We scored 24 of the most-loved open-source repositories against a 29-category production engineering standard. Not one of them reached 65.

This is not a quality verdict. These are excellent, battle-tested libraries. It is a breadth measurement: how much of a strict, cross-cutting standard — security, testing, observability, dependency hygiene, LLM practice, and 24 more — a codebase addresses out of the box. It is the baseline your AI agents start from, before they add to it.

24repositories

12,655source files

6,953detected findings

95block violations

29categories scored

The leaderboard

Not one of the 24 cleared 65.

Ranked by health score. Large, expressive libraries accumulate more advisory candidates because the standard evaluates every qualifying pattern — so a low score reflects surface area, not sloppiness.

Grades: Fair 50–64 · Poor 30–49 · Critical 0–29. Five repos reached Fair; eight Poor; eleven Critical. None reached Good (65+).

Where the gaps are

Five of 29 categories had gaps in every single repository.

Share of the 24 repos with at least one detected gap in each category. The universal ones — structure, documentation, testing, CI and git hygiene — are exactly the cross-cutting concerns a per-language linter never looks at.

Security is the standout for severity: 14 of 24 repos (58%) carry a security block violation — every repo with a blocking finding has one in security.

Three things the data says

Read it in thirty seconds.

33/100

The median widely-deployed OSS repo addresses about a third of a strict 29-category standard. That is the floor your agents build on top of.

58%

Well over half of these repositories ship a security block violation — present in production code used by millions of developers today.

5 of 29

Categories with a gap in every single repo. The cross-cutting concerns — not one language's syntax — are where the standard bites.

How it was measured

One deterministic 0–100 score, run at each repo's default branch, zero config.

Every repository was scored with npx developer-doctor against the same 29-category standard — 413 checks derived from a production engineering handbook. The scoring rubric and weights live in a private oracle, so the number can't be gamed by reading the tool. Checks that need a runtime or a semantic judgment are reported honestly as not verified and never counted against a repo. The same repo scores the same every run — these numbers reproduce exactly. See the standard →

$ npx developer-doctor .