Github Repository Analyzer

Comprehensive GitHub repository analysis with security scanning, code quality metrics, contributor bus factor, dependency audit, license compatibility, trends analysis, and optional AI-powered insights.

Useful for technical due diligence, dependency selection, and open source evaluation.

💡 First run? Add a free GitHub token to the githubToken input for the best experience. Without one you're on GitHub's unauthenticated 60 requests/hour limit, which even a single deep analysis can exhaust — a token (no scopes needed for public repos) gives 5,000/hour and unlocks security data. Create one in 30 seconds: https://github.com/settings/tokens (Token-less runs still work — they use lighter defaults and stop early with guidance instead of hanging.)

Continuous Monitoring Setup

Track repos over time with automatic alerts:

1. Enable trackHistory: true (default) — each run's scores are persisted for trend comparison.
2. Add a webhookUrl — the actor POSTs alerts when quality/security thresholds are breached. Supports Slack (webhookFormat: "slack"), Discord, or generic JSON.
3. Set up a schedule (Apify Console → Schedules → weekly/daily) — get notified when a tracked repo's quality drops, new vulnerabilities appear, or bus factor changes.
4. Customize alertThresholds — e.g. {"qualityScore": {"warning": 80, "critical": 60}} to match your standards.

Result: Automatic repo health monitoring with Slack/Discord pings on degradation. No manual re-runs.

✨ Features

Core Analysis

• Basic Info: Stars, forks, license, topics, archive status
• Tech Stack: Languages, frameworks, build tools, package managers
• Contributors: Bus factor, contribution distribution (Gini coefficient), top contributors
• Dependencies: Package count, lock file detection, transitive dependencies
• Activity: Commit frequency, staleness score, release history
• Quality: Tests, CI/CD, linting, documentation scores

Extended Analysis

• Security: Dependabot alerts, code scanning, secret scanning, security advisories
• Code Quality: Coverage integration (Codecov, Coveralls), complexity estimates
• Issues & PRs: Resolution time, merge velocity, stale issue count
• Trends: Star history, fork patterns, commit activity, momentum score
• Branches: Protection rules, branching strategy detection
• Monorepo: Lerna, Turborepo, Nx, workspaces detection
• License Compatibility: GPL/MIT/Apache/LGPL conflict detection
• AI Insights: Executive summary, strengths, concerns, risk assessment

🆕 New Features

📊 Repository Comparison

Compare multiple repositories side-by-side with automated winner detection:

{
  "repositories": ["facebook/react", "vuejs/vue", "sveltejs/svelte"],
  "compareMode": true
}

🏷️ Badge Generation

Get embeddable shields.io-style badges (with inline SVG) for your README:

• Quality Score badge
• Bus Factor badge
• Security Score badge
• Activity/Staleness badge
• Momentum badge
• Coverage badge (when the repo publishes a Codecov/Coveralls percentage)
• Overall Health Grade (A+ to F)

📈 Historical Tracking

Track metrics over time with automatic trend detection:

• Quality score trends
• Security score changes
• Bus factor evolution
• Activity patterns
• Degradation alerts

🔔 Webhook Monitoring

Get notified when metrics cross thresholds:

• Slack integration
• Discord integration
• Generic JSON webhooks
• Customizable alert thresholds

🤖 MCP Server (local / self-hosted only)

The repo also ships a standalone Model Context Protocol (stdio) server for AI assistants (Claude Desktop, Cursor, etc.). It is a separate entry point (node src/mcp-server.js / npm run mcp) and is not invoked by the Apify Actor run — running the Actor on the platform produces the dataset described below, not MCP tools. The server exposes 11 tools:

• analyze_repository - Full repository analysis
• compare_repositories - Side-by-side comparison of two repositories
• get_security_report - Security vulnerability scan (needs a token)
• get_issue_analytics - Issue/PR metrics
• get_trends - Historical trend data
• get_branch_analysis - Branch and protection rules
• get_code_quality - Quality metrics
• check_monorepo - Monorepo structure detection
• check_license_compatibility - License conflict detection
• generate_badges - Generate embeddable badges
• check_alerts - Evaluate quality/security threshold alerts

🚀 Quick Start

Basic Analysis

{
  "repositories": ["facebook/react"],
  "analysisDepth": "deep"
}

Compare Frameworks

{
  "repositories": [
    "vercel/next.js",
    "facebook/react",
    "vuejs/vue",
    "sveltejs/svelte"
  ],
  "compareMode": true,
  "analysisDepth": "standard"
}

Security Audit with Alerts

{
  "repositories": ["your-org/main-app"],
  "analysisDepth": "deep",
  "githubToken": "ghp_xxxxxxxxxxxx",
  "webhookUrl": "https://hooks.slack.com/services/xxx",
  "webhookFormat": "slack",
  "alertThresholds": {
    "securityScore": { "warning": 80, "critical": 60 },
    "criticalVulns": { "warning": 0, "critical": 1 }
  }
}

Scheduled Monitoring

Set up a scheduled run to monitor your dependencies:

{
  "repositories": [
    "your-org/frontend",
    "your-org/backend",
    "your-org/shared-lib"
  ],
  "trackHistory": true,
  "webhookUrl": "https://discord.com/api/webhooks/xxx",
  "webhookFormat": "discord"
}

📋 Input Parameters

Parameter	Type	Required	Description
repositories	array	Yes	Repository URLs or owner/repo format
analysisDepth	string	No	quick, standard, or deep (default: standard)
compareMode	boolean	No	Generate comparison for multiple repos
generateBadgesOutput	boolean	No	Create embeddable badges (default: true)
trackHistory	boolean	No	Save results for trend tracking (default: true)
webhookUrl	string	No	URL for alert notifications
webhookFormat	string	No	json, slack, or discord
alertThresholds	object	No	Custom thresholds for alerts
alwaysNotify	boolean	No	Send webhook on every run
includeAiSummary	boolean	No	Generate AI insights (default: true)
openaiApiKey	string	No	Required for AI summaries
githubToken	string	No	For higher rate limits and security data
maxConcurrency	integer	No	Parallel repos (default: 3, max: 10)

Which analysis modules run is controlled by analysisDepth, not by individual toggles: quick = basic info + languages; standard adds contributors, dependencies, activity, branches, and issues/PRs; deep adds security, code quality, trends, monorepo detection, and license compatibility. (The input form may show additional include* switches; coverage is determined by depth.)

📤 Output

Dataset (per repository)

Full analysis results with all metrics, badges, and alerts.

Key-Value Store

Key	Description
SUMMARY	Run summary with all repo scores
COMPARISON	Side-by-side comparison (if compareMode=true)
BADGES	All generated badges for easy access
HISTORY_owner_repo	Historical data for each repository

Example Output (abbreviated)

Each dataset record contains these top-level fields (sections are null when a sub-source is skipped for the chosen depth, unavailable, or rate-limited): repositoryUrl, owner, name, analysisDepth, analyzedAt, basicInfo, techStack, contributors, dependencies, activity, quality, security, codeQuality, issuesPRs, trends, monorepo, branches, licenseCompatibility, aiInsights, plus badges + badgeMarkdown (when badge output is on), trendReport (when 2+ history points exist), and either alerts or monitoring. A repository that fails outright is written as a compact record: { repositoryUrl, owner, name, error, analyzedAt }.

{
  "repositoryUrl": "https://github.com/facebook/react",
  "owner": "facebook",
  "name": "react",
  "analysisDepth": "deep",
  "analyzedAt": "2026-07-11T00:00:00.000Z",
  "basicInfo": {
    "stars": 220000,
    "forks": 45000,
    "license": "MIT",
    "topics": ["javascript", "ui"],
    "isArchived": false
  },
  "techStack": { "primaryLanguage": "JavaScript", "frameworks": [], "buildTools": [] },
  "contributors": { "total": 1600, "busFactor": 12, "giniCoefficient": 0.87 },
  "quality": { "overallScore": 95, "hasTests": true, "hasCI": true },
  "security": {
    "securityScore": 85,
    "vulnerabilityAlerts": { "enabled": true, "critical": 0, "high": 1, "total": 1 },
    "dependabotEnabled": true
  },
  "activity": { "stalenessScore": 0, "daysSinceLastCommit": 1 },
  "badges": {
    "qualityScore": {
      "markdown": "![Quality Score](https://img.shields.io/badge/quality-95%2F100-brightgreen)",
      "svg": "<svg ...>",
      "alt": "Quality Score: 95/100"
    },
    "health": { "markdown": "![Health](https://img.shields.io/badge/health-A-brightgreen)" }
  },
  "alerts": [],
  "aiInsights": {
    "summary": "React is a mature, actively maintained UI library...",
    "strengths": ["Large contributor base", "Strong CI"],
    "concerns": ["High issue volume"],
    "maintenanceRisk": "low",
    "recommendation": "Safe to depend on."
  }
}

Note: aiInsights is populated only when includeAiSummary is on and a valid openaiApiKey is supplied; otherwise it stays null. The vulnerabilityAlerts, codeScanning, and secretScanning sections under security are only populated when a GitHub token with the relevant access is provided.

📊 Key Metrics Explained

Bus Factor

Minimum contributors responsible for 50% of commits. Low values (1-2) indicate risk.

Staleness Score (0-100)

• 0-10: Active (< 30 days)
• 10-50: Moderate (30-180 days)
• 50-80: Stale (6-12 months)
• 80-100: Abandoned (> 1 year)

Quality Score (0-100)

Composite of: README (30%), Tests (20%), CI/CD (15%), Linting (10%), TypeScript (10%), Docs (15%)

Security Score (0-100)

Based on: No critical vulns (+40), Security policy (+15), Dependabot (+15), Code scanning (+15), Secret scanning (+15)

🔧 MCP Server Setup

The MCP server is a local stdio server (not the Apify platform run). From a checkout of this project, point your Claude Desktop / Cursor configuration at src/mcp-server.js:

{
  "mcpServers": {
    "github-analyzer": {
      "command": "node",
      "args": ["/absolute/path/to/github-repository-analyzer/src/mcp-server.js"],
      "env": {
        "OPENAI_API_KEY": "sk-xxx"
      }
    }
  }
}

Or run it directly:

$npm run mcp          # node src/mcp-server.js

Notes:

• A GitHub token is passed per tool call via the githubToken argument, not through an environment variable.
• OPENAI_API_KEY is read from the environment and is only used by analyze_repository when its includeAI argument is true.

💰 Pricing

Runs on Apify's standard usage-based pricing — you pay for the platform compute/usage the run consumes, which scales with the number of repositories and the chosen analysisDepth (deeper analysis issues more GitHub API calls). See the actor's Apify page for current pricing.

If you enable the AI summary, OpenAI API usage is billed separately by OpenAI against your own key.

⚡ Rate Limits

Token	Rate	Repos/hour
None	60/hour	~5-7
GitHub PAT	5000/hour	~400+

Get a token: https://github.com/settings/tokens

Required scopes: repo (private repos), security_events (security data)

⚠️ Limitations

• Data source: All data comes from the public GitHub REST API (api.github.com). No web scraping of github.com pages and no GraphQL — only documented REST endpoints.
• Rate limits are the main constraint. Without a githubToken you are on GitHub's unauthenticated 60 requests/hour limit, and a single deep analysis issues many requests (each analysis module plus per-branch commit lookups), so one deep run can exhaust it. A free token raises this to 5,000/hour. If a call is rate-limited, that section is left empty rather than crashing the run.
• Private repositories require a token with the repo scope. Public repos work with or without a token.
• Security sections need a token. Dependabot alerts, code scanning, and secret scanning (security.vulnerabilityAlerts, codeScanning, secretScanning) are only queried when a token is present and require the relevant access (e.g. security_events); otherwise they stay disabled/zero. Traffic data (views/clones/referrers under trends) and branch protection details require a token with push/admin access.
• AI insights are optional and gated. aiInsights is only produced when includeAiSummary is on and a valid openaiApiKey is provided (model: gpt-4o-mini); OpenAI usage is billed to your key. Without a key this field is null and the rest of the analysis still runs.
• Dependency analysis reads the first matching root manifest only (package.json → pyproject.toml → requirements.txt → Gemfile → composer.json → go.mod → Cargo.toml → pom.xml → build.gradle) using heuristic parsing. Transitive dependency counts are only computed for package-lock.json. License compatibility only checks npm licenses for package.json projects (top ~20 dependencies).
• Detection is signature-based. Frameworks, build tools, test frameworks, monorepo type, branching strategy, and coverage % (scraped from README badges) are inferred from well-known files and patterns, so they can be missed or misclassified. Contributors are read from the first 100 returned by the API; activeLastMonth is not computed.
• Historical trends require ≥2 runs. Trend data, trendReport, and degradation alerts only appear after the same repository has been analyzed at least twice (history is stored in the actor's key-value store under HISTORY_<owner>_<repo>).
• Partial results by design. If a sub-source fails, its section is null and the record is still pushed. If an entire repository fails (e.g. it doesn't exist or the API is unreachable), a compact error record is pushed for it instead — the overall run does not fail and the dataset is never empty for a valid input.

📝 Changelog

v1.2.0

• Added repository comparison mode with winner detection
• Added embeddable badge generation (shields.io style)
• Added historical tracking with trend analysis
• Added webhook notifications (Slack, Discord, JSON)
• Added customizable alert thresholds
• Added degradation detection

v1.1.0

• Added security vulnerability scanning
• Added code quality metrics with coverage
• Added issue/PR analytics
• Added license compatibility analysis
• Added monorepo detection
• Added MCP server for AI assistants

🆘 Support

For issues or feature requests, please open an issue on the actor's GitHub repository or contact us through Apify.

---

Built for developers who need to make informed decisions about open source dependencies.