ecosyste.ms

At a glance

• Editor score
  Not yet scored
• Pricing
  Free plan · pricing on request
• Best for
  Researchers needing open-source package metadata
• Free plan
  Yes
• Package health scoring
  No
• Facts checked
  26 Sep 2026

• Where it wins

  • Searches metadata across 52 ecosystems and 109 sources
  • Resolves dependencies and provides security-advisory metadata
  • Parses SBOMs and extracts license metadata

• Where it doesn't

  • Does not provide package health scoring
  • Does not provide dependency alerts
  • Paid commercial options have no published pricing here

Our verdict on ecosyste.ms

For researchers, developers, policymakers, and commercial teams working with open-source software, ecosyste.ms is a collection of datasets and services for querying package and repository metadata. It offers web, API, and self-hosted access, and its services are available for free under open-source licenses. The scope is data discovery and analysis rather than a focused package-health dashboard, so it fits teams that need underlying metadata more than a single health verdict.

Its breadth is a central strength: package metadata spans 52 ecosystems and 109 sources, with repository information, dependency manifests and resolution, security-advisory metadata, and package-archive inspection. Additional tools parse and convert SBOM formats, extract license metadata, compare package or repository contents, and summarize lists of open-source projects. API access includes unauthenticated use subject to rate limits. This makes ecosyste.ms useful when a research workflow or internal service needs to combine multiple kinds of open-source project data; teams seeking a concise risk score or user-facing dependency alerts should look elsewhere, since those functions are not part of the offering described.

The published offering is free for general use, while commercial options add increased API rate limits and less restrictive licensing; pricing is handled through sales contact. Buyers should weigh that distinction if they need higher-volume API access or commercial licensing terms. Cloud and self-hosted deployment give teams a choice of how to access the services, and documentation and email are listed support channels. Choose ecosyste.ms for flexible package and repository data, dependency resolution, license extraction, and SBOM work. It is a weaker fit for organizations whose main requirement is ongoing dependency alerting or automated package-health scoring rather than access to metadata and tools.

ecosyste.ms pricing

ecosyste.ms fact sheet

Alternatives to ecosyste.ms

• Sonatype LifecyclePolicy-driven SCA with broad ecosystem coverage, SBOMs, reachability, and continuous monitoring.3.0
• Endor LabsMaps vulnerable dependency reachability and connects findings to remediation workflows.4.0
• SocketBroad dependency risk coverage, with cloud-only deployment and paid plans from $25 per developer monthly.5.0

See all ecosyste.ms alternatives →

Featured on iTechGuides

ecosyste.ms is listed in our Open Source Package Health Tools directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/ecosyste-ms/"><img src="https://www.itechguides.com/best/badge/ecosyste-ms.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Sep 2026

Advertiser disclosure: iTechGuides is reader-supported. We may earn a commission when you click some links. It never changes a score or a verdict. How we rank.