bear/tool-use

bear/tool-use 0.5.0 appears usable and reasonably well-maintained, with five releases over the last 163 days, a latest release published recently, an active non-archived repository, substantial documentation, tests, a changelog, CI and static-analysis workflows, and organization ownership. The main concerns are that it remains a pre-1.0 package, all five commits in the last three months came from one contributor, there is no repository security policy or security-scanning tooling, and the workflows do not declare top-level token permissions. These issues warrant review before adoption but do not outweigh the evidence of active development and solid project scaffolding.

Latest 0.5.0

Packagist

72%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one account has registry publish access. This is not decisive because the repository is organization-owned, but it still provides limited evidence about registry publishing redundancy.

Repo bus factor

One contributor made all five commits in the last three months, creating a concentrated maintenance risk; organization ownership provides some ability to hand off maintenance but does not remove the current concentration.

Repo issue activity

There are eight open issues and two new issues in the last month, while two pull requests were merged; the absence of recently closed issues suggests some backlog, but demonstrated merges provide compensating maintenance evidence.

Repo tooling

Composer build tooling and CI-related quality configuration are present, but no security-scanning tool was detected, leaving a security-hygiene gap.

Security policy

The repository has no security policy, reducing transparency about vulnerability reporting and response procedures.