Checkmarx Repository Health is the sourcing-time scoring engine inside the Checkmarx One Supply Chain pillar. Where SCA evaluates artifacts after they enter the build, Repository Health scores the OSS projects feeding the dependency tree before adoption. Inputs include maintenance frequency, contributor diversity, vulnerability response time, license trust, project provenance (who controls the repository, where the maintainers are based, what the funding model is), and historical security posture. Outputs are project-level scores AppSec can gate on.
The premise is that not all OSS dependencies are equally trustworthy. A library with active maintainers, fast vulnerability response, and a healthy contributor base is a different risk than a library with a single maintainer who has not committed in two years. Both might pass an SCA scan today; only one is a defensible dependency tomorrow. Repository Health makes that distinction explicit and scorable rather than leaving it to developer intuition.
Comparison to OSSF Scorecard is fair. Scorecard provides similar signals as an open-source project. Checkmarx Repository Health adds curated scoring, integration with Checkmarx One findings, policy gates inside CI/CD, and a richer feed than the public Scorecard data. Programs running OSSF Scorecard manually can keep doing so; programs that want a productized score with policy enforcement adopt Repository Health.
Overrestrictive defaults are the main risk. Scoring every OSS project against a strict policy floods the team with warnings on dependencies the program has run for years and still relies on. A Repository Health rollout therefore grandfathers existing dependencies, applies the score gate only to newly introduced ones, and tunes thresholds to the customer's actual risk tolerance. Without that, the program looks like SCA all over again, with noise overwhelming signal.
Ideal use cases
- Sourcing-time gates on new OSS dependency adoption
- OSS project hygiene scoring across maintenance, contributors, and response time
- Provenance-aware OSS sourcing for regulated and federal programs
- Pairing Repository Health with Malicious Package Protection for layered sourcing controls
- Migrating off manual OSS review or OSSF Scorecard onto a productized scoring engine