Repo brief: osohq/oso

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T16:18:18.828Z · commit 7292df01679c

Verdict

Mixed — Stale — last commit 2y ago

• 30+ active contributors
• Distributed ownership (top contributor 21% of recent commits)
• Apache-2.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

Oso is a deprecated but maintained authorization framework that provides declarative policy language (Polar) and batteries-included primitives for role-based access control (RBAC), relationship-based permissions, and collection filtering. It compiles to a Rust core (polar-core) that is exposed via language bindings for Python, JavaScript/Node.js, Go, Ruby, and Java, allowing developers to write authorization logic once and reuse it across polyglot services. Monorepo managed by Cargo (Rust workspace in Cargo.toml) with polar-core as the central engine compiled to C via polar-c-api and polar-wasm-api, and language-specific bindings in languages/{rust,python,go,java,ruby,node}. Each language…

Start here

Open these first:

• README.md — Declares the library deprecated but actively maintained; required reading for all contributors to understand project status…
• Cargo.toml — Rust workspace root defining core members (polar-core, polar-c-api, polar-wasm-api) and build profiles; essential for…
• languages/go/oso.go — Go language binding entry point for the Oso authorization framework; primary interface for Go developers.
• languages/java/oso/src/main/java/com/osohq/oso/Oso.java — Java language binding entry point providing the main authorization API; core class for Java integration.
• languages/js/src/Oso.ts — TypeScript language binding entry point for JavaScript/Node.js environments; primary authorization interface for JS…

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

No setup instructions are safely inferred from the data provided. The README references external docs (docs.osohq.com) and the repository lists a Makefile at the root. Before attempting any local development, consult Ca…

Daily commands:

Unable to infer exact dev server or REPL commands from the provided data. The root Makefile and language-specific Makefiles (e.g., languages/go/Makefile) likely contain build and test targets. Verify workspace setup in…

…shortened for this brief.

Key cautions & unknowns

• Stale — last commit 2y ago
• Scorecard: marked unmaintained (0/10)
• Deprecation status means the maintainers are not actively developing this version; new features may be rejected in favor of the next-generation release. The monorepo uses Rust Cargo as the primary build tool, but…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.