OpenSSF Scorecard - Security health metrics for Open Source

Official GitHub Action for OpenSSF Scorecard.

Simplify OpenSSF Scorecard tracking in your organization with automated markdown and JSON reports, plus optional GitHub issue alerts

Website and API for OpenSSF Scorecard

Tool for visualizing the Open SSF Scorecard Api data in a human friendly way

Dead code doesn't get patched. Detect abandoned & end-of-life dependencies that SCA tools miss — before they become the next xz-utils.

Audit your Gemfile for dependency health: maintenance activity, outdated versions, archived repos, OpenSSF scores, vulnerabilities, libyear drift, and composite health scores. Terminal, JSON, or markdown output with CI quality gates.

scir-oss is a tool that integrates public data and information regarding open source software projects and their products into a Project, Product, Protection, and Policy report (OSS-P4/R).

Scorecard action for checking when new dependencies are added to the repository.

OpenSSF Dashboard allows you to check the OpenSSF scorecards for entire organisations and users on GitHub or Gitlab.

Azure Pipelines Task for OpenSSF Scorecard

⚙️ Reusable GitHub repository governance kit: CI/CD workflows, CodeQL SAST, Dependabot auto-merge, AI-assisted issue generation via Llama, structured issue templates, and a browser-based PR uploader for deploying governance files to any target repo

🔐 Repositories security and analysis.

FastMCP server that provides comprehensive security analysis for software packages across multiple ecosystems. It integrates seamlessly with Claude Desktop to provide AI-powered security evaluation capabilities.

Project to generate statistics about OpenSSF Compliance in the BEAM ecosystem.

An exporter for storing OpenSSF Scorecard data as Prometheus metrics.