0.9

Adjusted Signal

0.9

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

9.2K

Stars

TypeScript

Language

1.0M

Lines of Code

2.4K

Files

748

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 651 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.4/100 · LOW

Are imports declared and package/API names verified? 71 finding(s).

Agent Over-Engineering Ratio 2.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 482 finding(s).

PR Review Velocity Impact 4.3/100 · LOW

Which changes need focused human review? 748 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 25MEDIUM 16LOW 707

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 748 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers456 hits · 486 pts

Severity	File	Line	Snippet	Context
LOW	agent-claude-sdk/tests/test_model_mode.py	13	def test_model_mode_disables_native_and_ambient_tools():	CODE
LOW	agent-claude-sdk/tests/test_model_mode.py	76	def test_model_history_keeps_role_labels_and_real_image_blocks():	CODE
LOW⚡	agent-claude-sdk/tests/test_auth_middleware.py	46	def test_the_correct_token_reaches_the_route(app):	CODE
LOW⚡	agent-claude-sdk/tests/test_auth_middleware.py	52	def test_a_wrong_token_is_rejected(app):	CODE
LOW⚡	agent-claude-sdk/tests/test_auth_middleware.py	57	def test_a_missing_token_is_rejected(app):	CODE
LOW⚡	agent-claude-sdk/tests/test_auth_middleware.py	62	def test_a_non_ascii_token_is_rejected_not_a_server_error(app):	CODE
LOW⚡	agent-claude-sdk/tests/test_auth_middleware.py	69	def test_health_stays_exempt_regardless_of_token(app, headers):	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	215	def test_client_result_resumes_original_sdk_query(sdk, streaming, model_only, tool_name):	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	277	def test_parallel_calls_with_identical_arguments_keep_distinct_results(	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	324	def test_unknown_id_cannot_resolve_another_threads_tool(sdk, model_only):	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	360	def test_interrupt_cancels_pending_tool_without_fabricating_a_result(sdk, model_only):	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	374	def test_disconnected_event_consumer_cancels_the_sdk_query(sdk):	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	395	def test_query_timeout_interrupts_sdk_before_abandoning_client_result(sdk, model_only):	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	418	def test_sdk_authentication_signal_is_typed(sdk, model_only):	CODE
LOW	agent-claude-sdk/src/main.py	50	async def refuse_without_the_server_token(request: Request, call_next):	CODE
LOW	agent-strands/tests/test_learning_delivery.py	13	def test_learned_catalog_and_both_read_tools_reach_the_model(monkeypatch):	CODE
LOW⚡	agent-strands/tests/test_model_spec.py	17	def test_the_row_this_bot_runs(monkeypatch):	CODE
LOW⚡	agent-strands/tests/test_model_spec.py	23	def test_environment_beats_the_file(monkeypatch):	CODE
LOW⚡	agent-strands/tests/test_model_spec.py	29	def test_blank_environment_falls_through_to_the_file(monkeypatch):	CODE
LOW	agent-strands/tests/test_main.py	110	def test_model_id_keeps_the_chosen_provider_on_a_name_that_contains_a_slash(	CODE
LOW	agent-strands/tests/test_main.py	150	def test_a_run_sends_a_namespaced_model_name_verbatim(monkeypatch, provider, choice):	CODE
LOW	agent-strands/src/main.py	43	async def refuse_without_the_server_token(request: Request, call_next):	CODE
LOW	extension/src/background/recovery.ts	15	export function recoverInterruptedRecording(): Promise<void> {	CODE
LOW	extension/src/offscreen/index.ts	149	export function createOffscreenController(deps: OffscreenControllerDeps): void {	CODE
LOW	extension/src/shared/storage.ts	266	export async function restrictStorageToTrustedContexts(): Promise<void> {	CODE
LOW	extension/src/pages/popup/recording-view.tsx	213	export function afterStopLearningSentence(	CODE
LOW	app/vite.config.ts	102	export function selectedRouteSplitBehavior({	CODE
LOW	app/tests/bot-route-default-agent.test.tsx	78	function queryClientWithAgentsAndFetchedAgent(	CODE
LOW	app/tests/bot-route-default-agent.test.tsx	94	function queryClientWithFailingAgents() {	CODE
LOW	app/tests/serve.test.ts	266	function startAuthenticatedUpstream(port: number) {	CODE
LOW	app/tests/channel-new-error-state.test.tsx	108	function queryClientWithFailingAgents() {	CODE
LOW	app/tests/channel-new-error-state.test.tsx	122	function queryClientWithHiddenDetail(	CODE
LOW	app/tests/channel-new-error-state.test.tsx	189	async function expectMessageComposerDisabled(	CODE
LOW	app/src/components/ui/questionnaire.tsx	144	function QuestionnaireChoiceDescription({	CODE
LOW	app/src/components/settings/linked-accounts.tsx	99	export function linkedAccountsSectionState({	CODE
LOW	app/src/components/bot-profile/attention.tsx	32	function useAttentionNotifications(bots: BotAttention[] \| undefined) {	CODE
LOW	app/src/components/suggestions/proactive-panel.tsx	212	export function ProactiveResearchSettings({	CODE
LOW	app/src/components/channels/chat-transcript.tsx	434	function ScrollNewestQueuedIntoView({	CODE
LOW	app/src/lib/team-bots.ts	62	export function publishTeamBotMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/team-bots.ts	87	export function unpublishTeamBotMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/team-bots.ts	99	export function assignTeamBotMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/team-bots.ts	127	export function teamBotConsentMutationOptions() {	CODE
LOW	app/src/lib/team-bots.ts	143	export function clearTeamBotConsentsMutationOptions() {	CODE
LOW⚡	app/src/lib/responsibilities.ts	59	export function responsibilitiesQueryOptions() {	CODE
LOW⚡	app/src/lib/responsibilities.ts	69	export function responsibilityRunsQueryOptions(id: string) {	CODE
LOW⚡	app/src/lib/responsibilities.ts	79	export function githubBindingsQueryOptions() {	CODE
LOW	app/src/lib/responsibilities.ts	252	export function createGithubBindingMutationOptions(queryClient: QueryClient) {	CODE
LOW⚡	app/src/lib/responsibilities.ts	264	export function removeGithubBindingMutationOptions(queryClient: QueryClient) {	CODE
LOW⚡	app/src/lib/responsibilities.ts	274	export function createResponsibilityMutationOptions(queryClient: QueryClient) {	CODE
LOW⚡	app/src/lib/responsibilities.ts	281	export function updateResponsibilityMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/responsibilities.ts	295	export function responsibilityActionMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/responsibilities.ts	317	export function createTriggerMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/responsibilities.ts	340	export function revealTriggerSecretMutationOptions() {	CODE
LOW	app/src/lib/responsibilities.ts	345	export function setTriggerSecretMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/responsibilities.ts	359	export function removeTriggerMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/responsibilities.ts	369	export function setTriggerEnabledMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/groups.ts	81	export function sendGroupMessageMutationOptions(	CODE
LOW	app/src/lib/groups.ts	103	export function createGroupMutationOptions(queryClient: QueryClient) {	CODE
LOW	app/src/lib/groups.ts	119	export function addGroupMemberMutationOptions(	CODE
LOW	app/src/lib/groups.ts	138	export function removeGroupMemberMutationOptions(	CODE
396 more matches not shown…

Over-Commented Block166 hits · 162 pts

Severity	File	Line	Snippet	Context
LOW	bunfig.toml	1	[test]	COMMENT
LOW	docker-compose.yml	1	services:	COMMENT
LOW	docker-compose.yml	21	# Loopback, like every other port in this file, and for the reason the network split above	COMMENT
LOW	docker-compose.yml	81	# owns port 3001 while it does. Without the profile, a plain `docker compose up -d` would start a	COMMENT
LOW	docker-compose.yml	101	# container.	COMMENT
LOW	docker-compose.yml	121	# Per-Bot computers too, which is not automatic: the supervisor publishes each on a loopback	COMMENT
LOW	docker-compose.yml	161	OPENBOT_MODEL_OAUTH_FILE: ${OPENBOT_MODEL_OAUTH_FILE:+/openbot/model-oauth.json}	COMMENT
LOW	docker-compose.yml	241	# Loopback only. This process drives a browser holding real logins; COMPUTER_TOKEN is the	COMMENT
LOW	docker-compose.yml	261	# a loopback-bound port; a deployment sets a real value in .env.	COMMENT
LOW	docker-compose.yml	361	- path: ./egress.env	COMMENT
LOW	docker-compose.yml	381	COMPUTER_NETWORK: ${COMPUTER_NETWORK:-}	COMMENT
LOW	docker-compose.yml	401	# the process still listens on every interface inside its own container.	COMMENT
LOW	docker-compose.yml	461	# this file. The image and the port come from `.env`, which the shell writes from the pick, and	COMMENT
LOW	docker/s6/scripts/migrate.sh	1	#!/bin/sh	COMMENT
LOW	docker/s6/scripts/postgres-init.sh	1	#!/command/with-contenv sh	COMMENT
LOW	docker/s6/scripts/postgres-init.sh	21	# The image creates and chowns this at build time, and a volume mounted over /var/lib/postgresql at	COMMENT
LOW	docker/s6/scripts/computer-token.sh	1	#!/bin/sh	COMMENT
LOW	extension/tests/recording.test.ts	3921	});	COMMENT
LOW	extension/tests/support/recorded-text.ts	1	// What a leak check searches: everything a captured event records, without the numbers the clock and a stopwatch put in	COMMENT
LOW	extension/scripts/store-package.ts	1	// The Recorder's two store packages, made from the built Recorder (`bun run build` at the repository root first):	COMMENT
LOW	extension/scripts/agent-traffic/record.ts	1	// Records real AG-UI traffic and what CopilotKit itself emits for it, as the fixtures of the agent events' parity test	COMMENT
LOW	extension/src/manifest.ts	1	export type BuildVariant = "release" \| "e2e";	COMMENT
LOW	extension/src/background/recording.ts	2921	// is used when it becomes the active tab of its window (tabs.onActivated: a click on it, a keyboard switch, OpenBot's	COMMENT
LOW	extension/src/background/steps.ts	1	// A recording is the person's steps: each click, edit, choice, submit, Enter and top-frame page change, in order, so an	COMMENT
LOW	extension/src/background/steps.ts	21	// (create, update, save, delete, send, submit, mark, archive, assign, verify, confirm, redeem). What they typed into	COMMENT
LOW	extension/src/background/agent/thread-agent.ts	1	// One Thread of one agent in one tab, kept the way CopilotKit keeps it inside the page: an AG-UI agent (@ag-ui/client's	COMMENT
LOW	extension/src/background/agent/events.ts	1	// The agent's side of a recording: the AG-UI traffic the network capture observes (observation.ts), turned into exactly	COMMENT
LOW	extension/src/background/agent/agent-event.ts	1	// `agent.event`: the part of each AG-UI event that CopilotKit's own agent events (`agent.run`, `agent.message`,	COMMENT
LOW	extension/src/offscreen/voice.ts	1	// The person's narration, transcribed in this browser with the Web Speech API while they record. It runs in the offscre	COMMENT
LOW	extension/src/content/actions.ts	1	// The Recorder's own steps, for what the collector does not record: Enter pressed in a field (`key`) and a form submitt	COMMENT
LOW	extension/src/main-world/network-hook.ts	1	// The page-level network hook: a classic script the service worker injects into the MAIN world of recorded tabs only,	COMMENT
LOW	app/tests/composer-collapse.test.tsx	101	for (const fire of observers) fire();	COMMENT
LOW	app/tests/composer-collapse.test.tsx	161	test("opening measures the content in the commit that opened it", () => {	COMMENT
LOW	app/src/vite-env.d.ts	1	/// <reference types="vite/client" />	COMMENT
LOW	charts/openbot/Chart.yaml	21	# BUNDLED FOR SOMEBODY TRYING IT, OFF FOR ANYBODY WITH A DATABASE. A deployment with RDS, Cloud SQL	COMMENT
LOW	charts/openbot/values.yaml	1	# OpenBot, on any Kubernetes cluster.	COMMENT
LOW	charts/openbot/values.yaml	121	memory: 1Gi	COMMENT
LOW	charts/openbot/values.yaml	141	# A filter, not a boundary. It is checked against the address the provider returns, and OpenBot	COMMENT
LOW	charts/openbot/values.yaml	161	# `common` is Microsoft's own default and admits personal accounts as well as work ones. A	COMMENT
LOW	charts/openbot/values.yaml	181	# Optional initial defaults; saved Admin → Automatic Learning settings take precedence, including off.	COMMENT
LOW	charts/openbot/values.yaml	201	# An Intelligence service token, which creates Learning containers on a CopilotKit local	COMMENT
LOW	charts/openbot/values.yaml	221	#	COMMENT
LOW	charts/openbot/values.yaml	241		COMMENT
LOW	charts/openbot/values.yaml	261	verifyServiceSid: ""	COMMENT
LOW	charts/openbot/values.yaml	281	enabled: false	COMMENT
LOW	charts/openbot/values.yaml	301	endpoint: ""	COMMENT
LOW	charts/openbot/values.yaml	321	# - name: tenant	COMMENT
LOW	charts/openbot/values.yaml	341	mode: shared	COMMENT
LOW	charts/openbot/values.yaml	361	# WHAT IT BUYS, honestly. It is not a containment boundary against a Bot's own shell: the image	COMMENT
LOW	charts/openbot/values.yaml	381	# agent-sandbox exists to avoid. `OnRootMismatch` runs it once, when the root still says root.	COMMENT
LOW	charts/openbot/values.yaml	401	runAsGroup: 1001	COMMENT
LOW	charts/openbot/values.yaml	421	# (Xvfb, started by the computer), behind the same streamed screen: it is what sites see from a	COMMENT
LOW	charts/openbot/values.yaml	441		COMMENT
LOW	charts/openbot/values.yaml	501		COMMENT
LOW	charts/openbot/values.yaml	521	# is cleared within a day, which is a promise made on this sweep's behalf. With the sweep off, a	COMMENT
LOW	charts/openbot/values.yaml	541	# A ceiling on one sweep, because `concurrencyPolicy: Forbid` turns a hung one into a permanent	COMMENT
LOW	charts/openbot/values.yaml	561		COMMENT
LOW	charts/openbot/values.yaml	581	# This is the shape `docker-compose.yml` already ships, where the app user is the cluster	COMMENT
LOW	charts/openbot/values.yaml	601	tag: 17.6.0-debian-12-r4	COMMENT
LOW	charts/openbot/values.yaml	621	size: 20Gi	COMMENT
106 more matches not shown…

Cross-File Repetition23 hits · 115 pts

Severity	File	Snippet	Context
HIGH	agent-strands/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-ag2/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-adk/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-pydantic-ai/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-microsoft/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-llamaindex/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-agno/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-crewai/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-langroid/tests/test_learning_delivery.py	exercise learned skill reads through the real bundled framework.	STRING
HIGH	agent-strands/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-ag2/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-adk/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-pydantic-ai/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-microsoft/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-llamaindex/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-agno/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-crewai/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-langgraph-agui/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-langroid/tests/test_model_spec.py	the spec file this bot reads, pinned to what this repository decided. `shared/model-providers.json` is one file every la	STRING
HIGH	agent-strands/src/main.py	`provider/model`, which is how litellm addresses one and how openbot stores the choice. the model half is whatever the e	STRING
HIGH	agent-adk/src/main.py	`provider/model`, which is how litellm addresses one and how openbot stores the choice. the model half is whatever the e	STRING
HIGH	agent-llamaindex/src/main.py	`provider/model`, which is how litellm addresses one and how openbot stores the choice. the model half is whatever the e	STRING
HIGH	agent-agno/src/main.py	`provider/model`, which is how litellm addresses one and how openbot stores the choice. the model half is whatever the e	STRING

Fake / Example Data66 hits · 66 pts

Severity	File	Line	Snippet	Context
LOW	extension/src/content/targeting.ts	292	for (const attribute of ["placeholder", "title", "alt"]) {	CODE
LOW	extension/src/content/targeting.ts	734	"placeholder",	CODE
LOW	extension/src/content/actions.ts	45	"placeholder",	CODE
LOW	app/tests/handoff-resume.test.ts	109	id: "placeholder",	CODE
LOW	app/tests/skins-openmuse.test.tsx	683	["aria-label", "alt", "title", "placeholder"]	CODE
LOW	app/tests/channel-pagination.test.tsx	176	email: "user@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	155	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	170	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	192	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	208	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	223	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	230	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	281	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	288	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	299	await store.removeServer(holderId, "admin@example.com");	CODE
LOW	…er/tests/plugin-credential-binding.integration.test.ts	319	by: "admin@example.com",	CODE
LOW	server/tests/voice-routes.test.ts	42	email: "user@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	133	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	148	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	160	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	175	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	183	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	198	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	211	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	227	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	262	addedBy: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	268	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	288	addedBy: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	296	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	313	addedBy: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	319	by: "admin@example.com",	CODE
LOW	server/tests/brokered-app-provider.integration.test.ts	332	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3773	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3891	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3914	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3928	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3937	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3951	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3972	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	3987	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	4008	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	4017	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	4034	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	4359	"admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	5866	"admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	6940	by: "admin@example.com",	CODE
LOW	server/tests/plugin-store.integration.test.ts	6989	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	131	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	152	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	165	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	179	await store.addServer({ key: serverId, by: "admin@example.com" });	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	185	await store.addServer({ key: serverId, by: "admin@example.com" });	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	206	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	240	by: "admin@example.com",	CODE
LOW	…er/tests/plugin-curated-credential.integration.test.ts	253	by: "admin@example.com",	CODE
LOW	server/tests/store-scheme-sites.test.ts	236	by: "admin@example.com",	CODE
LOW	server/tests/store-scheme-sites.test.ts	259	by: "admin@example.com",	CODE
LOW	server/tests/store-scheme-sites.test.ts	272	by: "admin@example.com",	CODE
LOW	shared/demonstration-rules.ts	73	element.getAttribute("placeholder") \|\|	CODE
LOW	shared/recorder-masking.test.ts	993	expect(at(masked, "target", "attributes", "placeholder")).toBe(	CODE
6 more matches not shown…

AI Slop Vocabulary12 hits · 40 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker-compose.yml	131	# already right. The picked harness's path, a model endpoint on the host, and Intelligence.	COMMENT
MEDIUM⚡	docker-compose.yml	458	# The harness somebody picked during setup, whichever one it is.	COMMENT
MEDIUM⚡	docker-compose.yml	460	# ONE SERVICE RATHER THAN TWELVE, because a picked harness is a choice and not twelve branches in	COMMENT
MEDIUM⚡	docker-compose.yml	462	# both are facts about the image: each harness fixes its own port in its own Dockerfile.	COMMENT
MEDIUM	docker-compose.yml	481	# Every harness refuses without this; it is what makes the endpoint the server's alone.	COMMENT
MEDIUM	docker-compose.yml	486	# Whichever the model screen chose. A harness reads the one its provider needs and ignores the	COMMENT
MEDIUM	docker-compose.yml	498	# there either way; this variable is what tells the harness to read it.	COMMENT
MEDIUM	docker-compose.yml	505	# token expires within the hour and the harness renews it, so the renewal has to land back on	COMMENT
MEDIUM	agent-agno/src/main.py	47	# In memory, because a Bot's history lives in OpenBot's database and not in the harness. Two	COMMENT
MEDIUM	desktop/src-tauri/src/ask.rs	439	#[ignore = "needs a running harness and a real model credential"]	COMMENT
MEDIUM	desktop/src-tauri/src/ask.rs	453	#[ignore = "needs a running harness holding a deliberately invalid credential"]	COMMENT
MEDIUM	agent-langgraph-agui/src/main.py	221	# Typed provider boundary only. A callback or harness 401 is a different credential.	COMMENT

Deep Nesting14 hits · 14 pts

Severity	File	Line	Context
LOW	agent-claude-sdk/tests/test_tool_continuation.py	67	CODE
LOW	agent-claude-sdk/tests/test_tool_continuation.py	91	CODE
LOW	agent-claude-sdk/src/model_mode.py	11	CODE
LOW	agent-claude-sdk/src/model_mode.py	56	CODE
LOW	tests/learning_harness_contract.py	94	CODE
LOW	tests/learning_harness_contract.py	117	CODE
LOW	tests/learning_harness_contract.py	189	CODE
LOW	agent-crewai/tests/test_main.py	289	CODE
LOW	agent-crewai/tests/test_main.py	293	CODE
LOW	agent-langgraph-agui/tests/test_tool_protocol.py	41	CODE
LOW	agent-langgraph-agui/tests/test_tool_protocol.py	564	CODE
LOW	agent-langgraph-agui/tests/test_tool_protocol.py	65	CODE
LOW	agent-langgraph-agui/tests/test_parallel_tool_events.py	17	CODE
LOW	agent-langgraph-agui/src/parallel_tools.py	43	CODE

Cross-Language Confusion2 hits · 12 pts

Severity	File	Line	Snippet	Context
HIGH	agent-claude-sdk/tests/test_tool_continuation.py	157	# accepts string \| content-block[] \| null; its result-size	COMMENT
HIGH	agent-langgraph-agui/tests/test_provider_boundaries.py	769	"python -m pip install --quiet --root-user-action=ignore langchain-openai==1.6.0 && python /tmp/writer.py",	CODE

Self-Referential Comments3 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM	docker/s6/scripts/postgres-init.sh	2	# Create the cluster the first time, and hand the API a password every time.	COMMENT
MEDIUM	charts/openbot/values.yaml	187	# Creating the container. Name either Secret and a Job runs on every install and upgrade that	COMMENT
MEDIUM	scripts/typecheck-tests.ts	49	"# This file is a RECORD OF DEBT, not a list of things that are fine. Every line is a real defect",	CODE

Excessive Try-Catch Wrapping3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	agent-claude-sdk/src/adapter.py	196	except Exception as error:	CODE
MEDIUM	agent-claude-sdk/src/adapter.py	177	def _pump(self, input_data, turn):	CODE
LOW	agent-langgraph-agui/src/tool_runtime.py	89	except Exception:	CODE

Unused Imports3 hits · 3 pts

Severity	File	Line	Context
LOW	agent-microsoft/tests/test_main.py	9	CODE
LOW	shared/model_providers.py	28	CODE
LOW	agent-crewai/src/main.py	28	CODE

CopilotKit/OpenBot

Open-Source Code Quality, Security and Technical Debt Review