What is Plumb?
Plumb scans PHP packages and produces transparent, mechanically verifiable scores across three categories: Security, Maintenance, and Ecosystem Health.
Measurements, not opinions
Every check measures something observable — code, configuration, metadata, or activity history. Plumb never scores a package on stars, follower counts, or anyone's reputation.
Transparency is the point: every score can be explained down to the individual check, and each package's page shows exactly which checks passed, which failed, and why.
Why "Plumb"?
A plumb line is the oldest verification instrument — a weight on a string, used since antiquity to test whether a wall, post, or structure is truly vertical. The verb "to plumb" means to test for trueness, sound for depth, or measure soundness.
That's exactly what this project does: mechanically test whether a package is built true and aligned with sound practices, against fixed reference points — not opinions, not social signals.
What Plumb is not
Plumb is not a static analyzer — it doesn't read a package's source looking for bugs. It's not a replacement for composer audit — it complements vulnerability scanning rather than duplicating it. And it's not a code quality tool: it looks at hygiene signals, not style.
Learn more
The scoring page explains the categories, weights, and how checks combine into a score. The checks page lists every check in plain language, with a guide to doing well on the practice each one measures. Scores are also available programmatically through a free public API. See the API reference for endpoints and response shapes, and the API usage guidelines for caching, rate limits, and attribution. AI coding agents can ask for scores directly through the MCP server.