{ "openapi": "3.1.1", "info": { "title": "Open Source Trust Explorer API", "version": "1.0.0", "summary": "Is this open-source project maintained and trustworthy? Scorecard, activity and provenance.", "description": "Every endpoint performs the same calculation as the human page and returns inputs, result, units, assumptions, sources, warnings and computedAt. MCP endpoint: /mcp." }, "servers": [ { "url": "https://opensourcetrustexplorer.usefulweb.site" } ], "paths": { "/api/v1/calculate": { "post": { "operationId": "calculate", "summary": "Is this open-source project maintained and trustworthy? Scorecard, activity and provenance.", "description": "For a GitHub repository or a package (npm, PyPI, Go, Maven, Cargo, NuGet, RubyGems) combines deps.dev data (versions, licences, advisories, SLSA provenance, OpenSSF Scorecard) with GitHub activity (last push, releases, contributors, archived status) into an explained maintenance score and a list of trust signals, including whether releases are signed.\n\nMethodology:\n- Packages: deps.dev /v3/systems/{system}/packages/{name} (all versions, default version, deprecation) and /versions/{version} (licences, advisories, SLSA provenance, linked source repository).\n- Repository: deps.dev /v3/projects/{github.com/owner/repo} (stars, licence, OpenSSF Scorecard checks) and the unauthenticated GitHub REST API (repo, latest releases, contributor count via the Link header of ?per_page=1&anon=1). GitHub allows 60 unauthenticated requests per hour per IP; when rate-limited the score uses deps.dev data only.\n- Maintenance score = sum of available components ÷ their maximum × 100: recent commits (25), recent release (20), Scorecard Maintained (15), contributors (15), Scorecard Code-Review (10), Security-Policy (5), licence (10). Missing components are left out rather than counted as zero; archived repositories are capped at 10.\n- Release signing: the Scorecard \"Signed-Releases\" check (signatures or provenance attached to the last releases; -1 = no releases inspected) plus deps.dev's record of SLSA provenance / attestations for the package version.", "tags": [ "security" ], "x-mcp-tool": "open_source_trust_explorer", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenSourceTrustExplorerInput" }, "examples": { "example1": { "summary": "expressjs/express from pasted deps.dev + GitHub data (offline)", "value": { "depsdevProject": "{\"projectKey\": {\"id\": \"github.com/expressjs/express\"}, \"openIssuesCount\": 236, \"starsCount\": 69643, \"forksCount\": 25224, \"license\": \"MIT\", \"description\": \"Fast, unopinionated, minimalist web framework for node.\", \"homepage\": \"https://expressjs.com\", \"scorecard\": {\"date\": \"2026-08-24T00:00:00Z\", \"repository\": {\"name\": \"github.com/expressjs/express\", \"commit\": \"023767fe9872e029271df1418f73401bff20ff40\"}, \"scorecard\": {\"version\": \"v5.5.1-0.20260815060127-d1fab88f5463\", \"commit\": \"d1fab88f54636ff366076edfc5c239f97b3c8e66\"}, \"checks\": [{\"name\": \"Maintained\", \"documentation\": {\"shortDescription\": \"Determines if the project is \\\"actively maintained\\\".\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#maintained\"}, \"score\": 10, \"reason\": \"17 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10\", \"details\": []}, {\"name\": \"Code-Review\", \"documentation\": {\"shortDescription\": \"Determines if the project requires human code review before pull requests (aka merge requests) are merged.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#code-review\"}, \"score\": 10, \"reason\": \"all changesets reviewed\", \"details\": []}, {\"name\": \"Packaging\", \"documentation\": {\"shortDescription\": \"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#packaging\"}, \"score\": -1, \"reason\": \"packaging workflow not detected\", \"details\": [\"Warn: no GitHub/GitLab publishing workflow detected.\"]}, {\"name\": \"Dangerous-Workflow\", \"documentation\": {\"shortDescription\": \"Determines if the project's GitHub Action workflows avoid dangerous patterns.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#dangerous-workflow\"}, \"score\": 10, \"reason\": \"no dangerous workflow patterns detected\", \"details\": []}, {\"name\": \"Binary-Artifacts\", \"documentation\": {\"shortDescription\": \"Determines if the project has generated executable (binary) artifacts in the source repository.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#binary-artifacts\"}, \"score\": 10, \"reason\": \"no binaries found in the repo\", \"details\": []}, {\"name\": \"Pinned-Dependencies\", \"documentation\": {\"shortDescription\": \"Determines if the project has declared and pinned the dependencies of its build process.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#pinned-dependencies\"}, \"score\": 6, \"reason\": \"dependency not pinned by hash detected -- score normalized to 6\", \"details\": [\"Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:40\", \"Warn: npmCommand not pinned by hash: .github/workflows/ci.yml:72\", \"Warn: npmCommand not pinned by hash: .github/workflows/legacy.yml:56\", \"Info: 18 out of 18 GitHub-owned GitHubAction dependencies pinned\", \"Info: 3 out of 3 third-party GitHubAction dependencies pinned\", \"Info: 0 out of 3 npmCommand dependencies pinned\"]}, {\"name\": \"CII-Best-Practices\", \"documentation\": {\"shortDescription\": \"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#cii-best-practices\"}, \"score\": 0, \"reason\": \"no effort to earn an OpenSSF best practices badge detected\", \"details\": []}, {\"name\": \"Token-Permissions\", \"documentation\": {\"shortDescription\": \"Determines if the project's workflows follow the principle of least privilege.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#token-permissions\"}, \"score\": 10, \"reason\": \"GitHub workflow tokens follow principle of least privilege\", \"details\": [\"Info: jobLevel 'contents' permission set to 'read': .github/workflows/ci.yml:93\", \"Warn: jobLevel 'checks' permission set to 'write': .github/workflows/ci.yml:94\", \"Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:32\", \"Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:33\", \"Info: jobLevel 'contents' permission set to 'read': .github/workflows/legacy.yml:77\", \"Warn: jobLevel 'checks' permission set to 'write': .github/workflows/legacy.yml:78\", \"Info: topLevel 'contents' permission set to 'read': .github/workflows/ci.yml:17\", \"Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:25\", \"Info: topLevel 'contents' permission set to 'read': .github/workflows/legacy.yml:19\", \"Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18\"]}, {\"name\": \"License\", \"documentation\": {\"shortDescription\": \"Determines if the project has defined a license.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#license\"}, \"score\": 10, \"reason\": \"license file detected\", \"details\": [\"Info: project has a license file: LICENSE:0\", \"Info: FSF or OSI recognized license: MIT License: LICENSE:0\"]}, {\"name\": \"Fuzzing\", \"documentation\": {\"shortDescription\": \"Determines if the project uses fuzzing.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#fuzzing\"}, \"score\": 0, \"reason\": \"project is not fuzzed\", \"details\": [\"Warn: no fuzzer integrations found\"]}, {\"name\": \"Signed-Releases\", \"documentation\": {\"shortDescription\": \"Determines if the project cryptographically signs release artifacts.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#signed-releases\"}, \"score\": -1, \"reason\": \"no releases found\", \"details\": []}, {\"name\": \"Security-Policy\", \"documentation\": {\"shortDescription\": \"Determines if the project has published a security policy.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#security-policy\"}, \"score\": 10, \"reason\": \"security policy file detected\", \"details\": [\"Info: security policy file detected: github.com/expressjs/.github/SECURITY.md:1\", \"Info: Found linked content: github.com/expressjs/.github/SECURITY.md:1\", \"Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/expressjs/.github/SECURITY.md:1\", \"Info: Found text in security policy: github.com/expressjs/.github/SECURITY.md:1\"]}, {\"name\": \"Branch-Protection\", \"documentation\": {\"shortDescription\": \"Determines if the default and release branches are protected with GitHub's branch protection settings.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#branch-protection\"}, \"score\": -1, \"reason\": \"internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md\", \"details\": []}, {\"name\": \"SAST\", \"documentation\": {\"shortDescription\": \"Determines if the project uses static code analysis.\", \"url\": \"https://github.com/ossf/scorecard/blob/d1fab88f54636ff366076edfc5c239f97b3c8e66/docs/checks.md#sast\"}, \"score\": 10, \"reason\": \"SAST tool is run on all commits\", \"details\": [\"Info: SAST configuration detected: CodeQL\", \"Info: all commits (30) are checked with a SAST tool\"]}], \"overallScore\": 8.5, \"metadata\": []}}", "githubRepo": "{\n \"full_name\": \"expressjs/express\",\n \"html_url\": \"https://github.com/expressjs/express\",\n \"description\": \"Fast, unopinionated, minimalist web framework for node.\",\n \"stargazers_count\": 69651,\n \"forks_count\": 25228,\n \"open_issues_count\": 236,\n \"pushed_at\": \"2026-10-09T16:24:39Z\",\n \"created_at\": \"2009-06-26T18:56:01Z\",\n \"archived\": false,\n \"disabled\": false,\n \"fork\": false,\n \"default_branch\": \"master\",\n \"license\": {\n \"key\": \"mit\",\n \"name\": \"MIT License\",\n \"spdx_id\": \"MIT\"\n },\n \"has_issues\": true\n}", "githubReleases": "[{\"tag_name\":\"v5.3.0\",\"published_at\":\"2026-10-09T12:50:31Z\",\"draft\":false,\"prerelease\":false},{\"tag_name\":\"v4.22.2\",\"published_at\":\"2026-05-11T18:54:02Z\",\"draft\":false,\"prerelease\":false},{\"tag_name\":\"v5.2.1\",\"published_at\":\"2025-12-01T20:54:44Z\",\"draft\":false,\"prerelease\":false}]", "contributorsCount": 394 } } } } } }, "responses": { "200": { "description": "Calculation result envelope.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OpenSourceTrustExplorerResult" } } } }, "400": { "description": "Malformed JSON body.", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "422": { "description": "Invalid input (see errors[]).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } }, "429": { "description": "Rate limit exceeded (see Retry-After).", "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/Problem" } } } } } } }, "/api/v1/tool": { "get": { "operationId": "getToolDefinition", "summary": "Inputs, output schema and examples for this tool", "responses": { "200": { "description": "Tool definition.", "content": { "application/json": { "schema": { "type": "object" } } } } } } } }, "components": { "schemas": { "Problem": { "type": "object", "description": "RFC 9457 problem details. 422 responses include per-field `errors`.", "required": [ "type", "title", "status", "detail" ], "properties": { "type": { "type": "string" }, "title": { "type": "string" }, "status": { "type": "integer" }, "detail": { "type": "string" }, "code": { "type": "string" }, "errors": { "type": "array", "items": { "type": "object", "required": [ "field", "message" ], "properties": { "field": { "type": "string" }, "message": { "type": "string" } } } } } }, "OpenSourceTrustExplorerInput": { "type": "object", "additionalProperties": false, "properties": { "target": { "title": "GitHub repo or package", "type": "string", "maxLength": 300 }, "depsdevProject": { "title": "Or paste deps.dev project JSON", "description": "Offline mode: response of api.deps.dev/v3/projects/.", "type": "string", "maxLength": 1000000 }, "depsdevVersion": { "title": "Optional: deps.dev package version JSON", "type": "string", "maxLength": 1000000 }, "githubRepo": { "title": "Optional: GitHub repo JSON", "description": "Response of api.github.com/repos//.", "type": "string", "maxLength": 500000 }, "githubReleases": { "title": "Optional: GitHub releases JSON", "type": "string", "maxLength": 1000000 }, "contributorsCount": { "title": "Optional: contributor count", "type": "integer", "minimum": 0, "maximum": 1000000 } }, "required": [] }, "OpenSourceTrustExplorerResult": { "type": "object", "additionalProperties": false, "required": [ "schemaVersion", "tool", "computedAt", "inputs", "summary", "result", "units", "assumptions", "sources", "warnings", "presentation", "links" ], "properties": { "schemaVersion": { "type": "string", "const": "1.0" }, "tool": { "type": "object", "additionalProperties": false, "required": [ "id", "name", "version" ], "properties": { "id": { "type": "string" }, "name": { "type": "string" }, "version": { "type": "string" } } }, "computedAt": { "type": "string", "format": "date-time" }, "inputs": { "type": "object", "description": "Normalised inputs actually used, including applied defaults." }, "summary": { "type": "string" }, "result": { "type": "object", "additionalProperties": false, "required": [ "repo", "package", "github", "scorecard", "maintenance", "releaseSigning", "signals" ], "properties": { "repo": { "type": [ "string", "null" ] }, "package": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "system", "name", "version", "publishedAt", "defaultVersion", "versionCount", "deprecated", "licenses", "advisories", "provenance" ], "properties": { "system": { "type": "string" }, "name": { "type": "string" }, "version": { "type": [ "string", "null" ] }, "publishedAt": { "type": [ "string", "null" ] }, "defaultVersion": { "type": [ "string", "null" ] }, "versionCount": { "type": "integer" }, "deprecated": { "type": "boolean" }, "licenses": { "type": "array", "items": { "type": "string" } }, "advisories": { "type": "array", "items": { "type": "string" } }, "provenance": { "type": "boolean" } } }, "github": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "stars", "forks", "openIssues", "pushedAt", "createdAt", "archived", "license", "latestRelease", "contributors" ], "properties": { "stars": { "type": [ "integer", "null" ] }, "forks": { "type": [ "integer", "null" ] }, "openIssues": { "type": [ "integer", "null" ] }, "pushedAt": { "type": [ "string", "null" ] }, "createdAt": { "type": [ "string", "null" ] }, "archived": { "type": "boolean" }, "license": { "type": [ "string", "null" ] }, "latestRelease": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "tag", "publishedAt" ], "properties": { "tag": { "type": "string" }, "publishedAt": { "type": [ "string", "null" ] } } }, "contributors": { "type": [ "integer", "null" ] } } }, "scorecard": { "type": [ "object", "null" ], "additionalProperties": false, "required": [ "overall", "date", "checks" ], "properties": { "overall": { "type": [ "number", "null" ] }, "date": { "type": [ "string", "null" ] }, "checks": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "score", "reason" ], "properties": { "name": { "type": "string" }, "score": { "type": "integer" }, "reason": { "type": "string" } } } } } }, "maintenance": { "type": "object", "additionalProperties": false, "required": [ "score", "components" ], "properties": { "score": { "type": [ "integer", "null" ] }, "components": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "name", "points", "max", "explanation" ], "properties": { "name": { "type": "string" }, "points": { "type": "integer" }, "max": { "type": "integer" }, "explanation": { "type": "string" } } } } } }, "releaseSigning": { "type": "object", "additionalProperties": false, "required": [ "scorecardSignedReleases", "reason", "provenanceAttestations" ], "properties": { "scorecardSignedReleases": { "type": [ "integer", "null" ] }, "reason": { "type": [ "string", "null" ] }, "provenanceAttestations": { "type": "boolean" } } }, "signals": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "level", "text" ], "properties": { "level": { "type": "string", "enum": [ "good", "info", "warning", "bad" ] }, "text": { "type": "string" } } } } } }, "units": { "type": "object", "additionalProperties": { "type": "string" } }, "assumptions": { "type": "array", "items": { "type": "string" } }, "sources": { "type": "array", "items": { "type": "object", "additionalProperties": false, "required": [ "title" ], "properties": { "title": { "type": "string" }, "url": { "type": "string" }, "publisher": { "type": "string" }, "retrievedAt": { "type": "string" }, "note": { "type": "string" } } } }, "warnings": { "type": "array", "items": { "type": "string" } }, "presentation": { "type": "array", "items": { "type": "object" }, "description": "Display blocks used by the human page (same data)." }, "links": { "type": "object", "additionalProperties": false, "required": [ "human", "api", "openapi", "methodology" ], "properties": { "human": { "type": "string", "format": "uri" }, "api": { "type": "string", "format": "uri" }, "openapi": { "type": "string", "format": "uri" }, "methodology": { "type": "string", "format": "uri" } } } } } } } }