue411/issue411.proto, test/issue427/issue427.proto, test/issue42order/issue42.proto, test/issue435/issue435.proto, test/issue438/issue438.proto, test/issue444/issue444.proto, test/issue449/issue449.proto, test/issue498/issue498.proto, test/issue503/issue503.proto, test/issue8/proto.proto, test/mapdefaults/combos/both/map.proto, test/mapdefaults/combos/marshaler/map.proto, test/mapdefaults/combos/neither/map.proto, test/mapdefaults/combos/unmarshaler/map.proto, test/mapdefaults/map.proto, test/mapsproto2/combos/both/mapsproto2.proto, test/mapsproto2/combos/marshaler/mapsproto2.proto, test/mapsproto2/combos/neither/mapsproto2.proto, test/mapsproto2/combos/unmarshaler/mapsproto2.proto, test/mapsproto2/header.proto, test/mapsproto2/mapsproto2.proto, test/merge/merge.proto, test/moredefaults/md.proto, test/nopackage/nopackage.proto, test/oneof/combos/both/one.proto, test/oneof/combos/marshaler/one.proto, test/oneof/combos/neither/one.proto, test/oneof/combos/unmarshaler/one.proto, test/oneof/one.proto, test/oneof3/combos/both/one.proto, test/oneof3/combos/marshaler/one.proto, test/oneof3/combos/neither/one.proto, test/oneof3/combos/unmarshaler/one.proto, test/oneof3/one.proto, test/oneofembed/oneofembed.proto, test/packed/packed.proto, test/proto3extension/proto3ext.proto, test/protosize/protosize.proto, test/registration/registration.proto, test/required/requiredexample.proto, test/sizerconflict/sizerconflict.proto, test/sizeunderscore/sizeunderscore.proto, test/stdtypes/stdtypes.proto, test/tags/tags.proto, test/theproto3/combos/both/theproto3.proto, test/theproto3/combos/marshaler/theproto3.proto, test/theproto3/combos/neither/theproto3.proto, test/theproto3/combos/unmarshaler/theproto3.proto, test/theproto3/footer.proto, test/theproto3/header.proto, test/theproto3/maps.proto, test/theproto3/theproto3.proto, test/thetest.proto, test/typedecl/typedecl.proto, test/typedecl_all/typedeclall.proto, test/typedeclimport/subpkg/subpkg.proto, test/typedeclimport/typedeclimport.proto, test/types/combos/both/types.proto, test/types/combos/marshaler/types.proto, test/types/combos/neither/types.proto, test/types/combos/unmarshaler/types.proto, test/types/types.proto, test/unmarshalmerge/unmarshalmerge.proto, test/unrecognized/unrecognized.proto, test/unrecognizedgroup/unrecognizedgroup.proto, test/xxxfields/xxxfields.proto, vanity/test/gogovanity.proto, vanity/test/proto3.proto, vanity/test/vanity.proto |
| MCP server | not met | 0 / 20 | — |
| Runnable examples | met | 40 / 40 | example |

## Collection warnings

- Community profile unavailable
- go package 'github.com/gogo/protobuf' points at a different repository (https://github.com/gogo/protobuf); excluded from ecosystem scoring
- Could not fetch npm package 'gogo-protobuf' from its registry
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

## What this report is

inspect.software measures public repositories against a single published, versioned methodology and reports the result as a 1–100 health index. Findings are signals derived from what is visible in public repository data — they are not a security audit, a warranty, or an endorsement, and no result depends on payment.

- Methodology, formulas and weights: https://inspect.software/methodology.md
- What a result does and does not claim: https://inspect.software/wiki/signals-not-warranties.md
- Rating bands: https://inspect.software/wiki/scoring-bands.md
- Corrections: https://inspect.software/contact.md
- Index of all documents: https://inspect.software/llms.txt