# ossf/criticality_score

Gives criticality score for an open source project

Repository: https://github.com/ossf/criticality_score
Canonical: https://ross.abutalabs.com/products/criticality_score
Language: Go
License: Apache-2.0
License Family: permissive
Last push: 2026-08-26T05:04:55+00:00

## Health v2 (maintenance only)
Score: 67/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 8, longevity 100
- inputs: {"age_days": 2115, "days_push": 7, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1452, forks 142 (observed 2026-08-28T04:04:46.509520+00:00)

## What it is
A Go CLI tool from the OpenSSF that computes a criticality score (0 to 1) for open source projects based on parameters like contributor count, commit frequency, and dependents. It helps identify the critical open source projects the community depends on so their security posture can be proactively improved.

## Use cases
- score how critical an open source project is
- find the open source projects my dependencies rely on most
- prioritize security audits for widely-used open source projects
- generate a ranked list of critical open source projects
- assess supply chain risk of open source dependencies
- measure influence and importance of a GitHub repository

## When to choose
- you need a standardized, data-driven measure of an open source project's importance
- you're doing dependency risk analysis or supply chain security prioritization
- you want to identify which OSS projects deserve security investment

## When to avoid
- you need a full security audit or vulnerability scan rather than an importance score
- you want code quality or license compliance analysis
- the project isn't hosted on a supported platform like GitHub

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, analytics, developer-tools
- domain: security, developer-tools
- platform: windows, go, cli
- tags: open-source-security, criticality-score, ossf, supply-chain-security, project-analysis, open-source, linux, macos

## Member repositories
- ossf/criticality_score (main) score 67

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:46.509520+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:35:49.331741+00:00, confidence not recorded.
  - readme: https://github.com/ossf/criticality_score (fetched 2026-08-28T04:04:46.509520+00:00, sha 540d5e4405ab)
- Data as of 2026-08-30T08:39:29.467469+00:00.