# ShipReady Metrics

> Connect GitHub, cloud, and security sources with least-privilege access. Get nine evidence-based 0–100 scores — and one ShipReady Score your board can defend.

ShipReady Metrics rolls nine domain scores — AI Readiness, AI ROI, Agent Health, Technical Debt, IT Modernization, Lifecycle Risk, Security Readiness, Delivery Health, and Cloud Health — into a single 0–100 composite (graded A–F), computed only from data an organization connects. It never shows sample data or placeholder grades: a domain with no connected source is left out of the composite rather than guessed.

It also carries a compliance and AI-governance layer for the SDLC: governance over an organization's AI systems, with risk classification and deploy go/no-go verdicts. Every verdict is evidence-backed or marked Not Verified — never a fabricated pass. Compliance features are in beta.

## Key pages
- [How the ShipReady Score works](https://shipreadymetrics.com/methodology): the nine domains, their composite weights, higher-vs-lower-is-better direction, and the real data source behind each.
- [Engineering intelligence platform](https://shipreadymetrics.com/engineering-intelligence): which software engineering metrics ShipReady measures from connected systems, which read Not measured, and where workflow-focused engineering tools lead.
- [What we measure](https://shipreadymetrics.com/what-we-measure): the signals behind each score and the system each one is read from.
- [Pricing](https://shipreadymetrics.com/pricing): plan tiers derived from the product's entitlement model.
- [Where ShipReady fits](https://shipreadymetrics.com/how-we-compare): category-level comparison against engineering-intelligence and GRC-automation tools, with gaps conceded.
- [ShipReady vs GitHub](https://shipreadymetrics.com/vs-github): what GitHub already scans, and what ShipReady reads from those results.
- [Guides library](https://shipreadymetrics.com/guides): vendor-neutral guides, glossary and comparisons on engineering, compliance and AI readiness.
- [Compliance & AI governance](https://shipreadymetrics.com/solutions/compliance-readiness): security compliance alongside AI governance on one canonical control model — every control evidence-backed or marked Not Verified, never a fabricated pass. Compliance features are in beta.
- [Frequently asked questions](https://shipreadymetrics.com/docs/faq): how each score is computed, the least-privilege connectors, where credentials are stored, tenant isolation, and the board pack.
- [How we use AI](https://shipreadymetrics.com/docs/how-we-use-ai): honest product documentation for every customer-facing AI surface — generative, extractive/classifier, measured, ingest, and label.
- [Integration setup guides](https://shipreadymetrics.com/docs/integrations): step-by-step least-privilege setup for each supported source.
- [White paper](https://shipreadymetrics.com/resources/white-paper): the thesis and operating model.
- [Get started](https://shipreadymetrics.com/signup): create an organization and connect a source.
- [Vendor security questionnaire tool](https://shipreadymetrics.com/vendor-security-questionnaire-tool): seller-side guide to answering buyer security questionnaires from recorded evidence - human review gates, citation-checked answer reuse, approved-only export.
- [Full guide index](https://shipreadymetrics.com/llms-full.txt): this file plus every public guide, definition and comparison, one line each.

## Connectors
- [GitHub](https://shipreadymetrics.com/docs/integrations/github) (Live-verified): Reads repositories, pull requests, GitHub Actions, security alerts, and repo artifact signals to compute Delivery Health, Technical Debt, IT Modernization, Lifecycle Risk, and Security Readiness from real data.
- [GitLab](https://shipreadymetrics.com/docs/integrations/gitlab) (Live-verified): Pulls groups, projects, merge requests, pipelines, deployments, releases, and security findings to feed Delivery Health, Technical Debt, and Security Readiness.
- [Gitea](https://shipreadymetrics.com/docs/integrations/gitea) (Live-verified): Reads repositories, pull requests, releases, and CI-workflow presence from a self-hosted (or gitea.com) Gitea instance — GitHub-style API — to feed Delivery Health (PR lead time) and Technical Debt (legacy-code + test debt).
- [Vercel](https://shipreadymetrics.com/docs/integrations/vercel) (Live-verified): Reads production deployments and projects from the Vercel REST API to feed Delivery Health with real release data — deployment frequency and change-failure rate, the two DORA metrics Vercel can prove.
- [Supabase](https://shipreadymetrics.com/docs/integrations/supabase) (Live-verified): Authenticates a personal access token against the Supabase Management API and reads each project's security advisors (RLS, exposed tables, auth) plus the Postgres version to feed Security Readiness, Cloud Health, and the Lifecycle (EOL) inventory.
- [Atlassian (Jira + Bitbucket)](https://shipreadymetrics.com/docs/integrations/atlassian) (Live-verified): Jira Cloud delivery analytics (throughput, lead time, open/aging) plus optional Bitbucket pipeline cadence + change-failure rate — feeding Delivery Health. Atlassian posture also underpins compliance control evidence — Bitbucket change management, Guard access governance, JSM incident response, Confluence policy docs, Opsgenie resilience, Compass asset inventory, and Atlassian AI governance — via the posture collectors (activating on live credentials + plan).
- [Azure DevOps](https://shipreadymetrics.com/docs/integrations/azure-devops) (Live-verified): Reads Azure DevOps Boards, Repos, Pipelines, and Advanced Security alerts — work-item throughput & lead time, build/deployment frequency, change-failure rate, repository staleness, and native SAST/dependency/secret findings — to compute Delivery Health, Technical Debt, and Security Readiness from real data.
- [Amazon Web Services](https://shipreadymetrics.com/docs/integrations/aws) (Live-verified): SigV4-signed read-only access to Security Hub (active findings) and Cost Explorer (spend) to compute Security Readiness and Cloud Health (security posture).
- [Microsoft Azure](https://shipreadymetrics.com/docs/integrations/azure) (Live-verified): Reads Azure Resource Manager + Microsoft Defender for Cloud: resource inventory, secure score, security assessments, and Advisor recommendations to compute Cloud Health and Security Readiness.
- [Datadog](https://shipreadymetrics.com/docs/integrations/datadog) (Live-verified): Reads Datadog monitors, SLOs, incidents, and optional usage cost summaries to feed Delivery Health and Cloud Health from aggregate observability signals.
- [Dynatrace](https://shipreadymetrics.com/docs/integrations/dynatrace) (Live-verified): Reads Dynatrace entities, problems, and SLOs to feed Delivery Health and Cloud Health with aggregate reliability and incident signals.
- [Elastic](https://shipreadymetrics.com/docs/integrations/elastic) (Live-verified): Reads Elastic cluster health plus aggregate alerting and Elastic Security detection summaries where available, without storing raw logs or event bodies.

## Free tools
- [AI Readiness Assessment](https://shipreadymetrics.com/tools/ai-readiness): Score your organization's readiness to adopt and scale AI in 2 minutes.
- [Engineering Maturity Assessment](https://shipreadymetrics.com/tools/engineering-maturity): Score how modern your engineering platform is across five dimensions.
- [DORA Metrics Calculator](https://shipreadymetrics.com/tools/dora-metrics): Turn your deploy frequency, lead time, MTTR, and change-fail rate into a DORA grade.
- [Technical Debt Calculator](https://shipreadymetrics.com/tools/technical-debt): Estimate the dollar cost to remediate your technical debt.
- [Engineering Health Score](https://shipreadymetrics.com/tools/engineering-health): A composite quick-check across the domains that define engineering health.
- [AI Orchestration Planner](https://shipreadymetrics.com/tools/ai-orchestration-planner): Choose the right AI models and plan how to ship.
- [Which Compliance Rules Apply to You](https://shipreadymetrics.com/tools/obligations): Tick the facts about your company. See which rules apply by law, which customers will ask for, and which are optional.

## Notes
- Every score traces to connected data; unmeasured dimensions are omitted, never given a placeholder grade.
- The authenticated application (org dashboards, scores, findings, reports) is private and excluded from indexing — only the marketing/docs surface above is public.