A pulse check for your dependencies
Your code depends on it.
Is it still alive?
5,088 packages across npm (JavaScript), PyPI, crates.io, Go, Maven Central (Java), NuGet (C# / .NET) and RubyGems (Ruby), watched for the three things that quietly break a project: abandonment, licence changes, and deprecation.
One manifest. The whole picture.
Check your dependencies together and see what needs attention.
Live feed
Changes worth paying attention to.
github.com/gogo/protobuf
abandoned · GoWas finished. github.com/gogo/protobuf is abandoned by its maintainers' own account — the README says it is no longer maintained, no commits for over 3 years. Plan a migration rather than waiting for a fix.
github.com/go-martini/martini
abandoned · GoWas finished. github.com/go-martini/martini is abandoned by its maintainers' own account — the README says it is no longer maintained, no commits for over 9 years. Plan a migration rather than waiting for a fix.
The six verdicts
- active Work is landing and issues get answers.
- coasting A settled project. Nothing needs doing right now.
- finished Complete. A new commit would be noise, and nobody is waiting on one.
- drifting Something is slipping. Worth watching before it becomes a problem.
- abandoned Nobody is home and users are waiting. Plan a migration.
- dead Gone. Anything depending on it should be replaced.
What triggers each verdict
| Verdict | Trigger |
|---|---|
| active | A commit in the last 90 days. |
| coasting | No commits for 90–365 days, with nothing else deteriorating. |
| finished | No commits for over 365 days, and almost nobody filing new issues — or the README says the project is done. |
| drifting | No commits for 180–365 days plus a deterioration signal: unanswered issues rising, maintainers down to one, or issue response time doubling. |
| abandoned | No commits for over 365 days with unanswered issues piling up — or the registry marks it deprecated, or the repository is archived. |
| dead | The repository is archived and the registry marks it deprecated, or the package has been removed from the registry. |
An issue counts as unanswered once it has gone 14 days without a reply. Nothing changes verdict on a single bad day either: a new state has to hold across two crawls at least 7 days apart before we act on it. The exceptions are facts rather than inferences — an archived repository or a registry deprecation counts immediately.
Why this is hard
Telling finished apart from abandoned is the whole job. A small library that has nothing left to do is not a risk, and calling it one is how a tool like this loses your trust — so when the evidence is ambiguous we say drifting rather than cry abandonment.
Follow along
Subscribe to the feed and your reader tells you when a package goes quiet, changes licence, or comes back from the dead.
Or one ecosystem at a time: npm feed · PyPI feed · crates.io feed · Go feed
Use it from your tools
Everything on this site is also a set of tools for an AI client over the Model Context Protocol: look up a package, check a manifest, search, and what changed lately. Claude Code, Claude Desktop, Cursor — anything that takes an MCP server.
claude mcp add --transport http is-it-dead-yet https://isitdeadyet.dev/mcp --header "Authorization: Bearer <the instance's MCP_TOKEN>"Then ask it: is request still maintained, and what should I use instead? — or paste a package.json and ask what is rotting. On the machine that holds the database, node dist/mcp.js serves the same tools over stdio with no token.
From a terminal or a CI step: npx iidy scan reads the manifest in the current directory, prints every dependency worst first with its release line, and exits 1 on a dead or abandoned one — the same report as the project checker, over POST /api/report.