Score capped to 2.99 (raw score: 3.89) due to insufficient data in one or more signals. The composite is held at caution level until all signals can be fully evaluated.
Mar 4, 2026 at 11:29 PM6 signals analysedNo manual reviews · fully automated
Trust Signal Breakdown
high23 sub-signals across 6 dimensions
CVEs, dependency health, and supply chain integrity
3 of 3 sub-signals with data
Known CVEs40%5.0
No known CVEs
via OSV.dev
Dependency Health30%5.0
10 dependencies (minimal)
via npm / PyPI
Supply Chain30%4.8
37 transitive CVEs found (penalty: -0.25)
via npm provenance
Uptime, latency, error rates, and incident history
Public repo with OSI-approved license (apache-2.0)
via GitHub
Documentation25%4.0
Thorough README (>5000 bytes)
via GitHub
Security Policy20%5.0
SECURITY.md present
via GitHub
Changelog25%4.0
Releases exist but no CHANGELOG.md
via GitHub
Track record, org maturity, community standing
4 of 4 sub-signals with data
Track Record30%0.0
via Fabric index
Org Maturity30%0.0
via GitHub
Community Standing20%0.0
via GitHub
Cross-Platform20%0.0
via Registry scan
About this score
Scored across 23 sub-signals in 6 dimensionsScoring engine v1 (beta) — actively being expandedPhase 1: Core sub-signal architecture (live)Phase 2: Permission scope & expanded collection (in progress)
Trust AssessmentAI Assessment
Yandex's gradient boosting library with built-in handling of categorical features, GPU training, and strong out-of-the-box performance on structured data.