Due diligence for every GitHub repo. Know before you clone. by Handbuilt
RepoSignal is a Chrome extension that answers one question before you add a dependency: should you trust this repository? Open any GitHub repo and a score badge appears next to the title; the side panel breaks it down; a printed-style research report shows every number and the evidence behind it.
No AI. No black box. No servers. Every score is computed locally from public GitHub API data and is reproducible from the same inputs.
Six signals, weighted into a 0–100 score:
| Signal | Weight | Measured from |
|---|---|---|
| Maintenance | 25% | Days since last commit, release, and push (linear decay to 365 d) |
| Security | 20% | Published advisories, security policy, archived status |
| Contributor risk | 18% | Commit concentration of the top contributor (bus factor) |
| Community | 15% | Stars and forks, scaled — adoption breadth, not popularity |
| Release hygiene | 12% | Release cadence over 12 months, semver tagging |
| Docs | 10% | License, description, wiki |
The score maps to a verdict:
| Score | Verdict |
|---|---|
| 85–100 | Strong candidate |
| 70–84 | Adopt with confidence |
| 55–69 | Adopt with caution |
| 40–54 | Investigate |
| 0–39 | Avoid unless necessary |
Disagree with the model? Change it. Weights are tunable in Settings — profiles normalize to 100%, export/import as JSON to share with your team, and the report's ledger always shows the weights actually used. Opt-in deal-breakers (archived / no license / published advisory) override any score with a flat Do not adopt. Every ledger row expands to the raw inputs behind its number — the report shows its work.
The model is a public contract: npm test locks the band edges, weight normalization,
and risk wording with a zero-dependency test suite.
- Compare — shelve up to three repos from the panel and read them side by side on one verdict ruler, signal by signal, before you pick a dependency
- Drift — RepoSignal remembers each repo's past scores locally and shows the change
since you last looked (
since Jun 4: 83 → 76 ▼) — a quiet warning when a project starts slipping - Omnibox — type
rs+ Space in the address bar, thenowner/repo, to score any repository without leaving the keyboard - Markdown export & print — copy any report (or comparison) as Markdown for an issue or ADR, or print it with the evidence expanded
- All requests go directly from your browser to
api.github.com— five calls per analysis (repo info, contributors, releases, advisories, latest commit), nothing else - No analytics, no telemetry, no remote code; fonts and scripts ship inside the package
- Results cached locally (
chrome.storage.local) for 30 minutes; score history never leaves the browser - Optional GitHub token (raises the API limit from 60 to 5,000 req/hr) is stored locally and sent only to GitHub
- Permissions:
storage,sidePanel, and the two GitHub hosts — nothing more
See PRIVACY.md. Don't take the README's word for any of this — the source you're looking at is the extension.
From the Chrome Web Store: RepoSignal — Chrome Web Store
From source (developer mode):
- Clone this repo
chrome://extensions→ enable Developer mode → Load unpacked → select the repo folder- Open any GitHub repository — the badge appears next to the repo title; the toolbar icon opens the side panel
Plain Manifest V3 — no framework, no bundler, no build step; extension pages are ES modules.
src/lib/score.js— the scoring engine, verdict bands, and history (single source of truth)src/assets/theme.css— design tokens (see DESIGN.md for the system)npm test— the scoring model's contract (node:test, zero dependencies)npm run previews— regenerates mocked previews from the real markup for headless visual QAnpm run build— packs the store zip intodist/