# Open Source Trust Explorer

> Is this open-source project maintained and trustworthy? Scorecard, activity and provenance. For a GitHub repository or a package (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems) combines deps.dev data (versions, licences, advisories, SLSA provenance, OpenSSF Scorecard) with GitHub activity (last push, releases, contributors, archived status) into an explained maintenance score and a list of trust signals, including whether releases are signed.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://opensourcetrustexplorer.usefulweb.site/ (interactive tool at https://opensourcetrustexplorer.usefulweb.site/tool)
- JSON API: POST https://opensourcetrustexplorer.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://opensourcetrustexplorer.usefulweb.site/api/v1/tool)
- OpenAPI: https://opensourcetrustexplorer.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://opensourcetrustexplorer.usefulweb.site/mcp - tool `open_source_trust_explorer`

## Inputs
- target (text): GitHub repo or package
- depsdevProject (textarea): Or paste deps.dev project JSON - Offline mode: response of api.deps.dev/v3/projects/<github.com%2Fowner%2Frepo>.
- depsdevVersion (textarea): Optional: deps.dev package version JSON
- githubRepo (textarea): Optional: GitHub repo JSON - Response of api.github.com/repos/<owner>/<repo>.
- githubReleases (textarea): Optional: GitHub releases JSON
- contributorsCount (integer): Optional: contributor count

## Method
- Packages: deps.dev /v3/systems/{system}/packages/{name} (all versions, default version, deprecation) and /versions/{version} (licences, advisories, SLSA provenance, linked source repository).
- Repository: deps.dev /v3/projects/{github.com/owner/repo} (stars, licence, OpenSSF Scorecard checks) and the unauthenticated GitHub REST API (repo, latest releases, contributor count via the Link header of ?per_page=1&anon=1). GitHub allows 60 unauthenticated requests per hour per IP; when rate-limited the score uses deps.dev data only.
- Maintenance score = sum of available components ÷ their maximum × 100: recent commits (25), recent release (20), Scorecard Maintained (15), contributors (15), Scorecard Code-Review (10), Security-Policy (5), licence (10). Missing components are left out rather than counted as zero; archived repositories are capped at 10.
- Release signing: the Scorecard "Signed-Releases" check (signatures or provenance attached to the last releases; -1 = no releases inspected) plus deps.dev's record of SLSA provenance / attestations for the package version.