Choose open-source building blocks with the risks in plain sight

How we compute signals

Signals are simple rules over public listing data, so you can see why a result got its label. They are a starting point for choosing what to look at more closely, not a verdict. Discovery only, not legal advice.

The evaluation guide on each result only restates these signals and the license in plain words. It uses fixed rules, with no AI and no extra data. Security is “not assessed” unless a partial Scorecard result exists, an unknown license is never treated as permissive, and the alternatives are picked by shared category, tags and language, not by quality.

You can choose a skill level (Beginner, Intermediate or Experienced) on your account page. It only changes how much explanation Ossy and the pages give you: Beginner adds plain-language explanations and a suggested next step, Experienced keeps everything terse and dense. The data, the rules and your plan limits stay the same. You can also choose the language Ossy answers in (or leave it on automatic to follow your question); the catalog data, license names and these guides stay in English. Ossy always answers in the same four parts: recommendation, why, trade-offs and watch-outs, next step, and says “not assessed” where the catalog has no data.

• Maintenance. Measured from the most recent push or commit. Active within 6 months, slowing within 18, stale within 36, inactive beyond that. Archived projects are always inactive, and no date means “not enough data”. The “active in 12 months” filter and the “drop stale” filter (18 months) never include archived projects. A large issue backlog (100+ open issues and more than a quarter as many open issues as stars) is flagged but does not change the level.
• Maturity. Established: a top-level Apache or graduated CNCF project, or at least 3 years old with 1,000+ stars, 200+ likes or 100,000+ downloads. Growing: an Apache podling or incubating or sandbox CNCF project, or at least 1 year old with 100+ stars, 20+ likes or 10,000+ downloads. Anything else with data is early-stage.
• Adoption. High at 5,000+ stars, moderate at 500+ (for models and datasets without stars: 500+ and 50+ likes). Each metric is listed with its source, and tiers compare projects on the same platform only.
• License risk. For commercial or proprietary use. High for network copyleft, source-available, use-restricted, proprietary or non-commercial licenses. Review for copyleft, not OSI-approved, an open-core or commercial-license note in the README, or a license that needs a closer look. Low for the rest. A missing, custom or unrecognized license is unknown and is never treated as permissive. Discovery only, not legal advice.
• Releases, contributors, security and trend. When the catalog holds the data, these are shown as extra signals; otherwise they stay “not assessed”. Release cadence: 4+ releases in the last 12 months is regular, 1 to 3 is occasional, none is “no release in 12 months”. Contributor concentration: one contributor, or one holding 80%+ of commits, is single-person dependent; 50%+ or 3 or fewer contributors is concentrated. Security shows an OpenSSF Scorecard score as “assessed”, with 7+ read as higher, 4+ as middle and the rest as lower: a partial automated check, not a verdict. Open advisories (count) appear only where we hold that count; no count means “not assessed”, never zero. Trend compares stars over up to 12 weekly snapshots and needs at least 2.
• Not assessed. security, releases, contributors, trend unless a result shows the extra signal above. Nothing here means a project is safe, secure or clean.

Data sources and licences

• Repository statistics: GitHub (courtesy label; no attribution required by the ToS/AUP).
• Scorecard data: OpenSSF Scorecard (https://scorecard.dev), Data provided by the Scorecard REST API is licensed under the CDLA Permissive 2.0. The score is a partial, weekly-scan score: it omits the CI-Tests, Contributors and Dependency-Update-Tool checks.
• Vulnerability data: OSV.dev (https://osv.dev), aggregating the GitHub Advisory Database, PyPI Advisory Database, Go Vulnerability Database, OSS-Fuzz (all CC-BY 4.0), RustSec and the Global Security Database (CC0 1.0), Haskell (CC0 1.0), Drupal (MIT) and erlef/EEF (CC-BY 4.0); malicious-package reports from ossf/malicious-packages (Apache 2.0). Each record remains under its original source licence. This catalog stores only derived counts and a maximum severity bucket, not advisory text.
• Package metadata from the Nimble package list (nim-lang/packages), CC BY 4.0, https://github.com/nim-lang/packages

Community Data License Agreement – Permissive – Version 2.0
(source: https://cdla.dev/permissive-2-0/ , last updated 2021-06-17; reproduced verbatim)

This is the Community Data License Agreement – Permissive, Version 2.0 (the “agreement”). Data Provider(s) and Data Recipient(s) agree as follows:

1. Provision of the Data

1.1. A Data Recipient may use, modify, and share the Data made available by Data Provider(s) under this agreement if that Data Recipient follows the terms of this agreement.

1.2. This agreement does not impose any restriction on a Data Recipient’s use, modification, or sharing of any portions of the Data that are in the public domain or that may be used, modified, or shared under any other legal exception or limitation.

2. Conditions for Sharing Data

2.1. A Data Recipient may share Data, with or without modifications, so long as the Data Recipient makes available the text of this agreement with the shared Data.

3. No Restrictions on Results

3.1. This agreement does not impose any restriction or obligations with respect to the use, modification, or sharing of Results.

4. No Warranty; Limitation of Liability

4.1. All Data Recipients receive the Data subject to the following terms:

THE DATA IS PROVIDED ON AN “AS IS” BASIS, WITHOUT REPRESENTATIONS, WARRANTIES OR CONDITIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED INCLUDING, WITHOUT LIMITATION, ANY WARRANTIES OR CONDITIONS OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

NO DATA PROVIDER SHALL HAVE ANY LIABILITY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING WITHOUT LIMITATION LOST PROFITS), HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE DATA OR RESULTS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

5. Definitions

5.1. “Data” means the material received by a Data Recipient under this agreement.

5.2. “Data Provider” means any person who is the source of Data provided under this agreement and in reliance on a Data Recipient’s agreement to its terms.

5.3. “Data Recipient” means any person who receives Data directly or indirectly from a Data Provider and agrees to the terms of this agreement.

5.4. “Results” means any outcome obtained by computational analysis of Data, including for example machine learning models and models’ insights.

Saved lists, notes and alerts

• Saved lists. Save a shortlist to your account under a name. Each project is saved with a snapshot of its signals on the day you added it, so you can see what you decided on. Free accounts keep a small number of lists, Premium keeps more (limits are provisional and shown in the app).
• Install and links. For a saved project we show the package name and registry link we already have, a standard install command for that registry when the package name is a plain one, and the README or homepage link. We do not write code for you. Read the project's own documentation before you run anything.
• Export. Premium accounts can export a list with a license checklist and compliance notes. Discovery only, not legal advice.
• Project note. Optional, up to 400 characters, and kept in your browser by default. On Premium you can keep it on your account so it follows you to other devices; switching that off deletes the saved copy. You can view, edit and delete it on your account page, under "About my project".
• Email alerts (not switched on yet). When alerts launch they will be optional and per account: a note when a project in your own saved lists turns inactive, is archived or changes license, in a digest sent only to your verified address, with a one-click unsubscribe.

Reading your results

• The license is shown on each result. Unknown means unknown: it is never treated as permissive. Open the source link and check before you rely on it. License notes are discovery only, not legal advice.
• Signals are computed from public listing data and are a starting point. Security is not assessed here, so nothing is labelled safe or clean: review security and releases yourself before you depend on a project.
• Results come from public listings and are refreshed regularly. Details can lag the original project.
• Ossy recommends one option with its trade-offs and says what the catalog does not cover. It is a helper for deciding, not an authority, and it can tailor advice to an optional project note. The note stays in your browser unless you are on Premium and choose to keep it on your account. Ossy treats it as background, never as instructions.