GitHub Repo Analyzer — Health, Activity & Risk (AI)

Before you depend on an open-source project, know what you're depending on. This Actor reads any GitHub repository through the official GitHub API and turns its raw signals — stars, commit recency, release cadence, contributor concentration, license and issue load — into a clear health, activity and risk verdict. On top of the hard numbers, OpenAI adds a grounded assessment of maintenance, momentum and bus-factor risk.

Give it a list of repositories. It hands back a due-diligence scorecard.

---

The flow

1. Paste repositories            2. Pull real signals from        3. Get a health verdict
   ("owner/repo" or URLs)    →       the GitHub API            →     score · activity · risks
   facebook/react                    stars · commits · releases      bus factor · summary
   vercel/next.js                    contributors · license

1. Paste repositories as owner/repo or full GitHub URLs (e.g. facebook/react, https://github.com/vercel/next.js).
2. The Actor queries the GitHub REST API for each repo — metadata, languages, contributors, releases and the latest commit. No scraping.
3. The AI layer scores it — health (0–100), activity level, bus-factor risk, concrete red flags and a two-sentence summary, grounded only in the gathered numbers.

Add an optional GitHub token to lift the rate limit from ~60 to 5,000 requests/hour for large batches.

---

What you get per repo

For every repository, the Actor:

1. Reads core metadata (GET /repos/{owner}/{repo}): stars, forks, watchers, primary language, SPDX license, created/pushed dates, open-issue count, archived flag, description, homepage and topics.
2. Breaks down languages (/languages) by bytes.
3. Samples contributors (/contributors, first 100): an approximate contributorsCount, the top contributors and the top contributor's share — the core bus-factor signal.
4. Reads releases (/releases): release count, latest release date and the median gap (cadence) between recent releases.
5. Finds the last commit (/commits?per_page=1): the single most important freshness signal — how long since anyone touched the code.

Then the AI layer (OpenAI gpt-4o-mini, a fast and low-cost model) adds:

• healthScore (0–100) — blends activity, community breadth, release discipline and the absence of red flags.
• activityLevel — abandoned · low · active · very-active.
• maintenanceSignal / communitySignal — one factual sentence each.
• busFactorRisk — low · medium · high (how concentrated the work is in one person).
• risks — short phrases naming concrete red flags (staleness, single-maintainer, missing license, archived).
• summary — a two-sentence verdict.

Every statement is grounded in the fetched numbers — no invented facts. A repo that is gone, private or renamed comes back with an error instead of failing the run.

---

Three ways people use it

• Open-source due diligence — before adopting a library, run a GitHub repo analysis to judge open source health: is it maintained, is there release discipline, or is it a one-person side project at risk of abandonment?
• Dependency & vendor risk — audit your package.json / go.mod / requirements.txt dependencies for bus factor, stale commits, archived status and license problems. Turn a list of repos into an OSS due diligence register for security and procurement.
• Dev-tool competitive research — benchmark your project against rivals: compare stars, momentum, contributor breadth and release cadence across a whole category of developer tools.

Keywords: GitHub repo analysis, open source health, bus factor, OSS due diligence, dependency risk, repository health score.

---

Input

Field	Type	Notes
repos	array	Required. Repositories as owner/repo or GitHub URLs. One per line.
githubToken	string	Optional GitHub personal access token. Without it, GitHub allows ~60 requests/hour; with it, 5,000/hour. Recommended for large batches.
maxResults	integer	Cap how many repositories to analyze. Default 100. One pay-per-event charge per repo analyzed.
maxConcurrency	integer	Repositories processed in parallel. Default 4.
model	string	Override the OpenAI model. Default gpt-4o-mini.

A GITHUB_TOKEN environment variable is used as a fallback if the githubToken input is left empty.

Minimal input example

{
  "repos": ["facebook/react", "vercel/next.js"]
}

---

Output example

{
  "repo": "facebook/react",
  "owner": "facebook",
  "name": "react",
  "description": "The library for web and native user interfaces.",
  "stars": 232000,
  "forks": 47000,
  "watchers": 6700,
  "primaryLanguage": "JavaScript",
  "languages": { "JavaScript": 48210334, "TypeScript": 1203994, "HTML": 102339 },
  "license": "MIT",
  "createdAt": "2013-05-24T16:15:54Z",
  "lastCommit": "2026-10-08T11:02:33Z",
  "lastRelease": "2026-04-25T20:12:00Z",
  "releaseCount": 10,
  "releaseCadenceDays": 61,
  "openIssues": 980,
  "contributorsCount": 100,
  "topContributorShare": 0.12,
  "archived": false,
  "healthScore": 94,
  "activityLevel": "very-active",
  "maintenanceSignal": "Committed within the last day with a steady, well-staffed cadence.",
  "communitySignal": "A broad contributor base with no single dominant author.",
  "busFactorRisk": "low",
  "risks": [],
  "summary": "A flagship, heavily-maintained library with strong momentum and a wide contributor base. No meaningful maintenance or bus-factor risk."
}

A repository that is gone, private or renamed comes back with the fields empty and an error message, so one bad entry never breaks the batch.

---

Pay-per-event pricing

This Actor uses pay-per-event billing:

Event	Price	Charged when
repo-analyzed	$0.10	Once per GitHub repository analyzed for health, activity, contributors, releases and AI risk assessment.

The Actor logs its OpenAI token usage and the estimated AI cost at the end of every run, so the event price always stays safely above the model cost.

---

Setup

The AI layer calls the OpenAI API. Set the environment variable / secret OPENAI_API_KEY on the Actor. The GitHub token is optional and is supplied via the githubToken input (or a GITHUB_TOKEN environment variable).

---

Use it from an AI agent (Apify MCP server)

This Actor is available through the Apify MCP server, so AI agents (Claude, ChatGPT, or anything that speaks MCP) can call it as a tool — hand it a list of repositories and read back the health scorecards — with no custom integration code.

---

Run it locally

npm install
# put your input in storage/key_value_stores/default/INPUT.json
export OPENAI_API_KEY=sk-...
export GITHUB_TOKEN=ghp_...   # optional, raises the rate limit
apify run -p

---

A note on data

This Actor only reads public data exposed by the official GitHub REST API. It does not scrape, and it respects GitHub's rate limits — supply a token to raise them for larger runs.

Related actors

• GitHub Candidate Scorer — Score GitHub developers against a job description by reading their real repos and code.
• B2B Tech Stack Detector — Detect the technologies a company's website is built on, for sales and research.
• npm Package Intelligence — Health, popularity and risk signals for any npm package.
• AI Web Extractor — Turn any URL plus a plain-English prompt into structured JSON.