aveloxis
GitHub
OPEN SOURCE · MIT LICENSE

Understand open source health at fleet scale

Aveloxis collects CHAOSS metrics, contributor analytics, and OpenSSF Scorecards for GitHub and GitLab repositories — whole foundations at a time, on one host — and generates a validated SPDX 2.3 and CycloneDX 1.7 SBOM plus a full OSV vulnerability report for every one of them: software supply-chain evidence your security and procurement teams can file, not screenshots.

Open source, self-hostable, and built by the CHAOSS co-founders as the Go successor to Augur. It covers any repository you point it at, with data you own and a REST API to pull it from — where a hosted dashboard like LFX Insights shows you the projects it has chosen, on its terms.

Explore the live demo → Migrating from Augur? Why we built it →
—
Repositories tracked
GitHub and GitLab · one production host
—
Commits collected
—
Issues collected
—
Pull requests collected
MIT
License
University of Missouri · Sloan Foundation

Live counts from the production fleet's public API.

Free samples, real data

Nine curated collections, regenerated hourly from the production fleet. Every chart on this site is collected data — no mock data, no account required.

Taste it before you sign up

Browse live health snapshots for the Apache Software Foundation, CNCF, NumFOCUS, government and scientific software collections — top repositories with full charts, OpenSSF Scorecards, SBOM downloads, and a side-by-side comparison.

Browse the collections → See a live comparison

Apache Software Foundation

ASF projects, ranked by activity

CNCF

Cloud Native Computing Foundation projects

NumFOCUS

The scientific Python and data ecosystem

Scientific open source

CZI EOSS grantees and other research software

Government repositories

US and European agencies' public code

Enterprise Linux

Distributions and the infrastructure around them

NGOs

Non-governmental organisations' open source

HPE

Hewlett Packard Enterprise open source

Trendy

Widely watched projects, for a quick look
~ aveloxis 
$ git clone https://github.com/aveloxis/aveloxis.git
$ cd aveloxis && go install ./cmd/aveloxis
$ aveloxis migrate && aveloxis start all

✓ Migrations applied (142 tables across aveloxis_data + aveloxis_ops + aveloxis_scan)
✓ Collection scheduler started → ~/.aveloxis/aveloxis.log
✓ Web GUI started → http://localhost:8082
✓ REST API started → http://localhost:8383/api/v1/health

$
WHO IT'S FOR

One fleet, four questions

Each card opens a live showcase page that answers the question with production data.

Foundations and OSPOs

Which of the thousands of repositories in your ecosystem are active, which went quiet, and who is carrying them? Whole collections, ranked by real activity.

See the CNCF collection →

Security and supply-chain teams

Download a CycloneDX or SPDX SBOM, count the open dependency vulnerabilities OSV reports, and read the OpenSSF Scorecard for any tracked repository.

See a repository snapshot →

Researchers and analysts

Compare projects week by week on CHAOSS metrics, with linear trends and residual bands, then pull the same numbers from the REST API.

Open the comparison →

Augur operators

Import your repository list and API keys in two commands, keep your 8Knot dashboards, and retire the Celery, RabbitMQ and Redis stack.

Read the Augur comparison →
CAPABILITIES

Everything you need to understand open source health at velocity

From raw git history to SBOM generation, the whole pipeline runs from one Go binary. The complete list, with each capability's limits, is in the documentation.

Full Augur Schema Parity

142 tables across the aveloxis_data, aveloxis_ops, and aveloxis_scan schemas. Compatible with existing Augur databases — Aveloxis creates its own schemas and never touches yours.

Multi-Platform Collection

Collect CHAOSS metrics from GitHub and GitLab simultaneously using personal access tokens. Schedule collection jobs via the built-in scheduler.

SBOM & License Scanning

CycloneDX 1.7 and SPDX 2.3 SBOMs for every collected repository, OSV vulnerability scanning across their dependencies, and ScanCode license and copyright scanning.

Web GUI and Comparison

Web GUI with OAuth login, interactive charts, contributor timelines, and side-by-side repository comparison. Monitor real-time collection progress.

REST API

Clean API at :8383/api/v1 for querying stats, charts, and SBOMs. All data is accessible programmatically — power your own dashboards or scripts.

Container-First Deployment

Five-container Docker Compose stack: postgres, migrate, serve, web, api. Works with Docker or Podman — production-ready in a single command.

ARCHITECTURE

Five containers, one command

Aveloxis runs as a composable stack. Each service has a single responsibility.

⚡ GitHub ◆ GitLab 🌿 Git Repos 🔍 ScanCode
↓
postgres

PostgreSQL 16

142-table schema across aveloxis_data + aveloxis_ops + aveloxis_scan

:5432
migrate

Schema Migrations

Idempotent DDL — runs once then exits cleanly

serve

Collection Scheduler

Orchestrates GitHub/GitLab data collection jobs

web

Web GUI

OAuth login, visualizations, monitor dashboard

:8082
api

REST API

Stats, charts, SBOMs via /api/v1 endpoints

:8383
docker-compose 
$ cp aveloxis.docker.example.json aveloxis.docker.json
$ # edit aveloxis.docker.json with your API keys
$ docker compose up -d --build
✓ 5 containers started
QUICK START
QUICK START

Up and running in minutes

# Clone and install to PATH
$ git clone https://github.com/aveloxis/aveloxis.git
$ cd aveloxis && go mod tidy
$ go install ./cmd/aveloxis

# Verify installation
$ aveloxis version

# Apply DB migrations
$ aveloxis migrate

# Start all services
$ aveloxis start all
Augur user?

Point aveloxis.json at your existing Augur PostgreSQL database. Aveloxis creates its own schemas and never touches Augur's tables.

UNIVERSITY OF MISSOURI · SLOAN FOUNDATION

Ready to measure what matters?

Aveloxis is open source and free. Browse the public showcase, then sign in with GitHub or GitLab for the full per-repository analytics — or run your own.

Explore the live demo → Sign in for full analytics Read the Docs

Built with Claude Code

Read the story of how AI assisted the development of Aveloxis.

CHAOSS Metrics

Built on the open source community health analytics standard by the people who co-founded it.

Augur Compatible

Drop-in companion or standalone replacement. Your data, your choice.