What Libraries.io does

Libraries.io is a free, API-first open source package discovery and monitoring platform that aggregates metadata from 32 package managers spanning 11.55 million packages across ecosystems including npm, PyPI, Maven, Go, NuGet, Packagist, Cargo, Rubygems, and dozens of long-tail languages. The service scrapes publicly available package information from the internet and exposes it through a searchable web interface and a REST API (60 requests/minute for registered users, with authentication via api_key). Core capabilities include cross-package-manager search, package monitoring and release notifications, dependency tracking, and dependent repository discovery. Users authenticate via OAuth through GitHub, GitLab, or Bitbucket.

The business model is freemium at the Libraries.io layer with a separate paid add-on routed through Tidelift. Libraries.io itself is free; users with enterprise-grade needs are referred to The Tidelift Subscription, which provides curated, human-validated package data, CVE vulnerability insights, maintainer attestations, and SLA-backed API access. Libraries.io is privately held, was founded in 2015 by Andrew Nesbitt, and is currently undergoing acquisition by Tidelift, Inc., which itself is under a definitive agreement to be acquired by Sonar. The codebase is open source under AGPLv3 and its data is published under CC-BY-SA 4.0.

Name

Libraries.io

Legal name

Libraries.io

Website

https://libraries.io

Company type

Private

Founded year

2015

Operating status

Operating

Short description

Libraries.io is a free, open source package monitoring and discovery platform that aggregates metadata from 11.55 million packages across 32 package managers, serving developers and open source maintainers via web search and a rate-limited API.

Ownership category

akta.pro rank

Product category

Open Source Package Intelligence

NAICS

Web Search Portals, Libraries, Archives, and Other Information Services (5192), Web Search Portals and All Other Information Services (519290)

SIC

Services-Computer Processing & Data Preparation (7374)

akta.pro primary industry

Library Collections & Cataloging Services (Acquisitions, Metadata, Circulation) (EDAEAGAE)

Keywords

• Open source package monitoring
• Package metadata aggregation
• Dependency tracking platform
• Developer package discovery
• Package manager search

GTM type

B2C

Offering type

Software

Cost components

Technology or R&D, Infrastructure, Operations, Personnel

Revenue model

1. Free tier with API access: Libraries.io is a free service that provides basic API access to registered users with a rate limit of 60 requests per minute.
2. Tidelift partnership referral: Larger scale access to package data is monetized through Tidelift's paid subscription service, which Libraries.io promotes as its premium offering for enterprise customers requiring curated, validated package data.

Pricing tiers

Go-to-market motion1 record

Distribution channels1 record

Marketing channels2 records

Core offering

Libraries.io is a free web platform that scrapes and aggregates open source package metadata from 32 different package managers into a single index of more than 11.5 million packages. It provides cross-package-manager search by license, language, and popularity, package release monitoring, dependency tracking, and a free REST API (60 requests/minute) for developers. Enterprise customers requiring curated, validated data are referred to Tidelift's paid subscription service.

Product overview

Libraries.io operates as a unified open source package monitoring platform that provides free access to its core service and a paid upgrade through the Tidelift Subscription. The core Libraries.io platform monitors over 11.5 million packages across 32 package managers (including npm, PyPI, Maven, Go, NuGet, Cargo, Rubygems, and others) by scraping publicly available package metadata, offering search and API access. The companion Tidelift Subscription provides enterprise-grade curated data with human-validated accuracy, CVE vulnerability insights, and maintainer payment programs for secure development practices.

Differentiator

Problem solved

Functional benefit

Products and services

• Libraries.io platform A free web platform that scrapes and aggregates publicly available open source package metadata from 32 different package managers (npm, PyPI, Maven, Go, NuGet, Packagist, Cargo, Rubygems, CocoaPods, and others) into a single index of 11,553,509 packages, providing search by license, language, popularity, and trend; package release monitoring and notifications; and dependency and dependent-repository tracking. Targeted at open source developers and maintainers.
• Libraries.io API

Segments2 records

Ideal customer profiles2 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration35 records

Feature3 records

Partnerships

One partnership is on record.

• TideliftcoreStrategic or Co-development PartnerLibraries.io is being acquired by Tidelift, Inc. Libraries.io promotes Tidelift as its premium paid offering for customers needing more complete and accurate package data. Tidelift provides curated, human-validated package data with extensive API access, enterprise support, and SLA guarantees as an alternative to Libraries.io's scraped data approach.

Scale indicators3 records

Recent moves5 records

Expansion highlights8 records

Broad incumbents

• GitHub Dependabot: Dependabot, integrated into GitHub, automatically monitors repositories for outdated or vulnerable dependencies and creates pull requests to update them. Comparable as a dependency monitoring and update automation tool across the same package ecosystems.
• Sonar (SonarQube): Sonar offers SonarQube code quality and security analysis; it is acquiring Tidelift and therefore indirectly absorbing Libraries.io. Comparable as a broader incumbent extending into open source dependency and security analysis.
• FOSSA: FOSSA provides open source license compliance and security scanning for dependencies across many package managers. Comparable as a broad incumbent in OSS dependency management with similar ecosystem coverage.
• Sonatype Nexus: Sonatype operates the Nexus platform and the Central Repository (Maven Central), offering open source dependency analysis, security scanning, and repository management. Comparable as a broader incumbent in OSS component intelligence with both data and tooling.
• Mend (formerly WhiteSource): Mend offers open source license compliance and security vulnerability management across multiple language ecosystems. Comparable as a broader incumbent focused on OSS dependency intelligence and enterprise compliance workflows.
• Snyk Open Source: Snyk provides developer-first open source security scanning, dependency vulnerability detection, and license compliance across multiple package ecosystems. Comparable as a larger incumbent in the open source security and dependency intelligence space.

Direct peers

• Tidelift: Tidelift offers a curated, human-validated open source package data subscription covering the same package ecosystems as Libraries.io, including license, vulnerability, and maintenance insights. It is the direct paid counterpart and current acquirer of Libraries.io.

Emerging players

• Socket.dev: Socket focuses on supply chain security for open source packages, scanning dependencies for risks across npm, PyPI, and other ecosystems. Comparable as an emerging player in package-level security intelligence and dependency risk.
• deps.dev: deps.dev, operated by Google, provides cross-ecosystem open source package metadata, dependency graphs, and security advisories. Comparable as a multi-ecosystem package discovery and intelligence platform competing in the same space.

Regional players

• npm Registry: npm is the primary registry for JavaScript/Node.js packages and provides search, package metadata, and dependency information for the largest single ecosystem Libraries.io covers. Comparable as a native package ecosystem source that Libraries.io aggregates.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat4 records

Key risks5 records

Key highlights5 records

Customer concentration

• GitHubgithub.com/librariesio/libraries.io
• Xx.com/librariesio

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Libraries.io