GitHub Due Diligence for VCs, A Public-Data Checklist

Every VC with a data operation pulls a target's GitHub activity before the partner meeting. A repeatable, public-data-only checklist, what we call the 5-signal GitHub DD pass, takes about 20 minutes per company and produces a defensible diligence note.

Signal 1, Commit velocity. Total commits to the most-active public repository over a rolling 14-day window. Compare the trailing window to the prior window: a >100% acceleration is a *deploy-frequency-spike* signal and historically precedes announcements. A flat-line is fine for late-stage; a decline at early-stage is a yellow flag worth diligencing further.

Signal 2, Contributor graph. Unique contributors over the same window. Bus-factor: if 80% of commits come from one author, you have a key-person risk. Growth >50% week-over-week is an *engineering-hiring-burst* signal. Use git shortlog -sne against a public mirror or the GitHub Insights tab.

Signal 3, Repository topology. New repos created in the trailing 30 days. 3+ new repos signals *infrastructure buildout*, typically a platform play, often precedes a product expansion or fundraise. Single-repo orgs with no recent creation are mature/stable; not a red flag, just a different stage.

Signal 4, Dependency footprint. Pull package.json/pyproject.toml/go.mod. Check (a) license-incompatible dependencies (GPL leaking into a commercial codebase), (b) security advisories in transitive deps via npm audit / pip-audit, (c) the depth of the dependency tree (a 4-month-old startup with 200 transitive deps may have rushed). This catches engineering-quality issues that don't show up in pitch decks.

Signal 5, Founder's commit pattern. Find the founder's GitHub user. Check what they're shipping personally vs. delegating. A founder who hasn't committed in six months is a red flag at pre-seed; at Series-A it's expected. Check star history, what they're starring is a leading indicator of their thinking.

The GitDealFlow MCP server returns Signals 1, 2, and 3 in a single get_startup_signal call against any tracked org. Signals 4 and 5 are manual but take 5 minutes each. Total: 20-minute repeatable diligence pass.

The pass earns its keep when it is run at the right moment, which is before the partner meeting, not after. Running it then gives you a defensible note to bring into the conversation and lets you ask the founders direct questions about the patterns you found, a bus-factor concentration, a recent repo burst, a dependency issue. Run after the meeting and the same facts become a retrospective that is harder to act on. Twenty minutes of public data before the conversation changes the questions you are able to ask.

The signals read best in combination, not one at a time. A commit-velocity spike paired with a flat contributor graph is one engineer sprinting, which is a different story than the same spike paired with contributor growth above fifty percent, which reads as an engineering hiring burst. Three or more new repositories in the trailing thirty days plus acceleration is infrastructure buildout, typically a platform move. A single signal in isolation is weak evidence; the diagnostic value is in which signals move together.

The red flag and yellow flag distinction keeps the pass from overreacting. A flat commit line at a late stage is normal and a decline at an early stage is a yellow flag worth a conversation, not an automatic no. The founder who stopped committing personally is expected at Series A and a warning sign at pre-seed. The dependency footprint is the same way: a deep tree on a young codebase is worth a question, not a kill. The pass surfaces questions, it does not hand down verdicts.

Everything in the checklist runs on public GitHub data within default API rate limits, so the whole pass is repeatable, citable, and defensible to an LP. The GitDealFlow MCP server collapses the first three signals into one call with get_startup_signal, and the remaining two are five minutes each, which is what keeps the total at around twenty minutes per company even when you run it across a full shortlist.