Github Repository Analyzer

Comprehensive GitHub repository analysis with security scanning, code quality metrics, contributor bus factor, dependency audit, license compatibility, trends analysis, and AI-powered insights.

What it does

This actor provides deep analysis of any GitHub repository:

Core Analysis

• Basic Info: Stars, forks, license, topics, archive status
• Tech Stack: Languages, frameworks, build tools, package managers
• Contributors: Bus factor, contribution distribution (Gini coefficient), top contributors
• Dependencies: Package count, lock file detection, transitive dependencies (npm, pip, Ruby, Composer, Go, Rust, Maven, Gradle)
• Activity: Commit frequency, staleness score, release history
• Quality: Tests, CI/CD, linting, documentation scores

Extended Analysis (v1.1)

• Security: Dependabot alerts, code scanning, secret scanning, security advisories
• Code Quality: Coverage integration (Codecov, Coveralls), complexity estimates, test framework detection
• Issues & PRs: Resolution time, merge velocity, stale issue count, engagement score
• Trends: Star history, fork patterns, commit activity, momentum score
• Branches: Protection rules, branching strategy detection (GitFlow, GitHub Flow, trunk-based)
• Monorepo: Lerna, Turborepo, Nx, pnpm/yarn workspaces detection
• License Compatibility: GPL/MIT/Apache/LGPL conflict detection
• AI Insights: Executive summary, strengths, concerns, risk assessment

MCP Server

Model Context Protocol integration for AI assistants. Tools available:

• analyze_repository - Full repository analysis
• get_security_report - Security vulnerability scan
• get_issue_analytics - Issue/PR metrics
• get_trends - Historical trend data
• get_branch_analysis - Branch and protection rules
• get_code_quality - Quality metrics
• check_monorepo - Monorepo structure detection
• compare_repositories - Side-by-side comparison
• check_license_compatibility - License conflict detection

Use Cases

• Due Diligence: Evaluate open-source dependencies before adoption
• Security Audit: Scan for vulnerabilities in your dependency tree
• Hiring: Assess candidate GitHub portfolios objectively
• Investment: Technical due diligence on startup codebases
• Competitive Analysis: Understand competitor tech stacks
• Open Source: Evaluate project health before contributing
• License Compliance: Ensure dependency licenses are compatible

Input

{
  "repositories": ["facebook/react", "microsoft/vscode"],
  "analysisDepth": "deep",
  "includeSecurity": true,
  "includeTrends": true,
  "includeMonorepo": true,
  "includeLicenseCheck": true,
  "includeAiSummary": true,
  "openaiApiKey": "sk-...",
  "githubToken": "ghp_...",
  "maxConcurrency": 3
}

Input Parameters

Parameter	Type	Required	Description
repositories	array	Yes	Repository URLs or owner/repo format
analysisDepth	string	No	quick, standard, or deep (default: deep)
includeSecurity	boolean	No	Security vulnerability scan (default: true)
includeTrends	boolean	No	Historical trend analysis (default: true)
includeMonorepo	boolean	No	Monorepo detection (default: true)
includeLicenseCheck	boolean	No	License compatibility check (default: true)
includeAiSummary	boolean	No	Generate AI insights (default: true)
openaiApiKey	string	No	Required for AI summaries
githubToken	string	No	Increases rate limit, enables security data
maxConcurrency	integer	No	Parallel repos (default: 3, max: 10)

Analysis Depths

• Quick: Basic info + languages only (~2 API calls)
• Standard: + Contributors, dependencies, activity, branches, issues/PRs (~15 API calls)
• Deep: + Security, code quality, trends, monorepo, license check, AI (~25 API calls + OpenAI)

Output

{
  "repositoryUrl": "https://github.com/facebook/react",
  "owner": "facebook",
  "name": "react",
  "basicInfo": {
    "description": "The library for web and native user interfaces",
    "stars": 220000,
    "forks": 45000,
    "license": "MIT",
    "topics": ["javascript", "react", "frontend"]
  },
  "techStack": {
    "primaryLanguage": "JavaScript",
    "languagePercentages": { "JavaScript": 85.2, "TypeScript": 10.1 },
    "frameworks": ["React"],
    "buildTools": ["Rollup"]
  },
  "contributors": {
    "total": 1600,
    "busFactor": 12,
    "giniCoefficient": 0.78,
    "top10": [...]
  },
  "dependencies": {
    "total": 45,
    "direct": 12,
    "dev": 33,
    "transitive": 850,
    "lockFile": true,
    "packageManager": "yarn",
    "breakdown": { "npm": 45 }
  },
  "activity": {
    "commitsLastMonth": 45,
    "daysSinceLastCommit": 2,
    "stalenessScore": 0,
    "releaseCount": 150
  },
  "quality": {
    "hasTests": true,
    "hasCI": true,
    "hasLinting": true,
    "overallScore": 95
  },
  "security": {
    "vulnerabilities": {
      "critical": 0,
      "high": 1,
      "medium": 3,
      "low": 5
    },
    "hasSecurityPolicy": true,
    "dependabotEnabled": true,
    "codeScanning": true,
    "secretScanning": true,
    "securityScore": 85
  },
  "codeQuality": {
    "coverage": {
      "detected": true,
      "service": "codecov",
      "percentage": 92.5
    },
    "testFramework": "jest",
    "hasLinting": true,
    "complexity": {
      "avgFilesPerDir": 5.2,
      "maxDepth": 8
    },
    "score": 88
  },
  "issuesPRs": {
    "issues": {
      "open": 523,
      "closed": 12400,
      "avgResolutionDays": 4.2,
      "staleCount": 45
    },
    "pullRequests": {
      "open": 120,
      "merged": 8500,
      "avgMergeDays": 2.1,
      "mergeRate": 85
    },
    "community": {
      "engagementScore": 78
    }
  },
  "trends": {
    "starHistory": {
      "trend": "growing",
      "growthRate": 15.2,
      "weeklyAverage": 120
    },
    "commitActivity": {
      "trend": "stable",
      "totalLastYear": 2400,
      "busiestDay": "Tuesday"
    },
    "momentum": {
      "score": 82,
      "assessment": "high-momentum"
    }
  },
  "branches": {
    "totalBranches": 45,
    "activeBranches": 12,
    "staleBranches": 8,
    "protectedBranches": ["main", "canary"],
    "branchingStrategy": "gitflow",
    "branchProtection": {
      "requirePullRequest": true,
      "requiredReviewers": 2,
      "requireStatusChecks": true
    }
  },
  "monorepo": {
    "isMonorepo": true,
    "tool": "yarn-workspaces",
    "packages": [
      { "name": "react", "path": "packages/react" },
      { "name": "react-dom", "path": "packages/react-dom" }
    ],
    "totalPackages": 35
  },
  "licenseCompatibility": {
    "projectLicense": "MIT",
    "compatible": true,
    "conflicts": [],
    "warnings": ["Package 'some-gpl-lib' uses GPL-3.0"]
  },
  "aiInsights": {
    "summary": "React is a mature, actively maintained UI library...",
    "strengths": ["Large community", "Comprehensive testing", "Regular releases"],
    "concerns": ["High bus factor concentration", "Complex contribution process"],
    "maintenanceRisk": "low",
    "recommendation": "Safe for production use with long-term support expected"
  }
}

Key Metrics Explained

Bus Factor

Minimum number of contributors responsible for 50% of commits. Low numbers (1-2) indicate risk if those developers leave.

Gini Coefficient

Measures contribution inequality (0 = perfectly equal, 1 = one person does everything). High values suggest over-reliance on few contributors.

Staleness Score

0-100 scale based on days since last commit:

• 0-10: Active (< 30 days)
• 10-50: Moderate (30-180 days)
• 50-80: Stale (6-12 months)
• 80-100: Abandoned (> 1 year)

Quality Score

0-100 composite score based on:

• README completeness (30%)
• Tests presence (20%)
• CI/CD setup (15%)
• Linting config (10%)
• TypeScript (10%)
• Documentation files (15%)

Security Score

0-100 based on:

• No critical/high vulnerabilities (+40)
• Security policy present (+15)
• Dependabot enabled (+15)
• Code scanning enabled (+15)
• Secret scanning enabled (+15)

Engagement Score

0-100 based on:

• Issue resolution time
• PR merge velocity
• Stale issue ratio
• Recent PR activity
• Net issue change

Momentum Score

0-100 based on:

• Star growth trend
• Commit activity trend
• Traffic data (if available)
• Quiet period frequency

MCP Server Usage

Run the MCP server for AI assistant integration:

$npm run mcp

Configure in your Claude settings:

{
  "mcpServers": {
    "github-analyzer": {
      "command": "node",
      "args": ["path/to/src/mcp-server.js"],
      "env": {
        "GITHUB_TOKEN": "ghp_xxx",
        "OPENAI_API_KEY": "sk-xxx"
      }
    }
  }
}

Pricing

Pay per result:

• $0.03 per repository (quick)
• $0.05 per repository (standard)
• $0.10 per repository (deep)

Plus OpenAI API costs if using AI summary (~$0.01-0.02 per repository).

Rate Limits

Without GitHub token: 60 requests/hour (analyze ~5-7 repos) With GitHub token: 5000 requests/hour (analyze ~400+ repos)

The actor includes automatic rate limit handling with exponential backoff retry.

Get a token at: https://github.com/settings/tokens

Required scopes for full functionality:

• repo (for private repos)
• security_events (for security data)

Examples

Full security audit

{
  "repositories": ["your-org/main-app"],
  "analysisDepth": "deep",
  "includeSecurity": true,
  "githubToken": "ghp_xxxxxxxxxxxx"
}

Compare frameworks

{
  "repositories": [
    "vercel/next.js",
    "facebook/react",
    "vuejs/vue",
    "sveltejs/svelte"
  ],
  "analysisDepth": "standard",
  "includeAiSummary": false
}

Monorepo analysis

{
  "repositories": ["vercel/turbo"],
  "analysisDepth": "deep",
  "includeMonorepo": true
}

License compliance check

{
  "repositories": ["your-org/commercial-product"],
  "analysisDepth": "deep",
  "includeLicenseCheck": true,
  "githubToken": "ghp_xxxxxxxxxxxx"
}

Limitations

• Private repositories require a GitHub token with appropriate permissions
• Security data (Dependabot alerts) requires token with security_events scope
• Traffic data requires push access to the repository
• Repositories with 10,000+ commits may have limited contributor stats
• Some metrics require the repository to have been active recently
• AI insights require an OpenAI API key

Changelog

v1.1.0

• Added security vulnerability scanning (Dependabot, code scanning, secret scanning)
• Added code quality metrics with coverage integration
• Added issue/PR analytics with resolution time and merge velocity
• Added license compatibility analysis
• Added historical trend data with momentum scoring
• Added monorepo support (Lerna, Turborepo, Nx, workspaces)
• Added comprehensive dependency parsing (Gemfile, Composer, lock files)
• Added branch analysis with protection rules and strategy detection
• Added rate limit handling with automatic retry
• Added MCP server for AI assistant integration

Support

For issues or feature requests, please open an issue on the actor's GitHub repository.