# OpenSSF Scorecard Projects Scraper (`automation-lab/openssf-scorecard-projects-scraper`) Actor Export OpenSSF Scorecard checks for public GitHub repositories: scores, reasons, docs, commits, and pass/warn/fail security findings. - **URL**: https://apify.com/automation-lab/openssf-scorecard-projects-scraper.md - **Developed by:** [Stas Persiianenko](https://apify.com/automation-lab) (community) - **Categories:** Developer tools - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per event This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## OpenSSF Scorecard Projects Scraper Export OpenSSF Scorecard findings for public GitHub repositories at portfolio scale. The actor calls the public OpenSSF Scorecard API and turns each repository scorecard into clean dataset rows for compliance, vendor-risk, DevSecOps, and open-source maintenance workflows. ### What does OpenSSF Scorecard Projects Scraper do? OpenSSF Scorecard Projects Scraper collects security health checks from `api.securityscorecards.dev` for the GitHub repositories you provide. It returns one row per Scorecard check, including overall score, check score, reason, documentation URL, repository commit, scorecard version, and a normalized status. ### Who is it for? - 🛡️ Security teams reviewing third-party open-source dependencies. - 📋 Compliance teams exporting recurring evidence for software supply-chain controls. - 🧑‍💻 OSS maintainers monitoring their own repositories. - 🏢 Vendor-risk teams checking GitHub projects before approval. - 📊 Data teams feeding Scorecard findings into dashboards or risk registers. ### Why use this actor? The OpenSSF API is easy to call for one repository, but compliance workflows usually need repeatable exports for many repositories. This actor adds batching, input normalization, dataset output, Apify scheduling, API access, and pay-per-result billing. ### Data you can extract | Field | Description | | --- | --- | | `repository` | Canonical `github.com/owner/repo` project path | | `repositoryUrl` | Direct GitHub repository URL | | `overallScore` | OpenSSF overall project score | | `checkName` | Scorecard check name | | `checkScore` | Score for the individual check | | `checkStatus` | Normalized `pass`, `warn`, `fail`, or `not_available` | | `checkReason` | OpenSSF explanation for the check score | | `documentationUrl` | Official check documentation link | | `scorecardDate` | Date of the scorecard result | | `repositoryCommit` | Repository commit evaluated by Scorecard | | `scorecardVersion` | Scorecard version used | | `apiUrl` | Source API URL used by the actor | | `scrapedAt` | Actor run timestamp | ### How much does it cost to export OpenSSF Scorecard repository checks? The actor uses pay-per-event pricing. - A small start event is charged once per run. - A result event is charged for each Scorecard check row saved to the dataset. - OpenSSF checks are returned directly from a public API, so no browser or paid proxy is required by default. Your final cost depends on how many repositories you submit and how many checks the Scorecard API returns for each repository. ### How to use it 1. Add GitHub repositories to the `repositories` input. 2. Optionally paste a newline-separated list in `repositoryList`. 3. Set `maxRepositories` if you want a safety cap. 4. Run the actor. 5. Export the dataset as JSON, CSV, Excel, XML, or HTML. ### Input ```json { "repositories": [ "github.com/kubernetes/kubernetes", "https://github.com/nodejs/node", "golang/go" ], "maxRepositories": 100, "failBelowScore": 5, "includeRawDetails": false, "requestTimeoutSecs": 30 } ```` ### Output example ```json { "repository": "github.com/kubernetes/kubernetes", "repositoryUrl": "https://github.com/kubernetes/kubernetes", "owner": "kubernetes", "repo": "kubernetes", "scorecardDate": "2026-06-22", "overallScore": 7.6, "repositoryCommit": "5bc6fe68c97de1497bdf0dc96f2041cc50f2e13e", "scorecardVersion": "v5.5.1-0.20260519155427-916bfc57fa74", "scorecardCommit": "916bfc57fa7431467a33a5a013cba3f8a0c1ec50", "checkName": "Code-Review", "checkScore": 10, "checkStatus": "pass", "checkReason": "all changesets reviewed", "documentationShort": "Determines if the project requires human code review before pull requests are merged.", "documentationUrl": "https://github.com/ossf/scorecard/blob/.../docs/checks.md#code-review", "apiUrl": "https://api.securityscorecards.dev/projects/github.com/kubernetes/kubernetes", "scrapedAt": "2026-06-28T00:00:00.000Z" } ``` ### Supported repository formats You can provide repositories as: - `github.com/owner/repo` - `https://github.com/owner/repo` - `owner/repo` The actor normalizes all three formats before calling the OpenSSF Scorecard API. ### Tips for best results - Use public GitHub repositories only. - Keep `maxRepositories` low for first tests. - Schedule recurring runs to monitor score changes over time. - Use `includeRawDetails` when you need full raw detail arrays for audits. - Keep `failBelowScore` aligned with your internal policy threshold. ### Integrations Use this actor with: - Apify schedules for weekly open-source risk monitoring. - Apify webhooks to notify a compliance workflow when a run finishes. - BI tools that import Apify dataset CSV or JSON exports. - Security data lakes that aggregate dependency risk evidence. - Vendor approval workflows that need Scorecard evidence for GitHub projects. ### API usage Run the actor with the Apify API from Node.js, Python, or cURL. ### Node.js example ```js import { ApifyClient } from 'apify-client'; const client = new ApifyClient({ token: process.env.APIFY_TOKEN }); const run = await client.actor('automation-lab/openssf-scorecard-projects-scraper').call({ repositories: ['github.com/kubernetes/kubernetes', 'github.com/nodejs/node'], maxRepositories: 10, }); const { items } = await client.dataset(run.defaultDatasetId).listItems(); console.log(items); ``` ### Python example ```python from apify_client import ApifyClient import os client = ApifyClient(os.environ['APIFY_TOKEN']) run = client.actor('automation-lab/openssf-scorecard-projects-scraper').call(run_input={ 'repositories': ['github.com/kubernetes/kubernetes', 'github.com/nodejs/node'], 'maxRepositories': 10, }) items = client.dataset(run['defaultDatasetId']).list_items().items print(items) ``` ### cURL example ```bash curl -X POST "https://api.apify.com/v2/acts/automation-lab~openssf-scorecard-projects-scraper/runs?token=$APIFY_TOKEN" \ -H 'Content-Type: application/json' \ -d '{"repositories":["github.com/kubernetes/kubernetes"],"maxRepositories":1}' ``` ### MCP: use from Claude Desktop or Claude Code You can use this actor through the Apify MCP server. MCP tool URL: `https://mcp.apify.com/?tools=automation-lab/openssf-scorecard-projects-scraper` Claude Code setup: ```bash claude mcp add apify-openssf-scorecard --transport http https://mcp.apify.com/?tools=automation-lab/openssf-scorecard-projects-scraper ``` Claude Desktop JSON config: ```json { "mcpServers": { "apify-openssf-scorecard": { "url": "https://mcp.apify.com/?tools=automation-lab/openssf-scorecard-projects-scraper" } } } ``` Example prompts: - "Run OpenSSF Scorecard Projects Scraper for these GitHub repositories and summarize the failed checks." - "Export Scorecard check rows for our dependency list and group them by checkStatus." - "Monitor these OSS projects weekly and tell me which checks changed from pass to warn or fail." ### Scheduling recurring monitoring Open-source risk is not static. Create an Apify schedule to run this actor weekly or monthly against the same repository portfolio. Then compare datasets by `repository`, `checkName`, and `scorecardDate`. ### Error handling If one repository fails, the actor logs a warning and continues with the remaining repositories. The run fails only when no Scorecard check rows are saved. This makes it suitable for larger lists where one archived or unsupported repository should not stop the whole export. ### Performance The actor is HTTP/API-only and uses 256 MB memory by default. No browser automation is used. No proxy is required by default. ### Legality This actor uses the public OpenSSF Scorecard API and public GitHub project identifiers supplied by the user. You are responsible for using the data according to your policies, applicable law, and the OpenSSF/GitHub terms that apply to your workflow. ### FAQ #### Does it need a GitHub token? No. The actor calls the public OpenSSF Scorecard API endpoint. #### Why is a check score `-1`? OpenSSF Scorecard uses negative scores for checks that are not available or not applicable. The actor normalizes those rows to `checkStatus: not_available`. #### Can I scrape private repositories? No. This actor is for public GitHub repositories supported by the public Scorecard API. #### Why did my run save no rows? Check that the repositories are public GitHub projects and that the input uses `owner/repo`, `github.com/owner/repo`, or a GitHub URL. ### Related scrapers Explore related Automation Lab actors at: - https://apify.com/automation-lab - https://apify.com/automation-lab/github-repositories-scraper - https://apify.com/automation-lab/contact-info-scraper ### Changelog - Initial version: batch export of OpenSSF Scorecard check rows for public GitHub repositories. # Actor input Schema ## `repositories` (type: `array`): GitHub repositories to score. Use full URLs, github.com/owner/repo paths, or owner/repo slugs. ## `repositoryList` (type: `string`): Optional newline or comma separated list for copy-pasting repo portfolios from spreadsheets. ## `maxRepositories` (type: `integer`): Safety cap for repositories processed in one run. ## `failBelowScore` (type: `integer`): Checks with scores below this value are labelled fail. Scores from this value to 9 are labelled warn; 10 is pass; -1 is not\_available. ## `includeRawDetails` (type: `boolean`): Add the raw Scorecard details array to each row in addition to the normalized text field. ## `requestTimeoutSecs` (type: `integer`): Timeout for each OpenSSF Scorecard API request. ## Actor input object example ```json { "repositories": [ "github.com/kubernetes/kubernetes", "github.com/nodejs/node", "github.com/golang/go", "github.com/prometheus/prometheus", "github.com/elastic/elasticsearch", "github.com/hashicorp/terraform", "github.com/ansible/ansible", "github.com/rust-lang/rust" ], "repositoryList": "github.com/kubernetes/kubernetes\ngithub.com/nodejs/node", "maxRepositories": 8, "failBelowScore": 5, "includeRawDetails": false, "requestTimeoutSecs": 30 } ``` # Actor output Schema ## `overview` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "repositories": [ "github.com/kubernetes/kubernetes", "github.com/nodejs/node", "github.com/golang/go", "github.com/prometheus/prometheus", "github.com/elastic/elasticsearch", "github.com/hashicorp/terraform", "github.com/ansible/ansible", "github.com/rust-lang/rust" ], "repositoryList": `github.com/kubernetes/kubernetes github.com/nodejs/node`, "maxRepositories": 8, "failBelowScore": 5, "includeRawDetails": false, "requestTimeoutSecs": 30 }; // Run the Actor and wait for it to finish const run = await client.actor("automation-lab/openssf-scorecard-projects-scraper").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "repositories": [ "github.com/kubernetes/kubernetes", "github.com/nodejs/node", "github.com/golang/go", "github.com/prometheus/prometheus", "github.com/elastic/elasticsearch", "github.com/hashicorp/terraform", "github.com/ansible/ansible", "github.com/rust-lang/rust", ], "repositoryList": """github.com/kubernetes/kubernetes github.com/nodejs/node""", "maxRepositories": 8, "failBelowScore": 5, "includeRawDetails": False, "requestTimeoutSecs": 30, } # Run the Actor and wait for it to finish run = client.actor("automation-lab/openssf-scorecard-projects-scraper").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "repositories": [ "github.com/kubernetes/kubernetes", "github.com/nodejs/node", "github.com/golang/go", "github.com/prometheus/prometheus", "github.com/elastic/elasticsearch", "github.com/hashicorp/terraform", "github.com/ansible/ansible", "github.com/rust-lang/rust" ], "repositoryList": "github.com/kubernetes/kubernetes\\ngithub.com/nodejs/node", "maxRepositories": 8, "failBelowScore": 5, "includeRawDetails": false, "requestTimeoutSecs": 30 }' | apify call automation-lab/openssf-scorecard-projects-scraper --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=automation-lab/openssf-scorecard-projects-scraper", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "OpenSSF Scorecard Projects Scraper", "description": "Export OpenSSF Scorecard checks for public GitHub repositories: scores, reasons, docs, commits, and pass/warn/fail security findings.", "version": "0.1", "x-build-id": "RvUxWmPoAvBBOAxem" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/automation-lab~openssf-scorecard-projects-scraper/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-automation-lab-openssf-scorecard-projects-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/automation-lab~openssf-scorecard-projects-scraper/runs": { "post": { "operationId": "runs-sync-automation-lab-openssf-scorecard-projects-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/automation-lab~openssf-scorecard-projects-scraper/run-sync": { "post": { "operationId": "run-sync-automation-lab-openssf-scorecard-projects-scraper", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "repositories": { "title": "GitHub repositories", "type": "array", "description": "GitHub repositories to score. Use full URLs, github.com/owner/repo paths, or owner/repo slugs.", "items": { "type": "string" } }, "repositoryList": { "title": "Repository list (optional)", "type": "string", "description": "Optional newline or comma separated list for copy-pasting repo portfolios from spreadsheets." }, "maxRepositories": { "title": "Maximum repositories", "minimum": 1, "maximum": 1000, "type": "integer", "description": "Safety cap for repositories processed in one run.", "default": 100 }, "failBelowScore": { "title": "Fail threshold", "minimum": 0, "maximum": 10, "type": "integer", "description": "Checks with scores below this value are labelled fail. Scores from this value to 9 are labelled warn; 10 is pass; -1 is not_available.", "default": 5 }, "includeRawDetails": { "title": "Include raw details array", "type": "boolean", "description": "Add the raw Scorecard details array to each row in addition to the normalized text field.", "default": false }, "requestTimeoutSecs": { "title": "Request timeout seconds", "minimum": 5, "maximum": 120, "type": "integer", "description": "Timeout for each OpenSSF Scorecard API request.", "default": 30 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```