Scores every repo on 12 checks with direct links to GitHub settings for fast fixes.
Engineering managers, DevOps leads, GitHub organization admins
OpenSSF Scorecard · Allstar · SonarQube
It installs as a GitHub App, runs nightly checks across all your repos, and gives each one a score out of 100. Checks cover things like:
- Branch protection and required reviews - Secret scanning and Dependabot enabled - CI configured, stale PRs, stale repos - README, CODEOWNERS, LICENSE, CONTRIBUTING present
Results show up in a web dashboard and in a weekly Slack digest so the team stays aware without having to go looking. Free tier covers up to 5 repos and weekly email digest.
Happy to hear what checks you'd want to see added.
Gives you org-level operations that you'd otherwise script: auth, list orgs, repo sorting (stars/activity/staleness), stale-repo finder, cross-org issues and a dashboard — with JSON output for easy automation. Nothing revolutionary here, but the focused command set, XDG-config support and explicit token scopes make it a practical, scriptable tool for keeping repo hygiene under control.
Cross-repo dependency graphs with blast radius simulation—no signup, instant org visualization.
Local-first repo scoring with drift tracking beats cloud dashboards like Ossinsight.
Outputs a tight, schema-backed JSON (schema_version, tech_stack, architecture, health) you can drop into analytics, bots, or CI gates. The multi-interface approach — library, CLI, REST API and an MCP STDIO server — makes it easy to hook into automation or LLM workflows without relying on fuzzy heuristics. Feels like a pragmatic, engineer-first tool; I'd still like a hosted UI or richer security scoring for broader adoption.
Vanity metric generator for engineering leaders who love dashboards.
GitHub repo analyzer without hallucination; ships as CLI, library, REST API, and MCP server.
