# OpenSSF Scorecard Projects Scraper (`parseforge/openssf-scorecard-projects-scraper`) Actor

Scrapes OpenSSF Scorecard results for a list of GitHub repositories and returns each project's overall score, individual check scores, reasons, details, and commit metadata as a flat row.

- **URL**: https://apify.com/parseforge/openssf-scorecard-projects-scraper.md
- **Developed by:** [ParseForge](https://apify.com/parseforge) (community)
- **Categories:** Other, Automation
- **Stats:** 1 total users, 0 monthly users, 90.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $19.00 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

[![ParseForge](https://raw.githubusercontent.com/ParseForge/apify-assets/main/banner.jpg)](https://apify.com/parseforge?fpr=vmoqkp)

### OpenSSF Scorecard Projects Scraper

**Scrape OpenSSF Scorecard results for any GitHub repository, up to a million per run.** Every project comes with its overall score, individual check scores, commit hashes, Scorecard version, and detailed check results. Export to CSV, JSON, Excel, or XML.

The OpenSSF Scorecard API requires per-repo queries and manual pagination, making bulk analysis slow. This Actor reads the public Scorecard results directly for any list of GitHub repositories you provide, returning each project's security posture in one flat, consistent schema. No API key or authentication needed.

| Who uses it | What they scrape OpenSSF Scorecard for |
|---|---|
| Security engineers | Audit the security posture of dozens of dependencies at once. |
| Open source program offices | Track security improvements across an organization's portfolio of repositories. |
| DevSecOps teams | Integrate Scorecard results into CI/CD dashboards and compliance reports. |
| Due diligence analysts | Evaluate the security practices of a target company's open source projects before acquisition. |

### What it does

This Actor collects OpenSSF Scorecard results for a list of GitHub repositories and returns each project's scores, checks, and metadata as a flat row.

- 📋 **Bulk repo lookup:** Provide a list of GitHub repository paths and get all Scorecard results back in one dataset.
- 🔢 **Configurable volume:** Set a maximum number of projects to scrape, from a single preview up to one million.
- 📊 **Full check breakdown:** Each row includes the overall score, individual check scores, reasons, and details.
- 📁 **Multi-format export:** Download results as CSV, JSON, Excel, or XML for further analysis.

Results export to CSV, JSON, Excel, or XML, or straight from the API.

### What you can do with OpenSSF Scorecard data

**🛡️ Audit dependency security.**

A security engineer feeds a list of third-party dependency repos into the Actor and reviews the Scorecard results to decide which libraries need additional review or replacement.

**📈 Track portfolio improvements.**

An open source program office runs the Actor weekly against their organization's repositories to measure whether security scores are trending up after policy changes.

**📋 Generate compliance reports.**

A DevSecOps team exports Scorecard data to CSV and feeds it into their GRC platform to demonstrate due diligence for auditors.

**🔍 Evaluate acquisition targets.**

A due diligence analyst scrapes Scorecard results for all open source repos maintained by a target company to flag security risks before closing the deal.

### Why choose this scraper

|  | What you get |
|---|---|
| **Bulk analysis** | Score hundreds of repos in one run instead of querying the API one by one. |
| **Fixed schema** | Every project returns the same fields, making it easy to compare across repos. |
| **No API limits** | Reads public Scorecard data directly, bypassing API rate limits and authentication. |
| **Historical tracking** | Capture Scorecard versions and commit hashes to track security posture over time. |

### How it compares

This Actor is the only dedicated OpenSSF Scorecard scraper on Apify, built specifically for bulk repository analysis with a fixed output schema.

| Feature | ParseForge | OpenSSF Scorecard Projects Scraper |
|---|---|---|
| Bulk repository input | Yes, accepts a JSON array of repo paths | Yes |
| Configurable max items | Yes, up to 1,000,000 | Not listed |
| Individual check scores | Yes, all check scores returned per repo | Yes |
| Check reasons and details | Yes, full reason strings and details per check | Yes |
| Scorecard version tracking | Yes, version included per result | Yes |

### Configure the run

Drive the Actor with a list of GitHub repository paths, and set a maximum number of projects to control the run size. The Input tab lists every parameter.

A first run with the defaults:

```json
{
  "maxItems": 10
}
```

A larger pull:

```json
{
  "maxItems": 200
}
```

### Pricing

Pay-per-result: **$0.021 per result** collected. You pay only for the results written to your dataset.

| Results collected | Approximate cost |
|---|---|
| 100 results | $2.10 |
| 1,000 results | $21.00 |
| 10,000 results | $210.00 |

New Apify accounts start with $5 in free credit.

### Free users

Free-plan runs return up to 10 results as a preview. [Upgrade your Apify plan](https://console.apify.com/sign-up?fpr=vmoqkp) to collect up to 1,000,000 results per run.

### Run it

1. [Create a free Apify account with $5 in credit](https://console.apify.com/sign-up?fpr=vmoqkp).
2. Open the [OpenSSF Scorecard Projects Scraper](https://apify.com/parseforge/openssf-scorecard-projects-scraper?fpr=vmoqkp).
3. Set your inputs and any filters, then click **Start**.
4. Export the results as CSV, Excel, JSON, or XML from the **Dataset** tab.

Run it programmatically through the [Apify API](https://docs.apify.com/api/v2) (`run-sync-get-dataset-items`) or the [ApifyClient](https://docs.apify.com/api/client/js) for JavaScript and Python.

### Use with AI agents (MCP)

Give an AI agent live access to OpenSSF Scorecard through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:

```bash
claude mcp add --transport http apify "https://mcp.apify.com/?tools=parseforge/openssf-scorecard-projects-scraper"
```

Then prompt it in plain language to run the scraper and read back the results.

### Troubleshooting

**Why am I getting no results for a repository I know exists?**

The repository may not have been analyzed by the OpenSSF Scorecard yet, or the path format may be incorrect. Ensure you are using the format "github.com/owner/repo" without a trailing slash or protocol. Also check that the repository is public and has had a Scorecard analysis run against it.

**Why do some repositories have missing check scores?**

Not all Scorecard checks apply to every repository. Some checks may be skipped if the repository does not meet the prerequisites for that check, such as having no releases to sign. Missing scores are expected and will appear as null or empty in the output.

**Why is my run limited to 10 items?**

Free Apify accounts are limited to 10 items as a preview. Upgrade to a paid plan to increase the maximum projects limit up to 1,000,000 per run.

**Why did my run time out?**

Scraping a very large number of repositories can take time. Try reducing the maximum projects count or splitting your repository list across multiple runs. Each repository requires a separate request to the Scorecard API.

### FAQ

| Question | Answer |
|---|---|
| What is the OpenSSF Scorecard? | The OpenSSF Scorecard is a tool from the Open Source Security Foundation that automatically assesses a GitHub repository's security practices across multiple checks, such as whether it has branch protection, code review, signed releases, and a security policy. Each check produces a score from 0 to 10, and an overall aggregate score is calculated. |
| Do I need a GitHub token or API key to use this Actor? | No. This Actor reads the publicly available Scorecard results without authentication. You only need to provide the repository paths you want to check. |
| How many repositories can I scrape at once? | Free users can scrape up to 10 repositories as a preview. Paid users can scrape up to 1,000,000 repositories per run by adjusting the maximum projects setting. |
| What format should I use for repository paths? | Use the full GitHub path without the protocol, such as "github.com/kubernetes/kubernetes" or "github.com/torvalds/linux". Provide them as a JSON array in the input. |
| What data does each result row contain? | Each row includes the repository path, overall Scorecard score, individual check scores, check reasons and details, the Scorecard version used, and the commit hash that was analyzed. |
| Can I filter by specific checks or a minimum score? | The Actor returns all available Scorecard data for every repository you list. You can filter and sort the results after export using your own tools or spreadsheet software. |
| How often is the Scorecard data updated? | The Actor reads the latest available Scorecard results at the time of the run. The OpenSSF updates Scorecard data on its own schedule, which varies by repository activity. |
| Can I use this for private repositories? | No. This Actor reads publicly available Scorecard data only. Private repositories are not accessible through the public Scorecard API. |
| What export formats are supported? | You can export your dataset in CSV, JSON, Excel, or XML format from the Apify platform after the run completes. |

### Related actors

Browse the full [ParseForge collection](https://apify.com/parseforge?fpr=vmoqkp) for more scrapers.

🆘 **Need help?** Email parseforge@protonmail.com with your run ID, your input, and what you expected.

⚠️ **Disclaimer.** This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Open Source Security Foundation. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.

# Actor input Schema

## `maxItems` (type: `integer`):

Free users: Limited to 10 items (preview). Paid users: Optional, max 1,000,000

## `repos` (type: `array`):

List of GitHub repo paths e.g. "github.com/kubernetes/kubernetes".

## Actor input object example

```json
{
  "maxItems": 10,
  "repos": [
    "github.com/kubernetes/kubernetes",
    "github.com/torvalds/linux",
    "github.com/golang/go"
  ]
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "maxItems": 10
};

// Run the Actor and wait for it to finish
const run = await client.actor("parseforge/openssf-scorecard-projects-scraper").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "maxItems": 10 }

# Run the Actor and wait for it to finish
run = client.actor("parseforge/openssf-scorecard-projects-scraper").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "maxItems": 10
}' |
apify call parseforge/openssf-scorecard-projects-scraper --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,parseforge/openssf-scorecard-projects-scraper"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/oLPvByjIccenDDEcX/builds/Y58Raaofzk1KgBVgI/openapi.json