TrustOSS
TrustOSS is a free web-based tool that evaluates the health and trustworthiness of open-source GitHub repositories. It calculates a comprehensive 0–100 health score based on five weighted dimensions: activity, maintenance, community, documentation, and maturity. The score is visualized with a letter grade and a breakdown across each dimension, providing immediate insight into a project's overall well-being. Beyond surface metrics, TrustOSS offers a deep scan that checks for known vulnerabilities from the OSV database, real adoption through dependent package data from deps.dev, bus factor from commit concentration, CI pass rate, PR merge rate, and detection of documentation-only changes. It also features a fake-star audit that plots star growth curves and classifies recent stargazers to identify suspicious activity, drawing on academic research into purchased GitHub stars. The platform enables side-by-side comparison of up to four candidate libraries, displaying a radar chart and a score table to highlight the strongest choice. It also generates embeddable SVG badges for README files and offers a CLI tool (trustoss-cli) for terminal-based analysis. A sign-in with GitHub unlocks a maintainer dashboard for tracking your own repositories. TrustOSS aims to help developers, data scientists, and engineers make informed decisions before adding a dependency, reducing the risk of supply-chain attacks, unmaintained code, and inflated popularity metrics.
- Category
- AI Github
- Pricing
- Free
Problem solved
Evaluating the reliability and security of open-source dependencies before adoption, by assessing repository health, vulnerability risks, and the authenticity of popularity signals.
Use cases
- Screening Python libraries for production use
- Auditing star growth to detect artificially inflated popularity
- Comparing multiple React component libraries before integration
- Checking bus factor and maintenance history for critical dependencies
- Validating the security posture of a repository via vulnerability deep scan
- Monitoring your own open-source projects through the maintainer dashboard
Audience
- Developers
- Data Scientists
- ML Engineers
- Product Managers
- Researchers
Pros
- Free and no account required for core analysis
- Comprehensive health score with multi-dimensional breakdown
- Fake-star detection using research-backed heuristics
- Side-by-side library comparison with radar charts
- Embeddable README badge for continuous visibility
Cons
- Limited to public GitHub repositories only
- Sign-in required for maintainer dashboard features
- No on-premises deployment option
- Star audit may produce false positives for legitimate spikes
- Does not analyze private repositories or non-GitHub source forges
Official website: https://trustoss.org/
Canonical LambdaBase page: https://www.lambdabase.com/tools/trustoss