What is TrustOSS
TrustOSS is a free web tool that analyzes the health of open-source GitHub repositories. It scores any public repository from 0 to 100, audits whether its stars are organic, scans for known vulnerabilities, and lets you compare up to four candidate libraries side by side — so you can evaluate a dependency before you install it.
How to use TrustOSS
- Search or paste a repo: Type keywords like “rust http client” to rank candidates, or paste owner/repo or a GitHub URL to jump straight to a report.
- Read the health report: Get the overall score and five dimension breakdowns instantly, then run the deep scan and star audit for vulnerabilities, bus factor, real adoption, and star authenticity.
- Decide and share: Every report lives at a shareable /repo/owner/name URL. Compare finalists side by side, and add the score badge to your own README.
Features of TrustOSS
- Health score: A 0–100 score with a letter grade, broken into five weighted dimensions: activity, maintenance, community, documentation, and maturity — computed from public GitHub data.
- Fake-star audit: Plots the star growth curve and profiles recent stargazers by account age, followers, and repositories — the same signals used in fake-star research — to flag bought popularity.
- Deep scan: Known vulnerabilities from OSV, real dependent packages from deps.dev, bus factor from commit concentration, CI pass rate, PR merge rate, and docs-only detection — as OK/WARN/RISK findings with evidence.
- Side-by-side compare: Pick 2–4 candidate libraries and get a radar chart plus a score table across all five dimensions, with the strongest pick highlighted.
- README badge: An embeddable SVG badge showing your repository's live TrustOSS score, ready to paste into any README.
- CLI & agent skill: The trustoss-cli package brings analyze, deep-scan, and star-audit to your terminal — and installs a skill so AI coding agents can vet dependencies automatically.
Use Cases of TrustOSS
- Evaluate a dependency before installing it.
- Compare up to four candidate libraries side by side.
- Detect fake stars and bought popularity in repositories.
- Check for known vulnerabilities, bus factor, and real adoption.
- Show your own repository's health score in its README.
Pricing
TrustOSS is free. Searching, analyzing, comparing, deep scans, star audits, and badges require no account. Signing in with GitHub is only needed for the maintainer dashboard, which shows scores for your own repositories.
FAQ
What is TrustOSS? TrustOSS is a free web tool that analyzes the health of open-source GitHub repositories. It scores any public repository from 0 to 100, audits whether its stars are organic, scans for known vulnerabilities, and lets you compare up to four candidate libraries side by side — so you can evaluate a dependency before you install it.
How is the health score calculated? The overall score combines five weighted dimensions computed from public GitHub data: activity (25%) — last push, 90-day commit frequency, release cadence; maintenance (25%) — median issue close time, open-issue pressure, archived status; community (20%) — stars, forks, contributors; documentation (15%) — README, license, contributing guide; and maturity (15%) — project age and release history.
How does the fake-star audit work? The star audit plots the repository's star growth curve and profiles its most recent stargazers by account age, follower count, and repository count, classifying each as veteran, active developer, casual, newcomer, or empty profile. Sudden vertical spikes plus a wave of empty single-action accounts are the same signatures used in academic fake-star research to identify bought stars.
What does the deep scan check? The deep scan probes real capability beyond surface metrics: code substance (tests, CI configuration, docs-only detection), engineering health (CI pass rate, PR merge rate), known vulnerabilities from the OSV database, real adoption via dependent packages from deps.dev, bus factor from commit concentration, and star-growth authenticity. Results are reported as OK, WARN, or RISK findings with evidence.
Is TrustOSS free? Do I need an account? Yes — searching, analyzing, comparing, deep scans, star audits, and badges are free and require no account. Signing in with GitHub is only needed for the maintainer dashboard, which shows scores for your own repositories.
Can I show my repository's score in its README? Yes. Every analyzed repository gets an embeddable SVG badge at /badge/owner/name that displays its current TrustOSS score. Paste the badge markdown into your README and it stays up to date automatically.
