Will the code you depend on keep getting commits and releases?

For each repository we cover, Anteproof publishes two dated probabilities: will it reach its commit target, and will it publish a release. The commit target is the repository's commit total in the 90 days before the question was issued. The forecast covers the 90 days from that issue date. Both questions resolve from the GitHub REST API.

An npm, PyPI or crates.io name, or a GitHub owner/repo. No account needed.

Maintenance forecasts are new. Their past scores are withheld, because their outcomes were counted from a third-party archive of GitHub events we have stopped trusting. Only some repositories are covered, so a package may have no forecast. A probability is not advice.

Try one

  • Try to see the two probabilities for expressjs/express, each with the date it resolves.
  • Try to see the same two questions for psf/requests.
  • Try to see what a package with no open forecast looks like.

What the question means

Missing the commit target does not mean a project is abandoned. Commit activity alone does not tell you whether a package meets your needs. We publish the probability.

Receipt

Each forecast goes into an append-only log. The head of the log is anchored daily to a public repository, github.com/anteproof/log.

How it is scored

Scores use the Brier score. Lower is better, and always saying 50% scores 0.25. Live forecasts and point-in-time pastcasts are scored separately. With fewer than 30 resolved rows, the number is shown but says little. Until a family has resolved rows of its own, treat its probabilities as unscored. The calibration page has the details.

For developers

curl "https://api.anteproof.com/v1/risk?q=express"

Coding agents get the same answer as an MCP tool. Calls without a key are for trying it out. You can get a free key on your account page. The developer docs have the setup and the quotas.

Check a whole dependency list

Upload a CycloneDX or SPDX file on your account page. Dependencies we cover are matched, and you can keep some of them on a watchlist.

What we do not claim

We never describe a package as safe.