Open results

Assessments of public repositories

Canon runs the same assessment it runs for customers against repositories anyone can read, every day. Each result is a case study you can open in full — every control, including the ones Canon could not judge, measured against the rest of the set.

Only public repositories appear here. Customer and private repositories are never published — their results stay inside the organization that connected them.

Repositories assessed: 69
Median delivery controls score: 68
Strongest result: 86

How these scores are calculated — the full control list, the score formula, and what a public reader cannot see.

Control coverage by area

0%100%N/Anot applicableN/A*not assessable from public access

Each cell is the share of applicable controls confirmed in that area. Open a repository to see every control behind its cells.

Repository	Score	Governance	Review	CI & tests	Code quality	Security	Agents & AI	Release & ops	Docs
Reference projects
scorecardossf	70	90	74	72	38	79	0	54	80
cpythonpython	69	100	88	71	25	86	60	38	67
nodenodejs	68	80	74	66	38	71	83	54	83
cosignsigstore	64	80	65	69	25	71	0	54	100
curlcurl	57	100	63	62	25	64	0	31	80
rustrust-lang	55	80	48	56	25	57	67	54	67
AI coding agents
gemini-cligoogle-gemini	83	80	87	93	75	79	83	62	83
clinecline	79	80	83	89	75	50	100	69	83
gooseaaif-goose	76	100	94	76	38	86	80	62	67
github-mcp-servergithub	72	80	83	79	25	93	83	38	67
opencodeanomalyco	71	70	61	83	50	71	67	69	83
orcastablyai	68	50	61	86	50	43	67	85	83
OpenHandsOpenHands	68	70	48	90	63	36	83	77	83
continuecontinuedev	68	100	88	63	25	57	80	69	83
serversmodelcontextprotocol	68	80	62	73	63	50	100	61	83
codexopenai	67	90	65	67	38	71	83	54	83
rufloruvnet	60	30	52	79	38	54	67	54	100
aiderAider-AI	42	30	33	52	0	36	50	54	83
Agent frameworks
openai-agents-pythonopenai	80	90	91	79	75	79	83	54	83
agent-frameworkmicrosoft	73	90	78	79	38	79	83	54	67
mastramastra-ai	72	80	61	79	50	64	83	69	100
semantic-kernelmicrosoft	69	90	87	66	25	64	0	62	80
autogenmicrosoft	68	90	62	76	38	50	83	69	83
crewAIcrewAIInc	68	80	62	65	38	71	83	69	100
langchainlangchain-ai	67	70	57	76	50	64	83	62	83
haystackdeepset-ai	67	100	88	67	25	79	60	46	67
langgraphlangchain-ai	64	80	43	76	38	57	83	54	100
deepagentslangchain-ai	64	70	52	76	13	64	83	62	100
llama_indexrun-llama	60	80	63	66	13	62	60	54	83
agnoagno-agi	60	80	65	59	13	43	83	62	83
browser-usebrowser-use	59	100	56	56	13	50	80	69	83
agentscopeagentscope-ai	55	100	56	62	0	36	80	54	83
smolagentshuggingface	52	80	50	50	25	69	80	31	67
MetaGPTFoundationAgents	48	30	48	48	25	43	0	69	100
lettaletta-ai	48	80	43	46	0	50	83	38	67
TradingAgentsTauricResearch	43	50	29	55	0	38	0	46	100
Agent & workflow platforms
n8nn8n-io	80	80	86	90	63	71	100	54	83
simsimstudioai	76	70	65	86	63	93	67	72	83
AutoGPTSignificant-Gravitas	75	90	83	75	38	57	83	78	100
openhumantinyhumansai	75	70	78	93	63	50	67	69	83
lobe-chatlobehub	69	70	61	80	63	57	67	67	83
lobehublobehub	69	70	61	80	63	57	67	67	83
langflowlangflow-ai	68	90	48	83	75	50	67	62	83
deer-flowbytedance	67	100	63	72	38	64	80	54	83
difylanggenius	65	80	70	70	25	57	100	54	67
FlowiseFlowiseAI	63	80	56	69	38	43	0	77	100
FastGPTlabring	62	100	43	72	38	43	83	62	67
ragflowinfiniflow	52	100	50	56	13	43	60	46	83
Products that deploy
posthogPostHog	80	90	70	80	75	86	71	72	83
sentrygetsentry	79	80	70	90	75	71	100	69	83
grafanagrafana	78	100	78	86	75	57	67	69	83
mattermostmattermost	76	80	74	90	38	79	83	62	83
supabasesupabase	74	80	65	90	50	64	83	61	100
twentytwentyhq	73	80	61	90	25	71	100	67	83
Infrastructure
zarfzarf-dev	86	90	87	93	75	93	83	69	83
argo-cdargoproj	77	100	88	79	50	86	60	62	83
envoyenvoyproxy	74	80	78	67	50	79	83	69	100
prometheusprometheus	72	78	83	72	50	79	60	54	83
kuberneteskubernetes	70	80	88	46	25	100	60	64	83
opentofuopentofu	65	100	88	52	13	71	80	62	83
Frameworks & developer tools
freeCodeCampfreeCodeCamp	74	90	78	79	63	62	67	69	67
vscodemicrosoft	72	80	74	76	50	79	100	54	67
next.jsvercel	71	100	52	79	63	43	83	85	83
TypeScriptmicrosoft	71	80	62	82	75	71	83	46	67
ohmyzshohmyzsh	65	90	74	54	38	86	0	46	80
tensorflowtensorflow	64	80	75	58	13	71	80	67	83
reactfacebook	62	80	52	68	50	50	83	54	83
flutterflutter	62	56	82	60	13	64	60	67	83
ollamaollama	55	100	50	62	13	43	60	54	83

Repository	What it does	Score	vs median	Coverage	Gaps
react facebook Library for web and native user interfaces.	Library for web and native user interfaces.	62	-6	100%	40	Read
n8n n8n-io Fair-code workflow automation with native AI; visual + code; 400+ integrations.	Fair-code workflow automation with native AI; visual + code; 400+ integrations.	80	+12	100%	22	Read
AutoGPT Significant-Gravitas Open-source platform to build, deploy, and run AI agents.	Open-source platform to build, deploy, and run AI agents.	75	+7	100%	28	Read
langchain langchain-ai Agent engineering platform / framework for LLM apps and agents.	Agent engineering platform / framework for LLM apps and agents.	67	-1	100%	36	Read
langflow langflow-ai Visual tool for building and deploying AI agents and workflows.	Visual tool for building and deploying AI agents and workflows.	68	0	100%	34	Read
dify langgenius LLM app platform: agentic workflows, RAG, models, self-host or cloud.	LLM app platform: agentic workflows, RAG, models, self-host or cloud.	65	-3	100%	37	Read
browser-use browser-use Agents that use the browser.	Agents that use the browser.	59	-9	100%	39	Read
TradingAgents TauricResearch Multi-agent LLM financial trading framework.	Multi-agent LLM financial trading framework.	43	-25	100%	57	Read
MetaGPT FoundationAgents Multi-agent framework: assign roles to GPTs for complex tasks.	Multi-agent framework: assign roles to GPTs for complex tasks.	48	-20	100%	51	Read
autogen microsoft Programming framework for multi-agent AI (now in maintenance).	Programming framework for multi-agent AI (now in maintenance).	68	0	100%	34	Read
crewAI crewAIInc Framework for orchestrating role-playing autonomous AI agents.	Framework for orchestrating role-playing autonomous AI agents.	68	0	100%	33	Read
ragflow infiniflow Open-source RAG engine with agent capabilities.	Open-source RAG engine with agent capabilities.	52	-16	100%	45	Read
deer-flow bytedance Super-agent harness: sub-agents, memory, sandbox, skills/tools.	Super-agent harness: sub-agents, memory, sandbox, skills/tools.	67	-1	100%	32	Read
lobe-chat lobehub Agent operator/chat platform: hire, schedule, and run AI teams.	Agent operator/chat platform: hire, schedule, and run AI teams.	69	+1	100%	36	Read
orca stablyai Desktop orchestrator for running CLI coding agents in parallel.	Desktop orchestrator for running CLI coding agents in parallel.	68	0	100%	35	Read
ruflo ruvnet Claude Code plugins/MCP for multi-agent swarms, memory, and loops.	Claude Code plugins/MCP for multi-agent swarms, memory, and loops.	60	-8	100%	43	Read
Flowise FlowiseAI Visual AI-agent builder (archived Aug 2026).	Visual AI-agent builder (archived Aug 2026).	63	-5	100%	34	Read
llama_index run-llama Framework for agentic apps and document processing for AI.	Framework for agentic apps and document processing for AI.	60	-8	100%	38	Read
agno agno-agi Framework and runtime to build, run, and manage agent platforms.	Framework and runtime to build, run, and manage agent platforms.	60	-8	100%	44	Read
langgraph langchain-ai Low-level orchestration for long-running, stateful agents.	Low-level orchestration for long-running, stateful agents.	64	-4	100%	39	Read
openhuman tinyhumansai Personal AI with persistent memory, agent orchestration, and research.	Personal AI with persistent memory, agent orchestration, and research.	75	+7	100%	27	Read
agentscope agentscope-ai Production agent framework you can see, understand, and trust.	Production agent framework you can see, understand, and trust.	55	-13	100%	43	Read
FastGPT labring AI agent platform with knowledge bases and visual workflow orchestration.	AI agent platform with knowledge bases and visual workflow orchestration.	62	-6	100%	41	Read
openai-agents-python openai Lightweight framework for multi-agent workflows.	Lightweight framework for multi-agent workflows.	80	+12	100%	22	Read
smolagents huggingface Minimal library for powerful agents, especially code agents.	Minimal library for powerful agents, especially code agents.	52	-16	100%	44	Read
deepagents langchain-ai Opinionated agent harness on LangGraph: sub-agents, filesystem, skills.	Opinionated agent harness on LangGraph: sub-agents, filesystem, skills.	64	-4	100%	39	Read
sim simstudioai Workspace to build, deploy, and monitor AI agents and workflows.	Workspace to build, deploy, and monitor AI agents and workflows.	76	+8	100%	27	Read
semantic-kernel microsoft SDK for AI agents and plugins (succeeded by Microsoft Agent Framework).	SDK for AI agents and plugins (succeeded by Microsoft Agent Framework).	69	+1	100%	32	Read
mastra mastra-ai TypeScript framework for AI apps and agents.	TypeScript framework for AI apps and agents.	72	+4	100%	31	Read
haystack deepset-ai AI orchestration framework for production LLM apps, RAG, and agents.	AI orchestration framework for production LLM apps, RAG, and agents.	67	-1	100%	31	Read
letta letta-ai Platform for stateful agents with long-term memory that learn over time.	Platform for stateful agents with long-term memory that learn over time.	48	-20	100%	54	Read
freeCodeCamp freeCodeCamp Free community and curriculum to learn to code.	Free community and curriculum to learn to code.	74	+6	100%	28	Read
ohmyzsh ohmyzsh Community framework for managing zsh config, plugins, and themes.	Community framework for managing zsh config, plugins, and themes.	65	-3	100%	35	Read
ollama ollama Run large language models locally.	Run large language models locally.	55	-13	100%	43	Read
vscode microsoft Visual Studio Code — open-source code editor.	Visual Studio Code — open-source code editor.	72	+4	100%	30	Read
tensorflow tensorflow Open-source machine learning framework.	Open-source machine learning framework.	64	-4	100%	29	Read
flutter flutter Toolkit to build apps for mobile, web, desktop from one codebase.	Toolkit to build apps for mobile, web, desktop from one codebase.	62	-6	100%	33	Read
kubernetes kubernetes Production-grade container scheduling and management.	Production-grade container scheduling and management.	70	+2	100%	20	Read
scorecard ossf Automated security health checks for open-source projects.	Automated security health checks for open-source projects.	70	+2	100%	31	Read
cosign sigstore Signing and verification for containers and software artifacts.	Signing and verification for containers and software artifacts.	64	-4	100%	33	Read
curl curl Command-line tool and library for transferring data with URLs.	Command-line tool and library for transferring data with URLs.	57	-11	100%	39	Read
node nodejs JavaScript runtime built on Chrome's V8 engine.	JavaScript runtime built on Chrome's V8 engine.	68	0	100%	35	Read
cpython python The reference implementation of the Python language.	The reference implementation of the Python language.	69	+1	100%	30	Read
rust rust-lang The Rust compiler and standard library.	The Rust compiler and standard library.	55	-13	100%	47	Read
codex openai Lightweight coding agent that runs in your terminal.	Lightweight coding agent that runs in your terminal.	67	-1	100%	35	Read
gemini-cli google-gemini Open-source AI agent that brings Gemini to the terminal.	Open-source AI agent that brings Gemini to the terminal.	83	+15	100%	19	Read
OpenHands OpenHands Platform for AI software-development agents.	Platform for AI software-development agents.	68	0	100%	34	Read
cline cline Autonomous coding agent inside your IDE.	Autonomous coding agent inside your IDE.	79	+11	100%	23	Read
aider Aider-AI AI pair programming in your terminal.	AI pair programming in your terminal.	42	-26	100%	61	Read
continue continuedev Open-source AI coding agents for the IDE, terminal, and CI.	Open-source AI coding agents for the IDE, terminal, and CI.	68	0	100%	30	Read
opencode anomalyco Open-source AI coding agent for the terminal.	Open-source AI coding agent for the terminal.	71	+3	100%	32	Read
goose aaif-goose Extensible open-source AI agent that runs locally.	Extensible open-source AI agent that runs locally.	76	+8	100%	23	Read
github-mcp-server github GitHub's official Model Context Protocol server.	GitHub's official Model Context Protocol server.	72	+4	100%	30	Read
servers modelcontextprotocol Reference implementations of Model Context Protocol servers.	Reference implementations of Model Context Protocol servers.	68	0	100%	36	Read
agent-framework microsoft Framework for building and orchestrating AI agents; successor to AutoGen and Semantic Kernel.	Framework for building and orchestrating AI agents; successor to AutoGen and Semantic Kernel.	73	+5	100%	29	Read
lobehub lobehub Agent and chat platform for hiring, scheduling, and running AI teams.	Agent and chat platform for hiring, scheduling, and running AI teams.	69	+1	100%	36	Read
supabase supabase Open-source Postgres development platform.	Open-source Postgres development platform.	74	+6	100%	30	Read
sentry getsentry Error tracking and performance monitoring.	Error tracking and performance monitoring.	79	+11	100%	23	Read
posthog PostHog Product analytics, session replay, and feature flags.	Product analytics, session replay, and feature flags.	80	+12	97%	23	Read
grafana grafana Observability and data visualization platform.	Observability and data visualization platform.	78	+10	100%	24	Read
mattermost mattermost Secure collaboration platform for technical teams.	Secure collaboration platform for technical teams.	76	+8	100%	26	Read
twenty twentyhq Open-source CRM.	Open-source CRM.	73	+5	100%	31	Read
argo-cd argoproj GitOps continuous delivery for Kubernetes.	GitOps continuous delivery for Kubernetes.	77	+9	100%	22	Read
opentofu opentofu Open-source infrastructure as code.	Open-source infrastructure as code.	65	-3	100%	33	Read
prometheus prometheus Monitoring system and time-series database.	Monitoring system and time-series database.	72	+4	100%	29	Read
envoy envoyproxy Cloud-native edge and service proxy.	Cloud-native edge and service proxy.	74	+6	100%	28	Read
zarf zarf-dev Software delivery to air-gapped Kubernetes environments.	Software delivery to air-gapped Kubernetes environments.	86	+18	100%	15	Read
next.js vercel The React framework for the web.	The React framework for the web.	71	+3	100%	31	Read
TypeScript microsoft Typed superset of JavaScript.	Typed superset of JavaScript.	71	+3	100%	31	Read

Assess your own repository

Sign in, connect a repository, and Canon runs this same assessment on it — plus the controls only repository admins can see. Your results are private to your organization and never appear on these pages.

Run a private assessment Sign in

Canon reads your repository through a GitHub App you install and never stores secret values.