Plumb

Plumb is a hosted service that scans PHP packages from Packagist and produces transparent, mechanically-verifiable scores across three dimensions: Security, Maintenance, and Ecosystem Health. Its guiding question is simple — "Is this package built true?" Rather than leaning on social proxies like GitHub stars or maintainer reputation, every score traces down to individual checks measuring something observable in a package's code, configuration, metadata, or activity history.

Built with Laravel, Livewire, and Filament on PostgreSQL, Plumb runs an attribute-driven, auto-discovered registry of checks organized by category. A consolidated fetch phase lets each check declare the external data it needs (Packagist, the GitHub API, release archives), which the scanner dedupes into a single request per package — and it even runs Composer's own dependency solver in-process to verify genuine framework co-installability. Scan history records only changes, and every result is explainable down to the check that produced it.

Plumb exposes a public JSON API and embeddable scorecard badges, with a companion Composer plugin planned as the next milestone. The name comes from the plumb line — the oldest verification instrument — used since antiquity to test whether a structure is truly built. That's exactly what Plumb does for your dependencies: measurements, not opinions.