How We Score It
Every app and package scored the same way — deterministic, disclosed, and repeatable.
No score here comes from a vendor's pitch or a raw star count. All three are computed the same way for every listing, from public data or a direct read of the actual source code — not asserted, not editorialized. Here's exactly what goes into each one.
Repo Health
Pulled straight from GitHub, no opinions involved. Five signals, each worth an equal share of a 100-point score — deterministic and reproducible from public repo metadata alone.
- Development Activity20%How often the project ships — commit frequency and how recently it was last pushed to.
- Maintenance Consistency20%Whether releases and commits keep coming, not just a burst of early activity.
- Community Engagement20%Stars, watchers, forks, and contributor count — weighed as ratios, not raw totals, so a mega-popular repo with a skeleton crew doesn’t inflate the score.
- Project Maturity20%How long the project has been alive, log-scaled so a 10-year repo doesn’t automatically dwarf a solid 3-year one.
- Trend Momentum20%Star growth relative to age — is it still gaining traction, or coasting on popularity it earned years ago.
Technical Score
The only one of the three that isn't a formula. Claude reads the cloned repository — source files, tests, docs — the way a senior engineer doing due diligence would, and scores what it actually finds.
- Architecture25%Structure and separation of concerns, traced from the entry point through the real code — what breaks if a core abstraction changes.
- Code Quality25%Tests, error handling, type safety, linting, CI — or the lack of any of them.
- Innovation25%What this does that alternatives don’t. Standard patterns score lower than genuinely novel technical choices.
- Learning Curve25%How much documentation actually exists — README, CONTRIBUTING, a docs folder, inline comments, working examples.
Dependency Health
An app inherits every dependency's risk. This score looks past the app's own code at what it's actually built on.
- Library Repo Health30%The average Repo Health score of every tracked dependency — the same five-signal formula above, applied one level down.
- Library Technical Quality30%The average Technical Score of those same dependencies.
- Vulnerabilities15%Known CVEs sourced from OSV.dev, weighted by severity and how many dependencies are affected — not just a yes/no flag.
- Staleness15%How far pinned versions lag behind the latest release — current, a patch behind, a minor behind, or a major behind.
- Footprint10%How many dependencies are tracked at all. A sprawling dependency tree is its own risk, independent of any single library’s quality.
Further Reading
Scores are recomputed as GitHub and registry data refreshes — not a one-time snapshot. For more on why raw popularity metrics like stars can be misleading on their own:
