OpenSSF Scorecard Projects Scraper
Pricing
from $19.00 / 1,000 results
OpenSSF Scorecard Projects Scraper
Scrapes OpenSSF Scorecard results for a list of GitHub repositories and returns each project's overall score, individual check scores, reasons, details, and commit metadata as a flat row.
Pricing
from $19.00 / 1,000 results
Rating
0.0
(0)
Developer
ParseForge
Maintained by CommunityActor stats
0
Bookmarked
1
Total users
0
Monthly active users
2 days ago
Last modified
Categories
Share
OpenSSF Scorecard Projects Scraper
Scrape OpenSSF Scorecard results for any GitHub repository, up to a million per run. Every project comes with its overall score, individual check scores, commit hashes, Scorecard version, and detailed check results. Export to CSV, JSON, Excel, or XML.
The OpenSSF Scorecard API requires per-repo queries and manual pagination, making bulk analysis slow. This Actor reads the public Scorecard results directly for any list of GitHub repositories you provide, returning each project's security posture in one flat, consistent schema. No API key or authentication needed.
| Who uses it | What they scrape OpenSSF Scorecard for |
|---|---|
| Security engineers | Audit the security posture of dozens of dependencies at once. |
| Open source program offices | Track security improvements across an organization's portfolio of repositories. |
| DevSecOps teams | Integrate Scorecard results into CI/CD dashboards and compliance reports. |
| Due diligence analysts | Evaluate the security practices of a target company's open source projects before acquisition. |
What it does
This Actor collects OpenSSF Scorecard results for a list of GitHub repositories and returns each project's scores, checks, and metadata as a flat row.
- 📋 Bulk repo lookup: Provide a list of GitHub repository paths and get all Scorecard results back in one dataset.
- 🔢 Configurable volume: Set a maximum number of projects to scrape, from a single preview up to one million.
- 📊 Full check breakdown: Each row includes the overall score, individual check scores, reasons, and details.
- 📁 Multi-format export: Download results as CSV, JSON, Excel, or XML for further analysis.
Results export to CSV, JSON, Excel, or XML, or straight from the API.
What you can do with OpenSSF Scorecard data
🛡️ Audit dependency security.
A security engineer feeds a list of third-party dependency repos into the Actor and reviews the Scorecard results to decide which libraries need additional review or replacement.
📈 Track portfolio improvements.
An open source program office runs the Actor weekly against their organization's repositories to measure whether security scores are trending up after policy changes.
📋 Generate compliance reports.
A DevSecOps team exports Scorecard data to CSV and feeds it into their GRC platform to demonstrate due diligence for auditors.
🔍 Evaluate acquisition targets.
A due diligence analyst scrapes Scorecard results for all open source repos maintained by a target company to flag security risks before closing the deal.
Why choose this scraper
| What you get | |
|---|---|
| Bulk analysis | Score hundreds of repos in one run instead of querying the API one by one. |
| Fixed schema | Every project returns the same fields, making it easy to compare across repos. |
| No API limits | Reads public Scorecard data directly, bypassing API rate limits and authentication. |
| Historical tracking | Capture Scorecard versions and commit hashes to track security posture over time. |
How it compares
This Actor is the only dedicated OpenSSF Scorecard scraper on Apify, built specifically for bulk repository analysis with a fixed output schema.
| Feature | ParseForge | OpenSSF Scorecard Projects Scraper |
|---|---|---|
| Bulk repository input | Yes, accepts a JSON array of repo paths | Yes |
| Configurable max items | Yes, up to 1,000,000 | Not listed |
| Individual check scores | Yes, all check scores returned per repo | Yes |
| Check reasons and details | Yes, full reason strings and details per check | Yes |
| Scorecard version tracking | Yes, version included per result | Yes |
Configure the run
Drive the Actor with a list of GitHub repository paths, and set a maximum number of projects to control the run size. The Input tab lists every parameter.
A first run with the defaults:
A larger pull:
Pricing
Pay-per-result: $0.021 per result collected. You pay only for the results written to your dataset.
| Results collected | Approximate cost |
|---|---|
| 100 results | $2.10 |
| 1,000 results | $21.00 |
| 10,000 results | $210.00 |
New Apify accounts start with $5 in free credit.
Free users
Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.
Run it
- Create a free Apify account with $5 in credit.
- Open the OpenSSF Scorecard Projects Scraper.
- Set your inputs and any filters, then click Start.
- Export the results as CSV, Excel, JSON, or XML from the Dataset tab.
Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.
Use with AI agents (MCP)
Give an AI agent live access to OpenSSF Scorecard through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:
Then prompt it in plain language to run the scraper and read back the results.
Troubleshooting
Why am I getting no results for a repository I know exists?
The repository may not have been analyzed by the OpenSSF Scorecard yet, or the path format may be incorrect. Ensure you are using the format "github.com/owner/repo" without a trailing slash or protocol. Also check that the repository is public and has had a Scorecard analysis run against it.
Why do some repositories have missing check scores?
Not all Scorecard checks apply to every repository. Some checks may be skipped if the repository does not meet the prerequisites for that check, such as having no releases to sign. Missing scores are expected and will appear as null or empty in the output.
Why is my run limited to 10 items?
Free Apify accounts are limited to 10 items as a preview. Upgrade to a paid plan to increase the maximum projects limit up to 1,000,000 per run.
Why did my run time out?
Scraping a very large number of repositories can take time. Try reducing the maximum projects count or splitting your repository list across multiple runs. Each repository requires a separate request to the Scorecard API.
FAQ
| Question | Answer |
|---|---|
| What is the OpenSSF Scorecard? | The OpenSSF Scorecard is a tool from the Open Source Security Foundation that automatically assesses a GitHub repository's security practices across multiple checks, such as whether it has branch protection, code review, signed releases, and a security policy. Each check produces a score from 0 to 10, and an overall aggregate score is calculated. |
| Do I need a GitHub token or API key to use this Actor? | No. This Actor reads the publicly available Scorecard results without authentication. You only need to provide the repository paths you want to check. |
| How many repositories can I scrape at once? | Free users can scrape up to 10 repositories as a preview. Paid users can scrape up to 1,000,000 repositories per run by adjusting the maximum projects setting. |
| What format should I use for repository paths? | Use the full GitHub path without the protocol, such as "github.com/kubernetes/kubernetes" or "github.com/torvalds/linux". Provide them as a JSON array in the input. |
| What data does each result row contain? | Each row includes the repository path, overall Scorecard score, individual check scores, check reasons and details, the Scorecard version used, and the commit hash that was analyzed. |
| Can I filter by specific checks or a minimum score? | The Actor returns all available Scorecard data for every repository you list. You can filter and sort the results after export using your own tools or spreadsheet software. |
| How often is the Scorecard data updated? | The Actor reads the latest available Scorecard results at the time of the run. The OpenSSF updates Scorecard data on its own schedule, which varies by repository activity. |
| Can I use this for private repositories? | No. This Actor reads publicly available Scorecard data only. Private repositories are not accessible through the public Scorecard API. |
| What export formats are supported? | You can export your dataset in CSV, JSON, Excel, or XML format from the Apify platform after the run completes. |
Related actors
Browse the full ParseForge collection for more scrapers.
🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.
⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Open Source Security Foundation. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.
