The full upstream README, mirrored here for reference. Install config, tool schemas, adoption signals, and an original overview live on the Sighttrue listing page.
sighttrue.com · your stack · compare · method · feed
Fails the build when a dependency's own publisher has withdrawn it — npm calls
it deprecated, PyPI and crates.io call it yanked, RubyGems yanked, Packagist
abandoned, NuGet deprecated — or when its repository has been archived or moved
to a source-available licence, and reports advisories either way. Reads
package.json, requirements.txt, pyproject.toml, Cargo.toml,
composer.json and Gemfile. No key, no
account, no service to sign up to — it reads published measurements and talks
to OSV. A network problem is never a finding: if the readings cannot be fetched
the step says so and passes, because a build that breaks when somebody else's
site is down is a build that gets deleted.
On a pull request it also leaves a comment with the findings as a table, and
rewrites that same comment on every push rather than adding another. A red
build tells a reviewer that something is wrong; it does not tell them which
dependency, or what changed about it, without opening the log. Set
comment: false to report only in the step summary. A pull request from a fork
gets a read-only token, so the comment is skipped there and the step still
passes.
Also runs against requirements.txt and Cargo.toml.
The Action needs a workflow file in every repository that wants it. The GitHub App needs one install and then watches every repository it is given, with no workflow, no key and no configuration: when a pull request adds a runtime dependency that is on the watchlist, it leaves one comment with what is on record — downloads, OpenSSF scorecard, advisory count, licence, last push — and edits that same comment on every later push.
It says nothing at all when a pull request changes no manifest, adds no dependency, or adds nothing that is tracked. That is the common case and it is the point: a bot that comments to say it found nothing gets uninstalled. It never calls a package safe, unsafe or recommended, because none of those are things this project measures.
The Action fails a build; the App only reports. Both read the same published bundle, so they cannot disagree.
/stack exports the readout as a CycloneDX 1.6 document, with each dependency's advisory count, scorecard, licence, publish date and bus factor attached as properties. Built in the browser from the pasted manifest, like everything else on that page — nothing is uploaded, and there is no endpoint to send a manifest to.
It states no versions. A manifest declares ^1.6.0; it does not say what was
installed, and it says nothing about the transitive tree underneath. The
document says both of those things in its own metadata rather than leaving a
reader to notice, because an SBOM that guessed would be worse than none: a
compliance artefact asserting something nobody resolved.
The watchlist is curated and partial, and it was chosen by hand with no method beyond judgement — its weakest point. Open an issue to argue for a repository. Every change to the list is a reviewed commit, so that issue is where the review happens.
An MCP server over the same readings, so an agent can answer "is this dependency healthy" from a measurement taken today rather than from training data a year old.
Nine tools free, twenty-two paid. `check_before_install` is the one to reach for while writing code:given a package it returns only what a reviewer would be annoyed to discover afterwards — a publisher that withdrew it, scripts it runs on the installing machine, an archived repository, advisories, a source-available licence, a long silence — each with the address of the body that published it. It does not say whether to install. It says what is on record so the decision is made knowing it, and an empty result says plainly that it means nothing was found rather than that the package is safe.
Then check_package, check_stack, search_repositories, compare_repositories, find_model, check_eol, check_provider, list_readings. Read-only, no key, no account. Every result carries the
limits of what it can support, because an agent will paste these figures into a
code review and a scorecard quoted without "measures declared practices, not
whether the project is safe" is a claim this project does not make.
Without MCP, one GET returns the same thing:
Advisories, licence, when the registry last shipped it, the bus factor, and whether the release is still supported — each with the address of the body that published it, so a figure quoted into a review can be checked in one click. Despite the name there is no verdict in it: no score, no rank, no recommendation. Those would be this project's judgement of somebody else's work wearing the costume of a measurement.
One agent watches 417 open-source repositories and takeseleven readings, most of which never touch GitHub: 807 provider incidents kept after their own status pages dropped them, 522 release lines on the end-of-life clock, 382 model prices, 182 packages by real ship date, 416 commit histories for the bus factor. It runs every four hours on GitHub Actions, commits what it reads to this repository, and publishes a static site.
Every page and every bundle is a file. There are five dynamic routes and no page
depends on any of them: /api/ask, /api/mcp, /api/chain,
/api/github/webhook for the App, and the sign-in and watchlist endpoints under
/api/auth and /api/watchlist. Signing in with
GitHub saves a watchlist and nothing else — the readings on a signed-in page are
the same published bundle anyone can download.
The commit history of data/ is the point. It is an audit trail: every reading
is timestamped, append-only, and checkable against GitHub directly.
Eleven readings, each named by the question it answers rather than by the collector that produces it. The same list drives the site's navigation, so the two cannot drift — they had, three times over, before it was written down once.
| Reading | Question it answers | Touches GitHub |
|---|---|---|
| Live | What changed in the last few hours? | yes |
| Ships | What released a new version? | yes |
| Forks | What is being copied faster than its own baseline? | yes |
| Demand | What are developers asking for, across more than one project? | yes |
| Dependencies | What is being added, dropped, or jumped a major version? | yes |
| Lineage | Which models say they were built on which? | no |
| Model prices | What does a million tokens cost, and when did that change? | no |
| Outages | Does the thing I depend on go down, and how often? | no |
| Ecosystem | What do the registries, advisories and forums say? | no |
| Depended on | What does everything else quietly rely on? | no |
| This week | What would I have missed looking once a week? | — |
The six that never touch GitHub are the answer to the fair complaint that a GitHub summariser is worth only what GitHub already shows you.
Whether each detector's threshold is reachable at all is published too, on the index under Our record. A detector nothing has ever come close to is not a quiet detector, it is a misconfigured one, and the site says so about itself.
Every comparison is against a repository's own history, not against other repositories. "27× baseline" means 27 times what that project normally does, and the baseline is drawn on the chart so you can see what normal means.
Confidence is stated, never implied.
| State | Meaning |
|---|---|
forming | Under 14 days of history. Raw counts only. No multiplier is computed and none is implied. |
detected | Crossed the threshold once. Neutral treatment. |
confirmed | Persisted across two consecutive daily snapshots. |
Only confirmed signals are treated as findings. That costs up to a day of
speed and buys the thing that cannot be bought back.
Generated prose is set in a different typeface from measured values. Where a sentence explains a number, every figure in that sentence is checked against the source record before it is published; if any of them is not in the record, the sentence is discarded and a templated one is used instead.
Published findings that turn out to be wrong are superseded by a correction event carrying the same prominence. Events are never deleted and history is never rewritten.
Every bundle the site reads is served as JSON, so any claim can be checked against the same file the page used.
Files are sorted with a fixed key order so a repository that did not change produces no diff. That is what keeps a repository committed to six times a day from growing without bound.
Node 24. Types are stripped natively, so there is no build step and no runtime dependencies.
It said 22.18+ until the D1 schema arrived. The tests load migrations/ into
node:sqlite, which is stable in 24 and behind a flag in 22 — so on 22 the
suite fails on an import rather than on an assertion, which is a confusing way
to learn a version requirement.
The watchlist is curated. Deriving it from a search query was tried and produced
a worse list — topic search only finds repositories that tagged themselves, and
sorting by stars ranks tutorials and link collections above infrastructure.
derive-watchlist.ts is kept for proposing candidates a curator might have
missed, and because the negative result is worth being able to reproduce.
derive-packages.ts fills the packages field, which is what lets the agent
ask what a project's downloads are doing rather than only what its repository is
doing. It never maps on a name match: a candidate is proposed, the registry's own
record for that name is fetched, and the mapping is kept only when the registry
points back at this repository. That rule is not decoration — the first version
matched on substring and mapped angular/angular to the npm package angular,
which belongs to the archived angular/angular.js, and would have credited a
dead project's downloads to a live one.
Nothing is ever removed. Retired entries stay on the list with active: false,
because deleting one would erase the record that it was watched at all, and the
findings collected while it was still link to it.
Two scheduled workflows do the rest. pulse.yml runs every four hours for
repository base and releases; daily.yml writes the canonical snapshot,
classifies spikes, and collects issues and manifests. Both commit every run,
including when nothing changed — scheduled workflows are disabled after 60 days
of repository inactivity, and that commit is what prevents it.
| Secret | Purpose |
|---|---|
SIGNAL_GITHUB_PAT | Fine-grained token, public repository read only. Secret names cannot begin with GITHUB_. |
CLOUDFLARE_API_TOKEN | Cloudflare Pages: Edit |
CLOUDFLARE_ACCOUNT_ID | |
GROQ_API_KEY | Optional. Without it every reading still publishes, with numbers and no prose. |
Both optional groups are genuinely optional: unset, their steps skip and say so. Nothing is marked as a failed run, because choosing not to configure something is not a fault, and a warning that is always on is a warning nobody reads.
MIT. See LICENSE.
Cloudflare Pages, GitHub Actions on a public repository, and Groq's free tier. Static assets and bandwidth on Pages are unlimited, so visitor traffic has no ceiling. Every remaining limit applies to the build side, which is bounded and predictable.