rust-crate-discovery
Discover, evaluate, score, and compare Rust crates for adoption — search crates.io, fetch metadata from 4 sources (crates.io API, docs.rs, GitHub API, RustSec advisory DB), apply a weighted 0-100 scoring model across adoption/maintenance/documentation/maturity/community/license, flag red concerns (unmaintained, advisories, no docs, single-maintainer), and recommend the best fit. Use when users ask "which crate should I use for X", "is this crate maintained/safe/popular", "compare these 3 crates", or need to pick a dependency before adoption; hand post-adoption governance (cargo-deny, license policy, advisory response) to rust-dependencies, semver and breaking-change classification to rust-semver, and manifest mechanics to rust-cargo-build.
- Installs
- 100
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/full-stack-skills/rust-skills --skill rust-crate-discovery- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads rust-crate-discovery automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Rust Crate Discovery and Evaluation
Authority: crates.io API, docs.rs, GitHub REST API, RustSec Advisory Database.
This skill owns the discovery + evaluation phase before a crate enters your Cargo.toml. It uses a bundled Python tool (scripts/crate_eval.py) to fetch signals from 4 sources and produce a weighted 0-100 score with a letter grade (A/B/C/D/F), red-flag list, and a recommendation. It does not own post-adoption governance (rust-dependencies), manifest mechanics (rust-cargo-build), or semver (rust-semver).
Capability Boundaries
✅ Strengths
- Search crates.io by keyword, category, or name — returns ranked candidates
- Evaluate a single crate in depth: fetch metadata from crates.io + docs.rs + GitHub + RustSec
- Compare 2+ crates side-by-side with subscore breakdown
- Score each crate 0-100 across 6 dimensions: adoption (30), maintenance (25), documentation (15), maturity (15), community (10), license (5)
- Flag red concerns: stale, advisories, no docs, low adoption with churn, single-maintainer bus factor, no source repo, license missing
- Recommend the best fit, surfacing blocking concerns before the user adopts
- Output as human-readable report or machine-readable JSON (for agent consumption)
⚠️ Prerequisites
- Network access (the tool fetches from crates.io, docs.rs, GitHub, RustSec)
- Python 3.9+ (no external pip packages — stdlib only)
❌ Out of Scope
- Post-adoption governance (cargo-deny config, license policy, advisory response workflow) →
rust-dependencies - Cargo.toml field semantics →
rust-cargo-build - Semver and breaking-change classification →
rust-semver - Which std type to use instead of a crate →
rust-stdlib
Data Privacy
This skill makes outbound HTTP requests to crates.io, docs.rs, GitHub, and RustSec. The User-Agent identifies the tool. No user data is collected or transmitted beyond the crate name in the URL path (which is public registry data). For private/proprietary crate names, prefer manual review.
The Evaluation Tool — scripts/crate_eval.py
A stdlib-only Python script. Three subcommands:
# Search candidates
python3 scripts/crate_eval.py search "orm"
python3 scripts/crate_eval.py search "http client" --limit 5
python3 scripts/crate_eval.py search "logging" --category "development-tools::debugging"
# Evaluate one crate in depth
python3 scripts/crate_eval.py eval rbatis
python3 scripts/crate_eval.py eval rbatis --json # machine-readable
python3 scripts/crate_eval.py eval rbatis -v # show raw signals
python3 scripts/crate_eval.py eval rbatis --skip-github # faster, less signal
# Compare multiple candidates
python3 scripts/crate_eval.py compare rbatis diesel sea-orm sqlx
Workflow
- Search —
search "<domain keyword>"to surface candidates. Inspect the top 5-10 by downloads and recency. - Shortlist — pick 2-4 names with non-trivial adoption (≥1k downloads) and recent activity.
- Compare —
compare <names...>to get the side-by-side scorecard. - Investigate red flags — for the top pick, read the red-flag list. Block on security advisories; investigate stale or single-maintainer concerns.
- Verify fit — the score measures health, not fitness. Read the crate's docs, check its API shape (
rust-api-designlens), confirm it covers your use case. - Hand off — once adopted, set up
cargo-deny(rust-dependencies) and pin version policy (rust-semver).
Reading the output
=== rbatis === A (92/100) — RECOMMENDED — strong fit, low risk
version 4.9.6 | 657,356 downloads (19,938 recent) | license: Apache-2.0
Subscores:
adoption █████████████░░░░░░░░░░░░ 27/30
maintenance ████████████░░░░░░░░░░░░░ 25/25
...
Red flags:
! license not declared
- Grade + score — at-a-glance health
- Subscores — which dimensions are strong/weak
- Notes (
+) — positive signals - Red flags (
!) — concerns to investigate before adopting - Recommendation — verdict (RECOMMENDED / LIKELY SUITABLE / ACCEPTABLE / CAUTION / BLOCK / RISKY)
Scoring Model
| Dimension | Max | What it measures | Key signals |
|---|---|---|---|
| Adoption | 30 | Is anyone using this? | all-time downloads, recent (90-day) downloads |
| Maintenance | 25 | Is it actively maintained? | last crates.io update, version count, GitHub last commit |
| Documentation | 15 | Can users learn it? | docs.rs build, description, docs URL, repo link |
| Maturity | 15 | Is the API stable? | age, stable version ≥1.0, has repo |
| Community | 10 | Is there a contributor base? | GitHub stars, contributors |
| License | 5 | Is it permissive? | permissive (MIT/Apache/BSD) preferred; copyleft penalized |
| Total | 100 |
Grade bands
| Grade | Score | Meaning |
|---|---|---|
| A | ≥85 | Excellent — recommended |
| B | 70-84 | Good — likely suitable |
| C | 55-69 | Acceptable — verify fit |
| D | 40-54 | Risky — investigate before use |
| F | <40 | Avoid — significant concerns |
See references/scoring-rubric.md for the full formula and signal weights.
Red Flags Catalog
The tool surfaces specific concerns. Always read these before adopting.
| Flag | Severity | Action |
|---|---|---|
| RustSec advisory | Block | Pin to fixed version or pick alternative |
| No release in >12 months | High | Check if abandoned; consider fork or alternative |
| Last GitHub commit >6 months | High | Activity may have moved elsewhere |
| No docs.rs build | Medium | API docs may be missing; check manually |
| License not declared | Medium | Treat as proprietary; cannot use without clarification |
| Low adoption with many versions | Medium | Churn without traction; investigate quality |
| Pre-1.0 with 20+ versions | Medium | API likely unstable across minor bumps |
| Single maintainer + low adoption | Medium | Bus factor risk; consider backing up or forking |
| No source repository | High | Cannot audit; avoid |
See references/red-flags.md for the full catalog and decision guidance.
Decision Shortcuts
| Question | Answer |
|---|---|
| Which crate for X? | search "X", then compare top 3-4 |
| Is this crate safe? | eval <name>; check red flags for advisories |
| Is it maintained? | eval <name>; check maintenance subscore + last update |
| Is the API stable? | eval <name>; check maturity subscore + version ≥1.0 |
| What's the license? | eval <name>; appears in signals |
| A vs B vs C? | compare A B C; pick highest score without blocking red flags |
| Score says A but it doesn't fit my use case | Trust the fit check over the score — score measures health, not fitness |
When the score is misleading
- Niche crates — a domain-specific crate may have low downloads but be the only option. Score will understate; rely on manual review.
- New crates — recent releases have low adoption signals; check maintainer track record instead.
- Forks — a fork may have few downloads but be the maintained successor. Check the parent crate's status.
- Internal/private crates — not on crates.io; this tool won't help. Use manual review.
Resources
- Scoring Rubric — full formula, log-scale parameters, subscore breakdowns
- Red Flags Catalog — full flag list with severity and action
- API Endpoints Reference — the 4 data sources and their endpoints
- Evaluation Workflow Examples — worked scenarios (ORM choice, HTTP client, logging)
scripts/crate_eval.py— the evaluation tool (run withpython3)
Upstream Sources
- crates.io API — search, crate metadata, version downloads
- docs.rs — documentation build status, version presence
- GitHub REST API — stars, contributors, last commit, open issues
- RustSec Advisory Database — known vulnerabilities
- crates.io-index — registry index (alternative to API)
FAQ
What does the rust-crate-discovery skill do?
Discover, evaluate, score, and compare Rust crates for adoption — search crates.io, fetch metadata from 4 sources (crates.io API, docs.rs, GitHub API, RustSec advisory DB), apply a weighted 0-100 scoring model across adoption/maintenance/documentation/maturity/community/license, flag red concerns (unmaintained, advisories, no docs, single-maintainer), and recommend the best fit. Use when users ask "which crate should I use for X", "is this crate maintained/safe/popular", "compare these 3 crates", or need to pick a dependency before adoption; hand post-adoption governance (cargo-deny, license policy, advisory response) to rust-dependencies, semver and breaking-change classification to rust-semver, and manifest mechanics to rust-cargo-build.
How do I install rust-crate-discovery?
Run npx skills add https://github.com/full-stack-skills/rust-skills --skill rust-crate-discovery in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/rust-crate-discovery/ (personal) or .claude/skills/rust-crate-discovery/ (project).
Which AI agents can use rust-crate-discovery?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is rust-crate-discovery safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains rust-crate-discovery?
It is published by full-stack-skills in full-stack-skills/rust-skills. It has 100 recorded installs.
More from full-stack-skills/rust-skills
rust-testing
full-stack-skills/rust-skills
Design, implement, and validate Rust tests, including unit, integration, doctest, compile-fail, property, fuzz, benchmark, coverage, async, concurrency, process, daemon, IPC, terminal, platform, and hardware-facing test strategies. Use when users ask for Rust test architecture, flaky-test diagnosis, coverage gates, benchmarks, trybuild, cargo-nextest, real-process tests, or failure-path verification.
rust-concurrency
full-stack-skills/rust-skills
Design, implement, diagnose, and test Rust concurrency and parallelism with threads, Send and Sync, locks, atomics, channels, Tokio, Rayon, Crossbeam, bounded backpressure, actor ownership, task supervision, graceful shutdown, runtime diagnostics, and Loom model tests. Use when users ask about shared state, deadlocks, async tasks, CPU parallelism, high concurrency, daemon resource budgets, slow consumers, worker pools, lock-free structures, or concurrent correctness.
rust-style-clippy
full-stack-skills/rust-skills
Open the skill to read its SKILL.md instructions.
rust-performance
full-stack-skills/rust-skills
Measure, profile, optimize, and regression-test Rust performance across latency, throughput, CPU, allocations, memory, binary size, and compile time using representative workloads, Criterion, iai-callgrind, cargo-flamegraph, samply, DHAT, heap or pprof tools, cargo-bloat, cargo-llvm-lines, and build timings. Use when users report slow Rust code, high memory or CPU, large binaries, noisy benchmarks, tail-latency regressions, or need performance budgets and evidence-backed optimization.
rust-code-review
full-stack-skills/rust-skills
Review Rust changes for correctness, memory and thread safety, error semantics, unnecessary allocation or cloning, lock scope, API compatibility, test gaps, documentation, and dependency risk, applying the Rust API Guidelines checklist (C-PANIC, C-UNWRAP, C-TRANSMUTE, C-BOOL, C-NEWTYPE, C-COMMON-TRAITS, C-CONVERT, C-SEALED, C-NON-EXHAUSTIVE). Use when reviewing Rust diffs, pull requests, libraries, unsafe boundaries, or production incidents; report actionable findings by severity before summaries, route automated formatting or lint policy to rust-style-clippy, and route API shape decisions (trait sealing, error taxonomy, newtype design, builder patterns) to rust-api-design.
rust-cargo-build
full-stack-skills/rust-skills
Open the skill to read its SKILL.md instructions.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.