# grafeas/grafeas

Artifact Metadata API

Repository: https://github.com/grafeas/grafeas
Canonical: https://ross.abutalabs.com/products/grafeas
Homepage: http://grafeas.io
Language: Go
License: Apache-2.0
License Family: permissive
Last push: 2026-07-25T03:17:11+00:00

## Health v2 (maintenance only)
Score: 65/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 94, release rhythm 8, longevity 100
- inputs: {"age_days": 3319, "days_push": 39, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1572, forks 307 (observed 2026-08-28T04:05:05.521683+00:00)

## What it is
Grafeas is an open-source artifact metadata API and reference server (written in Go) that defines a uniform spec for storing, querying, and auditing metadata about software resources such as container images, VM images, JARs, and scripts. It organizes metadata into notes and occurrences to support software supply chain auditing, governance, and compliance across build, security, and deployment pipelines.

## Use cases
- track which container images are affected by a CVE
- generate a software bill of materials (SBOM) for an image
- audit software supply chain metadata across build and deploy pipelines
- store vulnerability scan results centrally for multiple teams
- query all artifacts built from a compromised builder or commit
- enforce compliance policies using CIS benchmark metadata
- aggregate metadata from different security and build tools in one place

## When to choose
- you need a central source of truth for artifact metadata across many teams and pipelines
- you want a standardized API spec (with client libraries in Go, Java, Python, Ruby) for supply chain metadata
- you need fine-grained access control over different metadata types via the notes/occurrences model
- you are building compliance, auditing, or vulnerability management tooling

## When to avoid
- you only need simple SBOM generation without a metadata server
- you want a turnkey product with UI rather than an API and reference implementation
- your metadata needs fall outside the Grafeas note/occurrence model and would require heavy extension

## Facets
- artifact type: service
- maturity: maintenance
- function: api-framework, database, search-engine, security, monitoring
- domain: security, developer-tools, apis, self-hosted
- platform: go, self-hosted, cross-platform
- tags: software-supply-chain, artifact-metadata, sbom, vulnerability-metadata, compliance, notes-and-occurrences, api-spec, devops, containers, linux, docker

## Member repositories
- grafeas/grafeas (main) score 65

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:05.521683+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:58:10.685138+00:00, confidence not recorded.
  - readme: https://github.com/grafeas/grafeas (fetched 2026-08-28T04:05:05.521683+00:00, sha 1e6b27fa3c0e)
  - homepage: http://grafeas.io (fetched 2026-08-29T11:27:59.687354+00:00, sha 79e3af3d5097)
- Data as of 2026-08-30T08:39:29.467469+00:00.