Paste a URL. Get an instant health report covering security vulnerabilities, dependency freshness, maintenance signals, code quality, and license risk. Results in under 10 seconds. No setup. No account required.
Here is what a RepoLens health report looks like
TypeScript · 2.3k stars · 156 forks
Overall Health
Every week you evaluate open source libraries, inherit codebases, or review vendor software. You check the GitHub stars. Maybe you glance at the last commit date. Then you add it and hope for the best.
The average npm package has 79 transitive dependencies. You audited the one you installed. Nobody checked the 78 underneath it.
43% of open source projects with over 1,000 stars have not had a commit in over 6 months. Stars don't expire. Maintenance does.
GPL and AGPL licenses in your dependency tree are expensive surprises at Series B.
RepoLens closes the gap. One URL. One report. Under 10 seconds.
RepoLens calls the GitHub API, OSV vulnerability database, and package registries simultaneously.
CVEs in direct and transitive dependencies, secret scanning alerts, security policy presence, and Dependabot configuration.
Outdated packages by major/minor/patch version gap, deprecated packages, unpinned wildcards across npm, PyPI, Cargo, and more.
Last commit recency, 90-day commit frequency, open/closed issue ratio, PR merge time, release cadence, contributor diversity.
CI/CD pipeline presence and last run status, code scanning configuration, test directory detection, linter configuration.
README length and quality, code examples, CHANGELOG, CONTRIBUTING guide, and API documentation directory.
License detection, SPDX classification, risk tier assessment, and commercial use compatibility check.
“I evaluated 12 npm packages in the time it used to take me to manually check one. RepoLens showed me three of them had Critical CVEs I would have shipped without knowing.”
Sarah Chen
Senior Frontend Engineer
Fintech startup, 45-person eng team
“I run quarterly dependency reviews across our 23 internal repos. Before RepoLens, this took two days of manual work. Now it takes 20 minutes and I have charts showing the trend.”
Daniel Okafor
VP of Engineering
B2B SaaS company, Series B
“I maintain four open source libraries. The Slack alerts are the killer feature for me. I found out about a CVE in a transitive dependency within hours of publication.”
Marta Kowalski
Staff Engineer and OSS Maintainer
Independent
You're 20 minutes into researching a new library. Before you add it to package.json, paste the URL into RepoLens. In 10 seconds: CVEs? Maintained? License compatible? Full picture before you commit.
Your manager asked for a dependency health audit. In the old world: a week of manual work. With RepoLens: add repos to watchlist, run scans, export data, present trend charts. Done in an afternoon.
Before committing to a multi-year maintenance obligation, RepoLens shows you current health, maintenance velocity, contributor diversity, and dependency landmines.
Your company just acquired a startup. Technical due diligence requires a dependency and security audit. RepoLens gives you a quantified health score and prioritized findings in minutes.
All the data you need to make smarter dependency decisions.
Everything you need to evaluate any public repository.
Everything in Free, plus powerful monitoring.
No credit card required. Cancel anytime.
Yes, with a paid subscription. Connect your GitHub account with repository access permissions, and you can scan any private repo you have access to. Your private repo data is never shared or cached publicly.
RepoLens pulls vulnerability data directly from the Open Source Vulnerabilities (OSV) database, the same source used by GitHub's own Dependabot. OSV covers 22+ ecosystems and is maintained by Google. No proprietary heuristics - only published, verified CVEs.
npm (Node.js), PyPI (Python), Maven (Java/Kotlin), Cargo (Rust), Go modules, RubyGems, and NuGet. For multi-language repos, we audit all detected ecosystems in a single scan.
Not for you. RepoLens uses its own GitHub App credentials when scanning public repositories. Private repo scans use your delegated OAuth token, but each scan uses fewer than 20 API calls - negligible against GitHub's 15,000 req/hour limit.
Under 10 seconds for the vast majority of repositories. Repos with unusually large dependency trees (200+ direct dependencies) may take 15-20 seconds. We run all API calls in parallel to keep scan time minimal.
Yes. The complete scoring algorithm - including weights, data sources, and the calculation for each signal - is fully documented. We want our scores to be auditable and explainable, not a black box.
Your private repo reports are deleted within 30 days of cancellation. Public repo scan history is retained for 90 days. You can request immediate deletion at any time by emailing privacy@repolens.io.
Stop relying on star counts and gut instinct. Get a scored, shareable, actionable health report in 10 seconds. Free for public repos, always.
No account required. Results in under 10 seconds.