heiner/agent-graph

Project backingcaution

The package and repository are both owned by the same individual user, and no organization backing is shown. This is consistent and transparent, but it provides less maintenance redundancy than organization ownership.

Repo bus factorcaution

One contributor made all 25 commits in the last three months, creating a clear single-maintainer continuity risk. The repository is user-owned rather than organization-owned, so there is no provided project-backing evidence to compensate for that concentration.

Repo popularitycaution

The repository has zero stars, forks, and watchers, so there is no demonstrated external adoption or review base. For a package only 110 days old this is a cautionary maturity signal, not a severe risk by itself.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The repository's security policy and clean workflow analysis provide some compensation, but security automation remains a hygiene gap.

Token permissionscaution

One of two workflows lacks top-level token permissions, while the other declares read-only permissions and none declares top-level write access. This is a minor permissions-hygiene gap rather than a severe workflow risk.