What is Plumb?
Plumb scans PHP packages and produces transparent, mechanically verifiable scores across three categories: Security, Maintenance, and Ecosystem Health.
Measurements, not opinions
Every check measures something observable — code, configuration, metadata, or activity history. Plumb never scores a package on stars, follower counts, or anyone's reputation.
Transparency is the point: every score can be explained down to the individual check, and each package's page shows exactly which checks passed, which failed, and why.
Why "Plumb"?
A plumb line is the oldest verification instrument — a weight on a string, used since antiquity to test whether a wall, post, or structure is truly vertical. The verb "to plumb" means to test for trueness, sound for depth, or measure soundness.
That's exactly what this project does: mechanically test whether a package is built true and aligned with sound practices, against fixed reference points — not opinions, not social signals.
What Plumb is not
Plumb is not a static analyzer — it doesn't read a package's source looking for bugs. It's not a replacement for composer audit — it complements vulnerability scanning rather than duplicating it. And it's not a code quality tool: it looks at hygiene signals, not style.
Learn more
The scoring page explains the categories, weights, and every check that goes into a score. Scores are also available programmatically through a free public API. See the API reference for endpoints and response shapes, and the API usage guidelines for caching, rate limits, and attribution.