Repo Health Check

Evaluate a public GitHub repo's health: activity analysis, dependency audit with CVE scanning, license compatibility check, and secret scan. Answers 'is this repo safe to depend on?'

4 steps repo-health-check

What it runs

GitHub Repo Analysis
Source: GitHub REST API (repository analysis and metrics)
Dependency Audit
Source: Algorithmic (dependency tree analysis, no external data)
Licence Compatibility Check
Source: SPDX License List
Secret Scan
Source: Algorithmic (regex pattern matching for secrets/credentials)

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`repo`	string	Yes	GitHub repo (owner/name format, e.g. 'facebook/react')
`use_case`	one of commercial, open-source, saas, internal	No	How you'll use this dependency (for license check)

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/repo-health-check/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "repo": "expressjs/express",
      "use_case": "commercial"
    },
    "max_price_cents": 22
  }'

The bundle’s published example input.

Limitations

Analyses public repository metadata — code quality metrics, test coverage, and internal documentation are not assessed
From step: GitHub Repo Analysis
What to do instead: Combine with dependency-audit for security insights and code-review for quality assessment of specific files
AI-based audit of declared dependencies — cannot detect transitive vulnerability chains or runtime-only dependencies
From step: Dependency Audit
What to do instead: Supplement with npm audit or pip-audit for vulnerability scanning that includes transitive dependencies
Unknown SPDX identifiers are flagged as 'unknown' and treated conservatively.
From step: Licence Compatibility Check
Pattern-based detection of common secret formats — custom API key formats and encrypted secrets will not be detected
From step: Secret Scan
What to do instead: Add custom regex patterns for your organisation's API key formats and service-specific credential patterns