# Endor Score

> Evaluate open source package health before adoption. Use when the user says "should I use this package", "is lodash well-maintained", "endor score express", "package health", "compare lodash vs underscore", "evaluate this dependency", or wants activity, popularity, security, and quality scores. Do NOT use for checking known CVEs in a package (/endor-check) or scanning the whole repo (/endor-scan).

- Skill: `endorlabs/endor-score` (Agent Skill)
- Install (CLI): `npx skillmds@latest add endorlabs/endor-score`
- Raw SKILL.md: https://api.skillmd.com/api/skills/endorlabs/endor-score/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: endorlabs (https://skillmd.com/u/endorlabs)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/endorlabs/endor-score

---


# Endor Labs Package Score

Evaluate open source package health before adoption.

## Input Parsing

Extract from user input:
1. **Package name** (required)
2. **Version** (optional)
3. **Compare with** (optional) - another package for comparison

## Workflow

### Step 1: Check Vulnerabilities and Risks

Use `check_dependency_for_risks` MCP tool (preferred — checks vulnerabilities AND malware):
- `ecosystem`: npm, python, go, java, maven, rust, dotnet, ruby, php
- `dependency_name`: package name
- `version`: version to evaluate

Fallback to `check_dependency_for_vulnerabilities` if `_risks` unavailable.

### Step 2: Get Package Metrics

Use CLI to query from OSS namespace:
```bash
# Package version info (always redirect stderr when piping)
npx -y endorctl api list --resource PackageVersion -n oss --filter "meta.name=={ecosystem}://{package}@{version}" 2>/dev/null

# Scorecard (use package UUID from above)
npx -y endorctl api list --resource Metric -n oss --filter "meta.name==package_version_scorecard and meta.parent_uuid=={package_uuid}" 2>/dev/null
```

Or use `get_resource` MCP tool:
- `name`: `{ecosystem}://{package}@{version}`, `resource_type`: `PackageVersion`
- Then `resource_type`: `Metric`, `name`: `package_version_scorecard` (with package UUID as parent)

### Step 3: Present Scores

Present overall score (X/10) with breakdown by category:

| Category | What it measures |
|----------|-----------------|
| Activity | Commit frequency, last release, contributors, issue response time |
| Popularity | Downloads, stars, dependents |
| Security | CVE count, security practices, OSSF scorecard, signed releases, security policy |
| Quality | Test coverage, documentation, type support, license |

Include vulnerability history table (CVE, severity, fixed version, date).

**Recommendation thresholds:**
- >= 8: Recommended for production
- 6-7: Acceptable, monitor
- 4-5: Use with caution, consider alternatives
- < 4: Not recommended

### Step 4: Version Comparison (if requested)

Compare CVEs, score, release date across versions.

### Step 5: Package Comparison (if requested)

Side-by-side table: overall score, activity, popularity, security, quality, CVE count, license. State recommendation with reasoning.

## Next Steps

1. `/endor-check {package}` - check vulnerabilities
2. `/endor-upgrade-impact {package}` - upgrade analysis
3. `/endor-scan` - see impact on your project

For data source policy, read references/data-sources.md.

## Error Handling

| Error | Action |
|-------|--------|
| Package not found | Check name/ecosystem. OSS namespace may not have indexed it. Do not use external sites |
| Metrics unavailable | Package may be too new or small for scoring |
| Auth error | Run `/endor-setup` |