Maintainer Radar

Maintainer Radar is a local-first CLI that generates repository health, security hygiene, release readiness, and OSS application readiness reports for open-source maintainers.

It is built for the maintenance work that usually sits between coding and project stewardship: reviewing repo health, spotting sensitive files before a public release, checking docs and release surfaces, and creating prioritized maintainer tasks.

Why This Exists

Open-source maintainers carry invisible work: triaging issues, reviewing pull requests, preparing releases, protecting security hygiene, and keeping docs useful. Maintainer Radar gives maintainers a fast local report they can use before publishing, applying for maintainer support, or handing a project to an AI coding agent.

Quick Start

Run from npm:

npx maintainer-radar scan .

Or install it globally:

npm install -g maintainer-radar
maintainer-radar scan .

You can also run the current public source release from GitHub:

npx --yes github:ts370102633-hue/maintainer-radar scan .

Or install it globally from GitHub:

npm install -g github:ts370102633-hue/maintainer-radar
maintainer-radar scan .

To run from a local clone:

npm install
npm run build
node dist/cli.js scan .

After scanning, open:

maintainer-radar-report/01-summary.md

GitHub Action

Maintainer Radar can run on pull requests or release branches and upload the Markdown report pack as a GitHub Actions artifact:

- uses: ts370102633-hue/[email protected]
  with:
    output-dir: maintainer-radar-report
    artifact-name: maintainer-radar-report

See docs/github-action.md for the full workflow example and private repository guidance.

CLI Usage

maintainer-radar scan [repo-path] [--out report-dir] [--json] [--private]

Examples:

maintainer-radar scan .
maintainer-radar scan /path/to/repo --out maintainer-radar-report
maintainer-radar scan /path/to/private-repo --out private-report --private
maintainer-radar scan . --json

Report Outputs

The CLI writes:

maintainer-radar-report/
  01-summary.md
  02-health-score.md
  03-security-risks.md
  04-oss-readiness.md
  05-release-readiness.md
  06-maintainer-tasks.md
  manifest.json

When --private is used, the report also includes:

00-private-report-notice.md

Use private mode for internal repositories, customer projects, portfolio tools, or anything that may contain local paths or sensitive operational context.

What It Checks

• README, LICENSE, SECURITY.md, CONTRIBUTING.md, and .env.example
• build, test, lint, and public package signals
• ecosystem detection for Node.js, Python, and Go projects
• Git repository, origin, release tags, and commit history
• GitHub Actions workflow presence
• release notes and roadmap presence
• common secret patterns and sensitive-looking files

Local-first Data Handling

Maintainer Radar does not upload repository content. It reads local files and writes local Markdown reports. Secret findings are redacted in report evidence, but maintainers should still review generated reports before publishing.

Intended Maintainer Workflows

• pre-open-source readiness review
• release readiness check
• security and privacy hygiene check
• AI handoff pack before using Codex or another coding agent
• application readiness review for open-source maintainer support programs

Non-goals

• It is not a full SAST tool.
• It is not a dependency vulnerability scanner.
• It does not replace legal review.
• It does not automatically upload code or reports.

Development

npm install
npm run build
npm test
npm run example

Ecosystem Support

v0.1.5 detects:

• Node.js through package.json
• Python through pyproject.toml, requirements.txt, or setup.py
• Go through go.mod

Python and Go projects receive ecosystem-specific readiness checks so maintainers can see whether dependency and test/build signals are present. Non-Node projects are not penalized for missing package.json when a Python or Go manifest is detected.

Roadmap

• richer ecosystem detection for Rust and Java
• GitHub Action summary comments
• optional AI summary generation
• issue and pull request triage inputs
• release note drafting
• maintainer support application drafts

License

MIT