GitHub Repository Analyzer - Security & Maintenance Scorer

GitHub Repository Intelligence

Analyze a GitHub repository's maintenance activity and a sample of its direct npm dependencies. Results include measured counts, heuristic scores, and explicit coverage warnings. Unavailable measurements and scores are null, never a claim of zero risk.

Plan	Output per run	Dependency sample
Free	One repository analysis	Up to 20 direct npm dependencies
Paid	One repository analysis	Up to 20 direct npm dependencies

Each run accepts one repository. The 25-row free-plan cap does not truncate this single-row result.

What It Does

1. GitHub REST API — Repository stars, last push age, open issues and license.
2. Default-branch package.json — Reads the root manifest and combines production and development dependencies. A missing manifest is reported separately from a failed request. Nested workspaces and transitive dependencies are not scanned.
3. npm Registry — Counts a dependency as outdated when a newer latest release is outside its declared semver range. A range such as ^2.0.0 is not outdated merely because it differs from 2.4.1 as text.
4. OSV — Queries each sampled dependency at its exact declared version or the minimum version of its semver range, follows batch pagination, deduplicates advisory IDs, and reads advisory details for severity.

Version scope: vulnerability_version_basis: "manifest_minimum" describes a manifest-based estimate, not the installed version or a lockfile audit. A minimum allowed version can differ from the version you deploy. Unsupported specifications (including workspace, file, git, aliases and wildcard *) are reported as unresolved. OSV counts are advisory IDs, not necessarily unique CVEs.

Coverage: The first 20 dependencies are sampled in manifest order (production first, then development). The result reports the full count, sample count and successful lookups. Scores describe this sample, not a full repository audit. OSV pagination is bounded at 10 pages and severity details at 100 advisory IDs per run. If a limit or source failure prevents a measurement, that measurement stays unknown. Unrecognized severity (including records exposing only a CVSS vector) is not treated as LOW or zero.

Scoring

The overall score starts at 100 and deducts:

• Commit age: (last_commit_days / 30) × 5, capped at 30 points.
• Outdated packages: 3 points each, capped at 30.
• Critical advisories: 15 points each; high advisories: 8 points each.
• More than 50 open issues: 10 points.

Security and maintenance scores use the same measured inputs with different weights. All scores are clamped to 0–100. A score is null when any input required for that score is unknown. A metadata-only result with no root manifest has no dependency-based scores. An empty, successfully read manifest can have measured zero dependencies.

Input

Parameter	Type	Required	Description
repoUrl	string	Yes	Full GitHub repository URL; .git, a trailing slash and query parameters are accepted
githubToken	string	No	Optional customer GitHub token sent only to GitHub requests

{
  "repoUrl": "https://github.com/apify/apify-sdk-js"
}

Output

Field	Meaning
repo_url, repo_name	Submitted URL and normalized owner/repo
stars, last_commit_days, open_issues_count, license	Repository metadata; null on an unavailable-analysis notice
outdated_packages_count	Sampled ranges excluding a newer latest release; null on incomplete npm checks
total_vulns	Unique OSV advisory IDs at the sampled manifest minimum versions; null on incomplete queries
critical_vulns, high_vulns	Counts from advisory severity; null when any sampled severity or version is unresolved
unknown_severity_count	IDs with missing or unrecognized severity; null when the query could not be completed
security_score, maintenance_score, overall_score	Heuristic 0–100 scores, or null when required inputs are unavailable
analysis_status	complete, partial, not_applicable (no root manifest), or unavailable (notice)
manifest_status, npm_status, osv_status	Source coverage, present on repository result rows
dependency_count, dependencies_sampled, dependency_sample_limited	Full direct dependency count, selected count, and whether the 20-package limit applies
packages_checked, vulnerability_packages_checked	Successful npm and completed OSV package queries
vulnerability_version_basis	manifest_minimum; no installed-version claim
warnings	Array explaining missing data, unresolved versions or sample limits
notice, error	Present on an unavailable-analysis status row
disclaimer, timestamp	Usage disclaimer and ISO timestamp

Repository metadata is retained when a dependency source fails. A partial result remains a repository analysis; inspect its warnings before using its scores.

Pricing and Errors

• $0.05 per delivered repository analysis, using the existing repo-analyzed event. Partial and metadata-only repository results are included.
• If the repository itself cannot be analyzed or the input is invalid, the Actor returns an analysis-unavailable notice with null measurements and no analysis event. A notice is not a repository result.
• Free-plan and paid-plan runs use the same one-repository input and sample. Platform credits and actual charges are determined by Apify; local tests do not prove a billable platform event.
• Storage or billing failures surface as execution failures instead of appending a second, contradictory result row.

Local Reproduction

Run these commands from this Actor directory:

npm install --ignore-scripts --no-audit --no-fund
npm test
npm run check

For a real API run, create $AGENT_TMPDIR/github-repo-prefill/key_value_stores/default/INPUT.json containing the example input, then run:

$env -u APIFY_IS_AT_HOME -u APIFY_TOKEN APIFY_USER_IS_PAYING=1 CRAWLEE_STORAGE_DIR="$AGENT_TMPDIR/github-repo-prefill" npm start

Read the result in $AGENT_TMPDIR/github-repo-prefill/datasets/default/. Use a separate storage directory and APIFY_USER_IS_PAYING=0 to exercise the free-plan path. An empty input object returns a notice. Never assert fixed advisory counts for a live repository: manifests, releases and advisories change.

Limitations and Responsibility

This Actor aggregates publicly available GitHub, npm and OSV data. It is not affiliated with or endorsed by those services. Results are informational, not professional security advice or a guarantee of safety. Customers are responsible for their input permissions and lawful use of the results. Data is stored in the run's Apify dataset. Review the coverage fields and perform an installed-dependency audit before production decisions.

See Also

• OSV Database — Open Source Vulnerabilities
• GitHub REST API — Repository metadata
• npm Registry — Package information
• Apify Platform — Serverless Actor ecosystem

---

Built by NtriqPRO | Version 1.0 | MIT License

---

🔗 Related Actors by ntriqpro

Build your data pipeline with the ntriqpro Actor suite:

• maigret-actor — Maigret OSINT — Username search across 3000+ sites
• website-tech-detector — Website Tech Stack Scanner
• code-review-intelligence-mcp — AI Code Reviewer for PR diffs

⭐ Love it? Leave a Review

Your rating helps professionals discover this actor. Rate it here.