{"adoption": {"forks": 307, "observed_at": "2026-08-28T04:05:05.521683+00:00", "stars": 1572}, "canonical_url": "https://ross.abutalabs.com/products/grafeas", "card": {"archived": false, "artifact_type": "service", "description": "Artifact Metadata API", "domain": ["security", "developer-tools", "apis", "self-hosted"], "enriched": true, "function": ["api-framework", "database", "search-engine", "security", "monitoring"], "health_score": 79, "homepage": "http://grafeas.io", "language": "Go", "license": "Apache-2.0", "license_family": "permissive", "maturity": "maintenance", "member_repos": ["grafeas/grafeas"], "name": "grafeas/grafeas", "platform": ["go", "self-hosted", "cross-platform"], "pushed_at": "2026-07-25T03:17:11+00:00", "repo": "grafeas/grafeas", "stars": 1572, "tags": ["software-supply-chain", "artifact-metadata", "sbom", "vulnerability-metadata", "compliance", "notes-and-occurrences", "api-spec", "devops", "containers", "linux", "docker"], "topics": [], "urls": [], "use_cases": ["track which container images are affected by a CVE", "generate a software bill of materials (SBOM) for an image", "audit software supply chain metadata across build and deploy pipelines", "store vulnerability scan results centrally for multiple teams", "query all artifacts built from a compromised builder or commit", "enforce compliance policies using CIS benchmark metadata", "aggregate metadata from different security and build tools in one place"], "what_it_is": "Grafeas is an open-source artifact metadata API and reference server (written in Go) that defines a uniform spec for storing, querying, and auditing metadata about software resources such as container images, VM images, JARs, and scripts. It organizes metadata into notes and occurrences to support software supply chain auditing, governance, and compliance across build, security, and deployment pipelines.", "when_to_avoid": ["you only need simple SBOM generation without a metadata server", "you want a turnkey product with UI rather than an API and reference implementation", "your metadata needs fall outside the Grafeas note/occurrence model and would require heavy extension"], "when_to_choose": ["you need a central source of truth for artifact metadata across many teams and pipelines", "you want a standardized API spec (with client libraries in Go, Java, Python, Ruby) for supply chain metadata", "you need fine-grained access control over different metadata types via the notes/occurrences model", "you are building compliance, auditing, or vulnerability management tooling"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/grafeas", "repo": "grafeas/grafeas", "role": "main", "score": 65}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:05:05.521683+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T03:58:10.685138+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "1e6b27fa3c0ee1b429071dbe1fdf7b111e4f9dec0d0962c49d1c8368452c522a", "fetched_at": "2026-08-28T04:05:05.521683+00:00", "kind": "readme", "missing": false, "url": "https://github.com/grafeas/grafeas"}, {"content_hash": "79e3af3d509753e4121c475bf88c0878dde9df140709bd09cfd24ca43e830e33", "fetched_at": "2026-08-29T11:27:59.687354+00:00", "kind": "homepage", "missing": false, "url": "http://grafeas.io"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 94, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3319, "days_push": 39, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 65, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}