Endor Labs Package Score
Evaluate open source package health before adoption.
Input Parsing
Extract from user input:
- Package name (required)
- Version (optional)
- Compare with (optional) - another package for comparison
Workflow
Step 1: Check Vulnerabilities and Risks
Use check_dependency_for_risks MCP tool (preferred — checks vulnerabilities AND malware):
ecosystem: npm, python, go, java, maven, rust, dotnet, ruby, phpdependency_name: package nameversion: version to evaluate
Fallback to check_dependency_for_vulnerabilities if _risks unavailable.
Step 2: Get Package Metrics
Use CLI to query from OSS namespace:
# Package version info (always redirect stderr when piping)
npx -y endorctl api list --resource PackageVersion -n oss --filter "meta.name=={ecosystem}://{package}@{version}" 2>/dev/null
# Scorecard (use package UUID from above)
npx -y endorctl api list --resource Metric -n oss --filter "meta.name==package_version_scorecard and meta.parent_uuid=={package_uuid}" 2>/dev/null
Or use get_resource MCP tool:
name: {ecosystem}://{package}@{version}, resource_type: PackageVersion- Then
resource_type: Metric, name: package_version_scorecard (with package UUID as parent)
Step 3: Present Scores
Present overall score (X/10) with breakdown by category:
| Category |
What it measures |
| Activity |
Commit frequency, last release, contributors, issue response time |
| Popularity |
Downloads, stars, dependents |
| Security |
CVE count, security practices, OSSF scorecard, signed releases, security policy |
| Quality |
Test coverage, documentation, type support, license |
Include vulnerability history table (CVE, severity, fixed version, date).
Recommendation thresholds:
= 8: Recommended for production
- 6-7: Acceptable, monitor
- 4-5: Use with caution, consider alternatives
- < 4: Not recommended
Step 4: Version Comparison (if requested)
Compare CVEs, score, release date across versions.
Step 5: Package Comparison (if requested)
Side-by-side table: overall score, activity, popularity, security, quality, CVE count, license. State recommendation with reasoning.
Next Steps
/endor-check {package} - check vulnerabilities/endor-upgrade-impact {package} - upgrade analysis/endor-scan - see impact on your project
For data source policy, read references/data-sources.md.
Error Handling
| Error |
Action |
| Package not found |
Check name/ecosystem. OSS namespace may not have indexed it. Do not use external sites |
| Metrics unavailable |
Package may be too new or small for scoring |
| Auth error |
Run /endor-setup |
1---2name: endor-score3description: Evaluate open source package health before adoption. Use when the user says "should I use this package", "is lodash well-maintained", "endor score express", "package health", "compare lodash vs underscore", "evaluate this dependency", or wants activity, popularity, security, and quality scores. Do NOT use for checking known CVEs in a package (/endor-check) or scanning the whole repo (/endor-scan).4---56# Endor Labs Package Score78Evaluate open source package health before adoption.910## Input Parsing1112Extract from user input:131. **Package name** (required)142. **Version** (optional)153. **Compare with** (optional) - another package for comparison1617## Workflow1819### Step 1: Check Vulnerabilities and Risks2021Use `check_dependency_for_risks` MCP tool (preferred — checks vulnerabilities AND malware):22- `ecosystem`: npm, python, go, java, maven, rust, dotnet, ruby, php23- `dependency_name`: package name24- `version`: version to evaluate2526Fallback to `check_dependency_for_vulnerabilities` if `_risks` unavailable.2728### Step 2: Get Package Metrics2930Use CLI to query from OSS namespace:31```bash32# Package version info (always redirect stderr when piping)33npx -y endorctl api list --resource PackageVersion -n oss --filter "meta.name=={ecosystem}://{package}@{version}" 2>/dev/null3435# Scorecard (use package UUID from above)36npx -y endorctl api list --resource Metric -n oss --filter "meta.name==package_version_scorecard and meta.parent_uuid=={package_uuid}" 2>/dev/null37```3839Or use `get_resource` MCP tool:40- `name`: `{ecosystem}://{package}@{version}`, `resource_type`: `PackageVersion`41- Then `resource_type`: `Metric`, `name`: `package_version_scorecard` (with package UUID as parent)4243### Step 3: Present Scores4445Present overall score (X/10) with breakdown by category:4647| Category | What it measures |48|----------|-----------------|49| Activity | Commit frequency, last release, contributors, issue response time |50| Popularity | Downloads, stars, dependents |51| Security | CVE count, security practices, OSSF scorecard, signed releases, security policy |52| Quality | Test coverage, documentation, type support, license |5354Include vulnerability history table (CVE, severity, fixed version, date).5556**Recommendation thresholds:**57- >= 8: Recommended for production58- 6-7: Acceptable, monitor59- 4-5: Use with caution, consider alternatives60- < 4: Not recommended6162### Step 4: Version Comparison (if requested)6364Compare CVEs, score, release date across versions.6566### Step 5: Package Comparison (if requested)6768Side-by-side table: overall score, activity, popularity, security, quality, CVE count, license. State recommendation with reasoning.6970## Next Steps71721. `/endor-check {package}` - check vulnerabilities732. `/endor-upgrade-impact {package}` - upgrade analysis743. `/endor-scan` - see impact on your project7576For data source policy, read references/data-sources.md.7778## Error Handling7980| Error | Action |81|-------|--------|82| Package not found | Check name/ecosystem. OSS namespace may not have indexed it. Do not use external sites |83| Metrics unavailable | Package may be too new or small for scoring |84| Auth error | Run `/endor-setup` |
endorlabs