How trust scores work

Trust = 0.40 × Adoption + 0.25 × Maintenance + 0.15 × Openness + 0.20 × Manual review.

Each factor is scored 1–10 and the weighted result is rounded to an integer. The per-factor breakdown is stored with every entry and shown on its detail page, so the number is always auditable — never a black box.

• Adoption (40%) — how widely it is used, log-scaled against catalog peers. GitHub stars for repos, package downloads where they exist, HuggingFace downloads for open-weight models. Closed SaaS and closed models use documented provider tiers, and the breakdown says so explicitly.
• Maintenance (25%) — is it alive? Last push, releases in the last 12 months, open-issue load. Archived repositories score 2 flat. For models and SaaS without a repo, release recency stands in.
• Openness (15%) — license plus documentation. OSI-approved licenses score highest; closed licenses score lowest.
• Manual review (20%) — a human sanity read: does the README make sense, do the capability claims hold up, any red flags (dead links, archived status, excessive permissions, marketing claims with no evidence)? The reasoning is written out on each entry.

The score is only half the story. Each entry also carries a verification tier:

• Verified — a deep check: official docs read, setup sanity-checked, capability claims cross-checked against independent coverage, security reviewed. Reserved for scores of 8 and above.
• Metrics-checked — scored from public repo stats, maintenance signals, license and docs, plus a quick sanity read. Not a deep audit. This is the honest label for the long tail, and we would rather show it than fake a deeper check.

• It is a point-in-time judgment, not a guarantee. Products get acquired, shut down, or pivot — entries carry lifecycle notes where we know them, but the catalog is researched by a small team and can lag reality.
• Vendor-reported figures (user counts, funding, benchmarks) are marked as provider-reported in the text. We do not launder marketing into "verified" facts.
• A high score does not mean "right for you." It means widely adopted, maintained, open, and sane — your threat model and budget still decide.

Found a dead product with a live score, a wrong license, or a claim that doesn't hold up? Every detail page has a report button, and corrections go to a human-reviewed queue. We would rather be corrected in public than wrong in silence.

Contact us if a score looks off and the report button doesn't cover it.

• v1 — October 2026. Initial methodology: 40/25/15/20 weighting, verified vs metrics-checked tiers.

When the methodology changes, this page changes first — and the version note above records it.