04 — Benefits
Prometheus is not an investment pitch. There is no legal entity to invest in, no tenants, and no sales — the value is created as a public good.
Stakeholders
Four perspectives on the same data — each role reads the same row with a different question in mind.
Decisions about roadmap, deprecation, and funding currently rely on downloads and intuition.
Supply chain risk today is a list of package names, not a reliable assessment.
Each study currently starts with its own data procurement — not reproducible, not comparable.
Whether an unmaintained library is dangerous depends on how widely it is actually used.
The same published row, read four ways — which columns carry the answer for which role:
"Is version 4 arriving broadly, or is everything still running on 3?"
The same cohort across several windows, split by version_id:
whether a migration is landing reads as a shift between the version rows —
without a data pipeline of your own and without asking users anything.
"How widely used is a dependency that sits in our product?"
project_id is the same PURL that appears in your own SBOM. The
value band gives the order of magnitude — enough to place a risk, too coarse
to infer individual installations.
"Is yesterday's analysis still reproducible tomorrow?"
window_start ties every number to a fixed period, and
source_mode says which capture mode it came from. The snapshot
stays archived, and the public audit log makes what a mirror accepted
checkable.
"How much reach does a library have that nobody maintains anymore?"
Reach and runtime band per version, linkable to OSV and CVE entries through the same PURL. Prioritization follows actual usage instead of download counts.
Compact
The same information for the template — for committees that need it in one line per role.
| Role | What Prometheus provides |
|---|---|
| Maintainers & Foundations |
Evidence for funding applications, roadmap prioritization, and sunset decisions — without having to build your own data pipeline. |
| Software Vendors |
Dependency health snapshots, supply chain early warning, and industry benchmarks, entirely from Open Data. |
| Research & Public |
Reproducible data backbone as daily Parquet and CSV.gz, plus a public audit log. CC-BY-4.0 with Provisional clause until Foundation legal clearance. |
| Security Community |
Prospective reach view on unmaintained libraries and correlation with CVE databases. |
Demarcation
The demarcation is part of the concept, not a later limitation. Existing tools are complemented, not replaced.
Prometheus does not generate bills of materials. It measures usage, not composition — both complement each other.
Vulnerabilities are tracked there. Prometheus provides the reach dimension for this, not the vulnerability itself.