FIELD NOTE 01 SUPPLY-CHAIN VISIBILITY

See who maintains
your dependencies.

Choose a dependency manifest to see public maintainer, release and repository activity signals. The report shows evidence and gaps, not a verdict.

!A manifest names packages. It does not reveal every maintainer. We show what public metadata can support, and mark the rest unknown.

MAINTAINER VISIBILITYPUBLIC DATA

AUTHOR COUNT IS NOT THE WHOLE STORYCHECK BEFORE YOU SHARE

01 LOAD A MANIFEST

Start with the dependency list.

package.json / go.mod / requirements.txt

↥Drop a file here, or browseRead locally · no manifest upload · public package names are queried only after you start the scan.NO FILE SELECTED

OR PASTE THE FILE CONTENT

Supports npm, Go modules, and pip requirements.

METHOD WHAT WE CAN MEASURE

Method, not
a verdict.

01 / OWNERSHIP

Look for concentration.

Registry publisher/contact counts and contributors visible in a repository’s latest 100 commits. These are different signals, not interchangeable identities.

02 / FRESHNESS

Check the last signal.

Latest release or visible commit date. A quiet project can still be healthy; age is a prompt to review, not a verdict.

03 / BOUNDARIES

Show the blind spots.

Files stay local. Only package names and public repository URLs are sent to public registries or GitHub after you choose to scan.

See who maintains
your dependencies.

Start with the dependency list.

Dependency ownership signals

What the public data says

Method, not
a verdict.

Look for concentration.

Check the last signal.

Show the blind spots.

See who maintainsyour dependencies.

Start with the dependency list.

Dependency ownership signals

What the public data says

Method, nota verdict.

Look for concentration.

Check the last signal.

Show the blind spots.

See who maintains
your dependencies.

Method, not
a verdict.