Methodology
Every tool carries a way.space signal summary, a grade from A+ to D derived from public evidence about the project. It is not a user rating, and it is not a safety certification. It is a summary of what we could measure, plus an honest account of what we could not.
Read this first
What it is
What it is not
The model
The grade is a weighted average of five components. Each one either reports a value or abstains, and an abstain is never scored as a zero (see below). Identity reads curated provenance — who released the tool and who built it — never a security review.
Measures. Repository health: contributor breadth and bus-factor, commit recency and cadence, issue close ratio, release cadence, log-damped stars, and how many public repos depend on the published package.
Does not measure. Whether the code is safe, correct, or fit for your use. A well-maintained repo can still be the wrong tool, and a quiet repo can be finished rather than abandoned.
Measures. Whether the people or organization behind this tool are known and verified: a curated, source-cited notable organization the tool is released under, or a notable person curated as its creator, founder, author, or maintainer. The strongest single piece of evidence sets the value; attributions never add up.
Does not measure. Whether an unattributed tool is untrustworthy, or whether a known name makes a tool safe. Most tools in the catalog have no curated attribution yet, which says nothing about them, so the component abstains for those rather than scoring zero. Provenance says who, not safe: it is never a security review, and it never affects who may post on way.space.
Measures. Whether registries that list this tool report a third-party scan of it, how many distinct sources do, and how recently we last confirmed those reports.
Does not measure. What a scan found. way.space counts and dates scans; it never re-judges them, and a scan is not a safety certification. A tool with no scan data has not failed anything — nobody has looked.
Measures. How long since the tool last shipped — its newest release or commit — measured against the release cadence expected of its kind, plus whether a registry has recently confirmed it is still listed.
Does not measure. Whether a quiet project is abandoned. Some tools are finished. Freshness reports elapsed time against an expectation; it does not read intent.
Measures. Recommends from builders who passed the credibility gate (weighted by their grade), activity in the tool’s gated forum, and Hacker News stories that point at the tool itself.
Does not measure. Popularity, quality, or a user rating. way.space has no 1–5 ratings by design, and a quiet tool with no recommends has not been judged — nobody has weighed in yet.
A component that has nothing to go on abstains. Its weight is removed from the average and the remaining components are re-weighted, so a missing signal neither drags a tool down nor props it up. A tool nobody has scanned has not failed a scan. Nobody has looked.
If less than 50% of the total weight could be measured, the tool’s page says the score is based on limited signals. The number still computes, and the honesty lives in what we tell you about it.
Identity and Community can only add to a score
Two signals are thin by nature. Very few tools have any recommends or forum activity yet, and only about one tool in ten carries a curated attribution to a notable organization or person. A signal that thin should not be able to take points away: being the first tool somebody vouches for, or having a maintainer we happen to know, would otherwise cost a grade band. So we floor the score at what it would be with Identity and Community abstaining: each of them is folded into the average only when it raises it — a value that merely matches the rest of the model is left out, because it would not have moved the number — and the published score is then held at that floor whatever the arithmetic does. The most either can do is nothing, and anything it does is upward. We will say so here when that changes.
Freshness expects different things of different tools
A harness that hasn’t shipped in three months is behind the churn it wraps. A blueprint quiet for the same period is probably finished. Expected release intervals:
90–100
80–89
65–79
45–64
0–44
Some tools carry no grade at all: a hosted app with no public repo, or a brand-new entry the scorer hasn’t reached. An unscored tool is never treated as a low-scoring one.
Changelog
Weights move the grade of every tool in the catalog, so each change is recorded here. Current model version: v2.1.0.
Code stays the largest single input because it is the only component with dense, independently verifiable data today. Identity and Audits are weighted above Freshness and Community because verified publisher identity and third-party scan presence are the hardest signals to manufacture; popularity is the easiest, so Community is deliberately the smallest.
A prod read of all 1,067 catalog tools showed the old thresholds were guessed for a catalog we do not have: 11 tools have any recommend at all (strongest mass 2.0, which the old curve scored 0.43) and 4 have any forum activity (max 3 posts). The new thresholds sit about 2× above the strongest observed signal, so the leaders read high with room to grow. Separately, a component this sparse must not be able to subtract: the assembly now floors the score at what it would be if Community abstained, because a first recommend from one B-grade builder previously cost a healthy tool a grade band (87/A → 75/B) — punishing the very act the credibility gate exists to encourage.
Identity had abstained for every tool since v2 shipped, waiting on verified publisher claims. It now reads its first evidence source: the curated registry of notable organizations (a tool released under the GitHub org of Google, Microsoft, LangChain, NVIDIA, OpenAI, Anthropic and the other hand-verified entries) and the curated notable people attached to a tool as its creator, founder, author, or maintainer. Both are editorial, cited, and never inferred by a job. The values are capped at 0.8 (a verified organization) and 0.6 (a creator) because provenance says who, not safe. Weights are unchanged, and Identity is bonus-only: a tool with no attribution keeps the score it had, and a tool with attribution can only move up, by at most its 0.20 share.