Open Source Trust Explorer

Is this open-source project maintained and trustworthy? Scorecard, activity and provenance.

Try an example: expressjs/express from pasted deps.dev + GitHub data (offline)

How it works

For a GitHub repository or a package (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems) combines deps.dev data (versions, licences, advisories, SLSA provenance, OpenSSF Scorecard) with GitHub activity (last push, releases, contributors, archived status) into an explained maintenance score and a list of trust signals, including whether releases are signed.

Packages: deps.dev /v3/systems/{system}/packages/{name} (all versions, default version, deprecation) and /versions/{version} (licences, advisories, SLSA provenance, linked source repository).
Repository: deps.dev /v3/projects/{github.com/owner/repo} (stars, licence, OpenSSF Scorecard checks) and the unauthenticated GitHub REST API (repo, latest releases, contributor count via the Link header of ?per_page=1&anon=1). GitHub allows 60 unauthenticated requests per hour per IP; when rate-limited the score uses deps.dev data only.
Maintenance score = sum of available components ÷ their maximum × 100: recent commits (25), recent release (20), Scorecard Maintained (15), contributors (15), Scorecard Code-Review (10), Security-Policy (5), licence (10). Missing components are left out rather than counted as zero; archived repositories are capped at 10.
Release signing: the Scorecard "Signed-Releases" check (signatures or provenance attached to the last releases; -1 = no releases inspected) plus deps.dev's record of SLSA provenance / attestations for the package version.

For scripts and AI agents

JSON API: POST https://opensourcetrustexplorer.usefulweb.site/api/v1/calculate (same calculation as this page)
Interface description: OpenAPI 3.1 · AI guide: llms.txt
MCP server (Streamable HTTP): https://opensourcetrustexplorer.usefulweb.site/mcp · tool name open_source_trust_explorer

Example request

curl -s -X POST https://opensourcetrustexplorer.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

Artifact Provenance Explorer – Verify npm build provenance: Sigstore signature, transparency log, source repo and commit.
Dependency Vulnerability Explorer – Known vulnerabilities in your dependencies, and the version that fixes each one.
SBOM Explorer – Open a CycloneDX or SPDX SBOM: components, licences, dependency tree and known vulnerabilities.