Is It Dead Yet? dependency vitals

Is that dependency still maintained?

5,067 packages across npm, PyPI, crates.io and Go, watched for the three things that quietly break a project: abandonment, licence changes, and deprecation.

i
A package name, or the start of one. Pick a registry to narrow it, or leave any and every match is listed — django on npm and on PyPI are two rows. A Go module is its import path, like github.com/gorilla/mux. No match? You can ask for the package to be judged.

Recently judged

The six verdicts

What triggers each verdict
VerdictTrigger
active A commit in the last 90 days.
coasting No commits for 90–365 days, with nothing else deteriorating.
finished No commits for over 365 days, and almost nobody filing new issues — or the README says the project is done.
drifting No commits for 180–365 days plus a deterioration signal: unanswered issues rising, maintainers down to one, or issue response time doubling.
abandoned No commits for over 365 days with unanswered issues piling up — or the registry marks it deprecated, or the repository is archived.
dead The repository is archived and the registry marks it deprecated, or the package has been removed from the registry.

An issue counts as unanswered once it has gone 14 days without a reply. Nothing changes verdict on a single bad day either: a new state has to hold across two crawls at least 7 days apart before we act on it. The exceptions are facts rather than inferences — an archived repository or a registry deprecation counts immediately.

Why this is hard

Telling finished apart from abandoned is the whole job. A small library that has nothing left to do is not a risk, and calling it one is how a tool like this loses your trust — so when the evidence is ambiguous we say drifting rather than cry abandonment.

Follow along

Subscribe to the feed and your reader tells you when a package goes quiet, changes licence, or comes back from the dead.

Or one ecosystem at a time: npm feed · PyPI feed · crates.io feed · Go feed

Use it from your tools

Everything on this site is also a set of tools for an AI client over the Model Context Protocol: look up a package, check a manifest, search, and what changed lately. Claude Code, Claude Desktop, Cursor — anything that takes an MCP server. 

claude mcp add --transport http is-it-dead-yet https://isitdeadyet.dev/mcp   --header "Authorization: Bearer <the instance's MCP_TOKEN>"

Then ask it: is request still maintained, and what should I use instead? — or paste a package.json and ask what is rotting. On the machine that holds the database, node dist/mcp.js serves the same tools over stdio with no token.

From a terminal or a CI step: npx iidy scan reads the manifest in the current directory, prints every dependency worst first with its release line, and exits 1 on a dead or abandoned one — the same report as the box below, over POST /api/report.

Check a whole project

Paste a package.json, requirements.txt, pyproject.toml, Cargo.toml or go.mod — or just names, one per line, saying which registry: pypi:django, npm:django, crates:serde, go:github.com/gorilla/mux. No account, nothing stored but the list of names, and you get a link you can share.

i
Paste the whole file: package.json, requirements.txt, pyproject.toml, Cargo.toml or go.mod. Or one package per line with its registry in front — pypi:django, npm:django, crates:serde, go:github.com/gorilla/mux — and a version after a space if you like. Bare names are read as PyPI packages. Up to 512 KB; nothing is kept but the names.