Every number here, you can check yourself.
8,348 lifetime installs against 7 GitHub stars, measured from pypistats.org and the GitHub API and dated. The gap between those two numbers says the most, so it has a section of its own. There are no customer logos here, because there are no customers yet.
The PyPI and GitHub figures were measured on : a scheduled job fetches them twice a week and commits them with that date, because this build runs offline and does not re-measure them. The reproduction count is kept by hand, from the register at /verification.
Distribution, with every qualifier attached
Each number says what it counts and what it does not. A download count is quoted with its mirror share, because without it the count flatters.
- PyPI downloads, lifetime
- 8,348Excluding mirrors. Including them the figure is 29,982 — the gap is infrastructure, not people.Source: pypistats.org · measured 1 November 2026
- PyPI downloads, last 30 days
- 686Excluding mirrors. Most of this is automated: CI runners and dependency resolvers reinstall on every job.Source: pypistats.org · measured 1 November 2026
- GitHub stars
- 7A star is the cheapest possible signal of human interest.Source: github.com/provael/provael — stargazers · measured 1 November 2026
- GitHub forks
- 0Nobody has forked the repository. A fork is roughly the cheapest signal that someone intends to change or extend the tool.Source: github.com/provael/provael — forks · measured 1 November 2026
- Third-party reproductions
- 0Nobody outside the project has reproduced a published result, and the register is empty.Source: The register at /verification · kept by hand
1,193 installs per star
8,348 downloads against 7 stars is roughly 1193 installs per star. This page reads that ratio as a diagnosis of where the downloads come from.
1193:1 says most installs are automated — CI runners, dependency resolvers and mirrors re-fetching the package — rather than people choosing the tool, and that the human network around the project is small. There is no published benchmark for what a "healthy" installs-per-star ratio is, and this page does not invent one; the ratio is stated so the download count cannot be read as adoption.
72% of all-time downloads are mirror traffic, which points the same way.
| Signal | Count | What it takes from a human |
|---|---|---|
| Installs, all time (no mirrors) | 8,348 | Often nothing — a CI job or resolver can produce these unattended. |
| Installs, all time (incl. mirrors) | 29,982 | Nothing. 72% of this is infrastructure copying the package. |
| Installs, last 30 days | 686 | Same caveat as the lifetime figures above: mostly automated, over a shorter window. |
| GitHub stars | 7 | One deliberate click by one person. The cheapest human signal there is. |
| Published third-party reproductions | 0 | Hours of someone else's compute and attention. The most expensive signal, and the one that would count most. |
CI-gate installs, and why there is no number
The published GitHub Action is the most interesting adoption signal this project could have: it means someone wired a red-team gate into a pipeline and left it there. There is no count for it here because there is no honest way to measure it. GitHub publishes no per-repository usage figures for an Action, and the tool has no telemetry by design, which is the same property that makes the architecture claim on /trust true.
A number could be estimated from download patterns. It is not, because an estimate shown beside measured figures reads as measured.
The signal that counts most is at zero
Installs are the cheap signal. The expensive one, an independent party reproducing a published result and publishing what they got, sits at 0. The register and the bar a reproduction has to clear are at /verification, and a result that contradicts ours is as welcome as one that confirms it. To measure your own policy instead, /submit is the four-step path onto the board.
Nothing on this page is a customer reference, a testimonial or an endorsement. Provael has zero published case studies (stated on /case-studies too) and zero independent verifications. These are distribution figures for an open-source package and nothing more.