# npm Package Health Score API — Dependency Risk Scorer (`malonestar/npm-package-health-scorer`) Actor

npm package health score API. Rate any npm dependency 0-100 with a letter grade from keyless public signals: downloads, release recency & cadence, maintainers, license, deprecation, deps. One row per package with top risks. Keyless. A clean MCP tool for AI coding agents.

- **URL**: https://apify.com/malonestar/npm-package-health-scorer.md
- **Developed by:** [Kyle Maloney](https://apify.com/malonestar) (community)
- **Categories:** Developer tools, MCP servers, Agents
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $6.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md):

```bash
npm install apify-client
```

In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md):

```bash
pip install apify-client
```

In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md):

````bash
# MacOS / Linux
curl -fsSL https://apify.com/install-cli.sh | bash
# Windows
irm https://apify.com/install-cli.ps1 | iex
```bash

In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md).

If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).


# README

## npm Package Health Score API — Dependency Risk Scorer

Score the health of any **npm package from 0 to 100** with a letter grade, using
only **keyless, public** signals. Give it a list of package names and get back one
clean, structured row per package — a composite `health_score`, a `grade`, the
biggest `top_risks`, and every underlying signal — so engineers and AI coding
agents can decide **whether a dependency is safe to adopt**.

No API key. No login. No GitHub token required.

### Who it's for
- **Engineering & platform teams** vetting a new dependency before `npm install`, or auditing an existing `package.json` for stale / risky packages.
- **Security & supply-chain reviewers** who need a fast, repeatable risk signal (deprecation, single-maintainer bus-factor, abandoned packages, heavy dependency surface).
- **AI coding agents** (Claude, Cursor, Copilot-style tools) that need a callable tool to judge a package before recommending or installing it. See "Use as an MCP tool" below.
- **Tech-radar / SRE / OSS-program-office** dashboards tracking the health of the libraries you depend on.

### Data sources (all keyless, official)
- **npm registry** — `https://registry.npmjs.org/<package>` (versions, publish timestamps, maintainers, license, deprecation, dependencies).
- **npm downloads API** — `https://api.npmjs.org/downloads/range/last-month/<package>` (last-30-day download counts + momentum).

### Example input
```json
{
  "packages": ["express", "lodash", "left-pad", "@babel/core"],
  "includeTrend": true
}
````

You can also score a single package with `{ "package": "react" }`, or paste a
comma-separated string into `packages`.

### Output fields (one row per package)

| Field | Meaning |
|---|---|
| `package` | Package name scored |
| `latest_version` | Version tagged `latest` |
| `health_score` | Composite 0–100 (null if not found) |
| `grade` | A / B / C / D / F |
| `last_publish_date` | Latest publish (YYYY-MM-DD) |
| `days_since_publish` | Days since the latest release |
| `publishes_last_2y` | Release cadence over 2 years |
| `downloads_last_month` | Total downloads, last 30 days |
| `download_trend_pct` | Momentum: 2nd-half vs 1st-half of last 30 days |
| `maintainers` | Registered maintainer count |
| `license` | Declared SPDX license (or null) |
| `deprecated` | True if the latest version is deprecated |
| `dependencies_count` | Runtime dependencies of the latest version |
| `top_risks` | Array of the biggest risks detected |
| `rationale` | One-line human summary of positives/negatives |
| `sub_scores` | The eight weighted sub-scores |
| `source_url` | npmjs.com page |
| `retrieved_at` | ISO timestamp of the scoring run |

### How the score is computed (weights)

The composite is a weighted average of eight 0–100 sub-scores:

| Signal | Weight | Rewards |
|---|---|---|
| `download_volume` | 25% | High last-month downloads (log-scaled) |
| `release_recency` | 20% | A recent publish (fresh in the last 30 days = 100; 2+ years stale = 0) |
| `release_cadence` | 15% | Regular releases (~8 in 2 years saturates to 100) |
| `download_trend` | 10% | Growing, not declining, downloads |
| `maintainer_count` | 10% | More than one maintainer (bus-factor) |
| `license` | 10% | A declared, permissive license |
| `version_maturity` | 5% | A `>= 1.0.0` release |
| `dependency_count` | 5% | Fewer runtime dependencies |

**Deprecation is a hard penalty:** any package whose latest version is marked
`deprecated` on npm is capped at a score of **20** (grade F), regardless of its
other signals.

**Grade thresholds:** A ≥ 85 · B ≥ 70 · C ≥ 55 · D ≥ 40 · F < 40.

### Use as an MCP tool

This Actor is a **prime tool for AI agents**. Exposed through
[mcp.apify.com](https://mcp.apify.com), an agent can call it to score a dependency
it's about to recommend or install. The input is a simple list of package names
and every output field carries a description, so the model can read
`health_score`, `grade`, `deprecated`, and `top_risks` directly and chain the
result into a decision ("is this package safe to add?"). Pair it with a
lockfile/SBOM tool to score an entire dependency tree.

### FAQ

**How do I check if an npm package is healthy or safe to use?**
Pass the package name; read `health_score`, `grade`, and `top_risks`. Low scores
flag stale, deprecated, single-maintainer, or low-adoption packages.

**How do I detect deprecated or abandoned npm packages?**
`deprecated: true` marks npm-deprecated packages; a large `days_since_publish`
with `publishes_last_2y: 0` flags abandoned ones. Both drag the score down.

**Does it need a GitHub token or npm login?**
No. It only uses the public, keyless npm registry and downloads APIs.

**Can it score scoped packages (`@scope/name`)?**
Yes — scoped packages are fully supported.

**Can an AI agent call this?**
Yes — it's designed as a chainable MCP tool (see above).

### Pricing

Pay per result: one scored package = one dataset item. Empty runs cost only the
tiny actor start. No hidden per-signal charges.

# Actor input Schema

## `packages` (type: `array`):

List of npm package names to score (e.g. "express", "lodash", "@babel/core"). Scoped packages are supported. You can also paste a comma- or space-separated string.

## `package` (type: `string`):

Convenience field to score just one package. Merged with the `packages` list if both are provided.

## `includeTrend` (type: `boolean`):

Compute the month-over-month download momentum (second half vs first half of the last 30 days) and include it in the score. Turn off to omit the trend field.

## Actor input object example

```json
{
  "packages": [
    "express",
    "left-pad"
  ],
  "includeTrend": true
}
```

# Actor output Schema

## `results` (type: `string`):

One scored record per npm package, in the default dataset.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "packages": [
        "express",
        "left-pad"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("malonestar/npm-package-health-scorer").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "packages": [
        "express",
        "left-pad",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("malonestar/npm-package-health-scorer").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "packages": [
    "express",
    "left-pad"
  ]
}' |
apify call malonestar/npm-package-health-scorer --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=malonestar/npm-package-health-scorer",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

```json
{
    "openapi": "3.0.1",
    "info": {
        "title": "npm Package Health Score API — Dependency Risk Scorer",
        "description": "npm package health score API. Rate any npm dependency 0-100 with a letter grade from keyless public signals: downloads, release recency & cadence, maintainers, license, deprecation, deps. One row per package with top risks. Keyless. A clean MCP tool for AI coding agents.",
        "version": "1.0",
        "x-build-id": "APP5QpR8wUYrXI0Tv"
    },
    "servers": [
        {
            "url": "https://api.apify.com/v2"
        }
    ],
    "paths": {
        "/acts/malonestar~npm-package-health-scorer/run-sync-get-dataset-items": {
            "post": {
                "operationId": "run-sync-get-dataset-items-malonestar-npm-package-health-scorer",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        },
        "/acts/malonestar~npm-package-health-scorer/runs": {
            "post": {
                "operationId": "runs-sync-malonestar-npm-package-health-scorer",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor and returns information about the initiated run in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK",
                        "content": {
                            "application/json": {
                                "schema": {
                                    "$ref": "#/components/schemas/runsResponseSchema"
                                }
                            }
                        }
                    }
                }
            }
        },
        "/acts/malonestar~npm-package-health-scorer/run-sync": {
            "post": {
                "operationId": "run-sync-malonestar-npm-package-health-scorer",
                "x-openai-isConsequential": false,
                "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
                "tags": [
                    "Run Actor"
                ],
                "requestBody": {
                    "required": true,
                    "content": {
                        "application/json": {
                            "schema": {
                                "$ref": "#/components/schemas/inputSchema"
                            }
                        }
                    }
                },
                "parameters": [
                    {
                        "name": "token",
                        "in": "query",
                        "required": true,
                        "schema": {
                            "type": "string"
                        },
                        "description": "Enter your Apify token here"
                    }
                ],
                "responses": {
                    "200": {
                        "description": "OK"
                    }
                }
            }
        }
    },
    "components": {
        "schemas": {
            "inputSchema": {
                "type": "object",
                "properties": {
                    "packages": {
                        "title": "npm package names",
                        "type": "array",
                        "description": "List of npm package names to score (e.g. \"express\", \"lodash\", \"@babel/core\"). Scoped packages are supported. You can also paste a comma- or space-separated string.",
                        "items": {
                            "type": "string"
                        }
                    },
                    "package": {
                        "title": "Single package (optional)",
                        "type": "string",
                        "description": "Convenience field to score just one package. Merged with the `packages` list if both are provided."
                    },
                    "includeTrend": {
                        "title": "Include download trend",
                        "type": "boolean",
                        "description": "Compute the month-over-month download momentum (second half vs first half of the last 30 days) and include it in the score. Turn off to omit the trend field.",
                        "default": true
                    }
                }
            },
            "runsResponseSchema": {
                "type": "object",
                "properties": {
                    "data": {
                        "type": "object",
                        "properties": {
                            "id": {
                                "type": "string"
                            },
                            "actId": {
                                "type": "string"
                            },
                            "userId": {
                                "type": "string"
                            },
                            "startedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "finishedAt": {
                                "type": "string",
                                "format": "date-time",
                                "example": "2025-01-08T00:00:00.000Z"
                            },
                            "status": {
                                "type": "string",
                                "example": "READY"
                            },
                            "meta": {
                                "type": "object",
                                "properties": {
                                    "origin": {
                                        "type": "string",
                                        "example": "API"
                                    },
                                    "userAgent": {
                                        "type": "string"
                                    }
                                }
                            },
                            "stats": {
                                "type": "object",
                                "properties": {
                                    "inputBodyLen": {
                                        "type": "integer",
                                        "example": 2000
                                    },
                                    "rebootCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "restartCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "resurrectCount": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "computeUnits": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "options": {
                                "type": "object",
                                "properties": {
                                    "build": {
                                        "type": "string",
                                        "example": "latest"
                                    },
                                    "timeoutSecs": {
                                        "type": "integer",
                                        "example": 300
                                    },
                                    "memoryMbytes": {
                                        "type": "integer",
                                        "example": 1024
                                    },
                                    "diskMbytes": {
                                        "type": "integer",
                                        "example": 2048
                                    }
                                }
                            },
                            "buildId": {
                                "type": "string"
                            },
                            "defaultKeyValueStoreId": {
                                "type": "string"
                            },
                            "defaultDatasetId": {
                                "type": "string"
                            },
                            "defaultRequestQueueId": {
                                "type": "string"
                            },
                            "buildNumber": {
                                "type": "string",
                                "example": "1.0.0"
                            },
                            "containerUrl": {
                                "type": "string"
                            },
                            "usage": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "integer",
                                        "example": 1
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            },
                            "usageTotalUsd": {
                                "type": "number",
                                "example": 0.00005
                            },
                            "usageUsd": {
                                "type": "object",
                                "properties": {
                                    "ACTOR_COMPUTE_UNITS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATASET_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "KEY_VALUE_STORE_WRITES": {
                                        "type": "number",
                                        "example": 0.00005
                                    },
                                    "KEY_VALUE_STORE_LISTS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_READS": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "REQUEST_QUEUE_WRITES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_INTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "DATA_TRANSFER_EXTERNAL_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                                        "type": "integer",
                                        "example": 0
                                    },
                                    "PROXY_SERPS": {
                                        "type": "integer",
                                        "example": 0
                                    }
                                }
                            }
                        }
                    }
                }
            }
        }
    }
}
```