1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

—

Last Push

—

Stars

—

Language

2.2M

Lines of Code

7.0K

Files

3.3K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 2922 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.3/100 · LOW

Are imports declared and package/API names verified? 308 finding(s).

Agent Over-Engineering Ratio 6.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2693 finding(s).

PR Review Velocity Impact 8.3/100 · LOW

Which changes need focused human review? 3298 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 33HIGH 0MEDIUM 90LOW 3175

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 3298 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers2625 hits · 2622 pts

Severity	File	Line	Snippet	Context
LOW	config/migrate-orphaned-agent-files.js	28	async function migrateOrphanedAgentFiles({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/create-error-convo.js	478	function assertCatalogueIsComplete() {	CODE
LOW	config/migrate-code-file-duplicates.js	72	async function migrateCodeFileDuplicates({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/migrate-agent-permissions.js	23	async function migrateAgentPermissionsEnhanced({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/migrate-prompt-permissions.js	16	async function getGlobalProjectPromptGroupIds(db) {	CODE
LOW	config/migrate-prompt-permissions.js	23	async function migrateToPromptGroupPermissions({ dryRun = true, batchSize = 100 } = {}) {	CODE
LOW	config/migrate-shared-link-permissions.js	21	async function migrateSharedLinkPermissions({	CODE
LOW	utils/update_env.py	42	def update_env_file_with_local_env(input_file_path, output_file_path):	CODE
LOW	packages/data-schemas/src/tenant/conformance.ts	77	export function describeTenantIsolationConformance(harness: TenantEngineHarness): void {	CODE
LOW	packages/data-schemas/src/tenant/policy.ts	58	export function warnOnInvalidStrictSetting(): void {	CODE
LOW	packages/data-schemas/src/tenant/harness.ts	26	export function createMongooseTenantHarness(engine: MongooseTenantEngine): TenantEngineHarness {	CODE
LOW	packages/data-schemas/src/types/compaction.ts	54	function isValidCompactionSemanticIndexEntry(	CODE
LOW	packages/data-schemas/src/types/compaction.ts	87	export function isCompactionSemanticIndexProjection(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	182	function getRootLineagePredecessorId(parentMessageId: string): string {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	188	function isRootLineagePredecessorId(lineagePredecessorId: string): boolean {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	521	function normalizeReasoningOverride(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	728	export function createAgentQueuedTurnMethods(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	763	async function quarantineDuplicateAdmissionLanes(): Promise<number> {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	850	async function ensureAgentQueuedTurnIndexes(): Promise<void> {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1073	async function finalizeVisibleReservation(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1209	async function listActiveAgentQueuedTurns(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1227	async function ensureEffectiveAdmissionBoundary(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1299	async function listAgentQueuedTurnReceipts(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1346	async function getAgentQueuedTurnByClientRequestId(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1424	async function findQueuedTurnsNeedingDelivery(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1505	async function claimQueuedTurnsForAdmissionReconciliation(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1589	async function deferAgentQueuedTurnAdmissionReconciliation(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1623	async function reserveAgentQueuedTurnDelivery(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	1954	async function beginAgentQueuedTurnAdmission(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2194	async function markAgentQueuedTurnAdmitted(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2301	async function hasAgentQueuedTurnAdmissionReceipt(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2336	async function deadLetterAgentQueuedTurn(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2577	async function getEffectiveAgentQueuedTurnPredecessor(	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2762	async function prepareAgentQueuedTurnConversationDeletion(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2837	async function deletePreparedAgentQueuedTurnConversations(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2861	async function markAgentQueuedTurnDeliveryRetired(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2885	async function beginAgentQueuedTurnMissingDeliveryRetirement(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2912	async function markAgentQueuedTurnMissingDeliveryRetired(input: {	CODE
LOW	packages/data-schemas/src/methods/queuedTurn.ts	2936	async function deleteAllAgentQueuedTurnsForUser(input: {	CODE
LOW	packages/data-schemas/src/methods/systemGrant.ts	230	async function hasCapabilityForPrincipals({	CODE
LOW	packages/data-schemas/src/methods/systemGrant.ts	443	async function getCapabilitiesForPrincipal({	CODE
LOW	packages/data-schemas/src/methods/systemGrant.ts	500	async function getCapabilitiesForPrincipals({	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	267	export function createMCPAuthorityBootRevision(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	293	export function createMCPAuthorityConfigSourceRevision(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	351	export function createMCPAuthorityDatabaseSourceRevision(server: {	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	380	export function createMCPAuthorityCredentialRevision(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	430	function normalizeCredentialFields(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	461	function assertPreparedTargetBounds(targets: readonly PreparedTarget[]): void {	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	1038	export function createMCPAuthorityMethods(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	1624	async function loadAuthoritativeSnapshot(	CODE
LOW	packages/data-schemas/src/methods/mcpAuthority.ts	1798	async function assertMCPAuthorityProofsCurrent(input: MCPAuthorityAssertInput): Promise<void> {	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	33	export function createOpenIDRefreshFlightMethods(mongoose: typeof import('mongoose')): {	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	73	async function acquireOpenIDRefreshFlight(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	144	async function completeOpenIDRefreshFlight(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	257	async function claimOpenIDRefreshFlightDelivery(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	304	async function releaseOpenIDRefreshFlightDelivery(	CODE
LOW	…ckages/data-schemas/src/methods/openidRefreshFlight.ts	378	async function revokeOpenIDRefreshFlight(	CODE
LOW	packages/data-schemas/src/methods/mcpServer.ts	42	function generateServerNameFromTitle(title: string): string {	CODE
LOW	packages/data-schemas/src/methods/mcpServer.ts	125	async function findNextAvailableServerName(	CODE
LOW	packages/data-schemas/src/methods/mcpServer.ts	227	async function findMCPServerByServerName(serverName: string): Promise<MCPServerDocument \| null> {	CODE
2565 more matches not shown…

Hallucination Indicators33 hits · 305 pts

Severity	File	Line	Snippet	Context
CRITICAL	packages/api/src/app/service.spec.ts	1360	const setCalls = deps._cache.set.mock.calls.filter(	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1428	req.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1511	initialReq.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1523	changedReq.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1551	req.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1660	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1697	req.config.endpoints.agents.capabilities.push('execute_code');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1816	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1867	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1933	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	1976	if (enabled) req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2012	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2052	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2103	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2146	req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2222	if (state !== 'disabled-skills') req.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2223	if (state !== 'disabled-tools') req.config.endpoints.agents.capabilities.push('tools');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2292	req.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2320	eventReq.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2400	req.config.endpoints.agents.capabilities.push('skills');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2517	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2561	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2647	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2735	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	2965	req.config.endpoints.agents.capabilities.push('execute_code', 'stateful_code_sessions');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	3932	req.config.endpoints.agents.capabilities.push('run_in_background');	CODE
CRITICAL	api/server/services/Endpoints/agents/initialize.spec.js	3998	req.config.endpoints.agents.capabilities.push(	CODE
CRITICAL	api/server/services/__tests__/ToolService.spec.js	3687	req.config.endpoints.agents.capabilities.push(AgentCapabilities.programmatic_tools);	CODE
CRITICAL	api/server/services/Threads/manage.js	488	promises.push(openai.beta.threads.runs.steps.list(run_id, { thread_id }));	CODE
CRITICAL	api/server/services/Runs/RunManager.js	94	// const { data: steps, first_id, last_id, has_more } = await openai.beta.threads.runs.steps.list(run_id, { thread_i	COMMENT
CRITICAL	api/server/services/Runs/RunManager.js	95	const { data: _steps } = await openai.beta.threads.runs.steps.list(	CODE
CRITICAL	api/server/services/Runs/StreamRunManager.js	172	const streamRun = this.openai.beta.threads.runs.createAndStream(	CODE
CRITICAL	api/server/services/Runs/StreamRunManager.js	590	toolRun = this.openai.beta.threads.runs.submitToolOutputsStream(	CODE

Fake / Example Data274 hits · 276 pts

Severity	File	Line	Snippet	Context
LOW	packages/data-schemas/src/methods/prompt.spec.ts	143	email: 'admin@example.com',	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	1833	{ name: 'John Doe', email: 'john@example.com', username: 'johnd', provider: 'local' },	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	2162	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	2212	name: 'John Doe',	CODE
LOW	packages/data-schemas/src/methods/user.methods.spec.ts	2228	expect(found?.name).toBe('John Doe');	CODE
LOW	packages/data-schemas/src/methods/userGroup.spec.ts	1321	{ type: PrincipalType.USER, name: 'John Doe', email: 'jd@gmail.com', source: 'local' },	CODE
LOW	packages/data-schemas/src/methods/file.acl.spec.ts	84	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/file.acl.spec.ts	234	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/file.acl.spec.ts	297	email: 'user@example.com',	CODE
LOW	packages/data-schemas/src/methods/token.spec.ts	1227	expect(stored?.email).toBe('user@example.com');	CODE
LOW	packages/data-schemas/src/methods/token.spec.ts	1240	for (const lookup of ['User@Example.COM', 'user@example.com', 'USER@EXAMPLE.COM']) {	CODE
LOW	packages/data-schemas/src/methods/token.spec.ts	1260	const result = await methods.deleteTokens({ email: 'user@example.com' });	CODE
LOW	packages/data-schemas/src/config/parsers.spec.ts	830	nested: { 'k@example.org': 1, 'j@example.org': 2, other: 3 },	CODE
LOW	…s/data-schemas/src/models/plugins/searchTokens.spec.ts	64	emailTokens: ['jose.alvarez@example.org', 'jose', 'alvarez', 'example', 'org'],	CODE
LOW	packages/api/src/middleware/remoteAgentAuth.spec.ts	1460	expect(await captureEmailArg({ sub: 's1', email: 'user@example.com' })).toBe(	CODE
LOW	packages/api/src/middleware/remoteAgentAuth.spec.ts	1461	'user@example.com',	CODE
LOW	packages/api/src/middleware/remoteAgentAuth.spec.ts	1491	email: 'user@example.com',	CODE
LOW	packages/api/src/endpoints/models.spec.ts	183	const userObject = { id: 'user123', email: 'user@example.com' };	CODE
LOW	packages/api/src/endpoints/models.spec.ts	187	'X-User-Email': 'user@example.com',	CODE
LOW	packages/api/src/endpoints/models.spec.ts	209	'X-User-Email': 'user@example.com',	CODE
LOW	packages/api/src/endpoints/config/models.spec.ts	63	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/endpoints/config/models.spec.ts	100	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/endpoints/custom/initialize.spec.ts	380	user: { id: 'user-1', email: 'user@example.com', tenantId: overrides.tenantId },	CODE
LOW	packages/api/src/endpoints/custom/initialize.spec.ts	532	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/endpoints/custom/initialize.spec.ts	617	user: { id: 'user-1', email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/user.spec.ts	7	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/domain.spec.ts	95	const email = 'user@example.com';	CODE
LOW	packages/api/src/auth/refresh.spec.ts	28	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/refresh.spec.ts	137	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/refresh.spec.ts	167	expect(result.user.email).toBe('admin@example.com');	CODE
LOW	packages/api/src/auth/refresh.spec.ts	641	'admin@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	165	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	181	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	222	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	248	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	257	email: 'user@example.com',	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	315	const user = { _id: userId, email: 'user@example.com' };	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	354	{ _id: userId, email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/userDocCache.spec.ts	367	{ _id: userId, email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/googleRefresh.spec.ts	25	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/googleRefresh.spec.ts	102	email: 'admin@example.com',	CODE
LOW⚡	packages/api/src/auth/passwordReset.spec.ts	10	updateUser: jest.fn().mockResolvedValue({ email: 'user@example.com' }),	CODE
LOW⚡	packages/api/src/auth/passwordReset.spec.ts	19	return { token: RESET_HASH, email: 'user@example.com', type: 'password_reset', ...overrides };	CODE
LOW⚡	packages/api/src/auth/passwordReset.spec.ts	27	return { _id: 'user-reset', email: 'user@example.com', ...overrides };	CODE
LOW	packages/api/src/auth/passwordReset.spec.ts	88	{ email: 'user@example.com' },	CODE
LOW	packages/api/src/auth/exchange.spec.ts	28	email: 'admin@example.com',	CODE
LOW	packages/api/src/auth/exchange.spec.ts	53	expect(result!.user.email).toBe('admin@example.com');	CODE
LOW	packages/api/src/auth/passkey.spec.ts	45	const user = { id: '65f0000000000000000000aa', email: 'user@example.com', name: 'Ada' };	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	319	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	329	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	337	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	706	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	711	expect(mockFindUser).toHaveBeenCalledWith({ email: 'user@example.com' });	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	720	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	759	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	768	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	772	expect(mockFindUser).toHaveBeenCalledWith({ email: 'user@example.com' });	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	979	email: 'user@example.com',	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	988	expect(getOpenIdEmail({ email: 'user@example.com' }, 'remoteAgentAuth')).toBe(	CODE
LOW⚡	packages/api/src/auth/openid.spec.ts	989	'user@example.com',	CODE
214 more matches not shown…

Decorative Section Separators68 hits · 208 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	1202	# # ============================================================================	COMMENT
MEDIUM	librechat.example.yaml	1205	# # ============================================================================	COMMENT
MEDIUM	config/test-subdirectory-setup.sh	2	# =============================================================================	COMMENT
MEDIUM	config/test-subdirectory-setup.sh	21	# =============================================================================	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	166	// ─── PHASE 1: DATABASE-PER-ORG SCHEMA MAPPING ────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	231	// ─── PHASE 2: INDEX INITIALIZATION ────────────────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	328	// ─── PHASE 3: SCALING CURVE ───────────────────────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	458	// ─── PHASE 4: WRITE AMPLIFICATION ────────────────────────────────────────	COMMENT
MEDIUM	…ta-schemas/misc/ferretdb/multiTenancy.ferretdb.spec.ts	528	// ─── PHASE 5: SHARED-COLLECTION ALTERNATIVE ──────────────────────────────	COMMENT
MEDIUM	…s/data-schemas/misc/ferretdb/sharding.ferretdb.spec.ts	26	// ─── TYPES ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…s/data-schemas/misc/ferretdb/sharding.ferretdb.spec.ts	46	// ─── TENANT ROUTER (INLINE POC) ────────────────────────────────────────────	COMMENT
MEDIUM	…s/data-schemas/misc/ferretdb/sharding.ferretdb.spec.ts	245	// ─── TESTS ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	106	// ─── FLOW 1: import — bulkSaveConvos + bulkSaveMessages ───────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	258	// ─── FLOW 2: bulkWriteAclEntries ───────────────────────────────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	365	// ─── FLOW 3: bulkIncrementTagCounts ────────────────────────────────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	416	// ─── FLOW 4: Transaction.insertMany (bulkInsertTransactions) ──────────────	COMMENT
MEDIUM	…/data-schemas/misc/ferretdb/bulkWrite.ferretdb.spec.ts	501	// ─── FLOW 5: file-TTL bulkWrite (extendFilesTTL) ───────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	66	// ─── BACKUP/RESTORE UTILITIES ───────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	109	// ─── MIGRATION UTILITIES ────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	171	// ─── TESTS ──────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	192	// ─── RETRY UTILITY ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	280	// ─── REAL DEADLOCK RETRY ────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	310	// ─── BACKUP/RESTORE ─────────────────────────────────────────────────────	COMMENT
MEDIUM	…a-schemas/misc/ferretdb/orgOperations.ferretdb.spec.ts	511	// ─── SCHEMA MIGRATION ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/app/service.ts	465	// ── Types ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/app/service.ts	604	// ── Helpers ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/app/service.ts	685	// ── Service factory ──────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/admin/config.handler.spec.ts	1982	// ── Invariant tests: rules that must hold across ALL handlers ──────	COMMENT
MEDIUM	packages/api/src/admin/config.ts	1015	// ── Validation helpers ───────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/admin/config.ts	1827	// ── Change batches ───────────────────────────────────────────────────	COMMENT
MEDIUM	packages/api/src/admin/config.ts	2565	// ── Handler factory ──────────────────────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	23	# ── Helpers ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	80	# ── Test 1: Basic single-turn request ─────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	91	# ── Test 2: Multi-turn with output_text assistant blocks ──────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	118	# ── Test 3: Multi-turn with refusal blocks ────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	145	# ── Test 4: Streaming request ─────────────────────────────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	156	# ── Test 5: Back-and-forth using previous_response_id ─────────────────	COMMENT
MEDIUM	…/agents/responses/__tests__/responses-api.live.test.sh	185	# ── Summary ───────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	…ges/api/src/agents/responses/__tests__/service.test.ts	406	// ── String input shorthand ─────────────────────────────────────────	COMMENT
MEDIUM⚡	…ges/api/src/agents/responses/__tests__/service.test.ts	412	// ── Empty input array ──────────────────────────────────────────────	COMMENT
MEDIUM⚡	…ges/api/src/agents/responses/__tests__/service.test.ts	418	// ── Role mapping ───────────────────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	450	// ── input_text content blocks ──────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	463	// ── output_text content blocks (the original bug) ──────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	478	// ── refusal content blocks ─────────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	493	// ── input_image content blocks ─────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	518	// ── input_file content blocks ──────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	547	// ── Null / undefined filtering ─────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	560	// ── Missing text field defaults to empty string ────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	597	// ── Unknown block types are filtered out ───────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	613	// ── Mixed valid/invalid content in same array ──────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	639	// ── Non-array, non-string content defaults to empty string ─────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	646	// ── Function call items ────────────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	720	// ── Item references are skipped ────────────────────────────────────	COMMENT
MEDIUM	…ges/api/src/agents/responses/__tests__/service.test.ts	730	// ── Multi-turn conversation (the real-world scenario) ──────────────	COMMENT
MEDIUM	api/server/middleware/__tests__/requireJwtAuth.spec.js	13	// ── Mocks ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	api/server/middleware/__tests__/requireJwtAuth.spec.js	124	// ── Helpers ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	api/server/middleware/__tests__/requireJwtAuth.spec.js	171	// ── Tests ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rvices/Config/__tests__/invalidateConfigCaches.spec.js	1	// ── Mocks ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…rvices/Config/__tests__/invalidateConfigCaches.spec.js	61	// ── Tests ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…c/utils/__tests__/applyModelSpecEphemeralAgent.test.ts	44	// ─── New Conversations ─────────────────────────────────────────────	COMMENT
8 more matches not shown…

Over-Commented Block162 hits · 124 pts

Severity	File	Line	Snippet	Context
LOW	librechat.example.yaml	1	# For more information, see the Configuration Guide:	COMMENT
LOW	librechat.example.yaml	21		COMMENT
LOW	librechat.example.yaml	41		COMMENT
LOW	librechat.example.yaml	61		COMMENT
LOW	librechat.example.yaml	81	# origin (a self-hosted base URL, or a single tenant destination URL), and only	COMMENT
LOW	librechat.example.yaml	101	# Temporary chats, including every chat when interface.retentionMode is	COMMENT
LOW	librechat.example.yaml	121	# Granular file storage strategies (new format - recommended)	COMMENT
LOW	librechat.example.yaml	141	# domain: "https://cdn.example.com" # CloudFront domain (CNAME recommended for cookies)	COMMENT
LOW	librechat.example.yaml	161	# # when includeRegionInPath is true. Existing files are not moved automatically.	COMMENT
LOW	librechat.example.yaml	181	# sources:	COMMENT
LOW	librechat.example.yaml	201		COMMENT
LOW	librechat.example.yaml	221	# historyCacheTtlMs: 60000	COMMENT
LOW	librechat.example.yaml	321	# Scheduled agents that can pause require both `USE_REDIS_STREAMS=true` for	COMMENT
LOW	librechat.example.yaml	341	# # Pin every scheduled run to ONE chat project, ignoring the user's choice.	COMMENT
LOW	librechat.example.yaml	361	# sound: true # Allow readers to turn on the reply chime (default: true)	COMMENT
LOW	librechat.example.yaml	381	# # user chatting with a shared agent cannot otherwise see.	COMMENT
LOW	librechat.example.yaml	401	# When omitted, tools start unpinned and the MCP dropdown keeps its default (pinned).	COMMENT
LOW	librechat.example.yaml	421	# mcpServers:	COMMENT
LOW	librechat.example.yaml	441	# LibreChat hat diesen MCP-Server nicht überprüft. Angreifer könnten versuchen, Ihre Daten zu stehlen oder das M	COMMENT
LOW	librechat.example.yaml	461	# retentionMode: "all"; non-agent files still expire.	COMMENT
LOW	librechat.example.yaml	481	# perUserMax: 20	COMMENT
LOW	librechat.example.yaml	501	# refillAmount: 10000	COMMENT
LOW	librechat.example.yaml	521	# control and that cannot be repointed by an attacker. Do not list attacker-controllable or	COMMENT
LOW	librechat.example.yaml	541	# stt:	COMMENT
LOW	librechat.example.yaml	561	# - 'localhost:8080'	COMMENT
LOW	librechat.example.yaml	581	# maxEntries: 100	COMMENT
LOW	librechat.example.yaml	601	# # Always active; successful and failed requests count. Uses Redis when enabled.	COMMENT
LOW	librechat.example.yaml	621	# userMax: 3	COMMENT
LOW	librechat.example.yaml	641	- 'google.com'	COMMENT
LOW	librechat.example.yaml	661		COMMENT
LOW	librechat.example.yaml	681	# SECURITY: If not configured, SSRF targets are blocked (localhost, private IPs, .internal/.local TLDs).	COMMENT
LOW	librechat.example.yaml	701	# # want default SSRF protection AND specific internal MCP servers. Entries must	COMMENT
LOW	librechat.example.yaml	721	# mcpServers:	COMMENT
LOW	librechat.example.yaml	741	# # When to ask users to sign in. `on_start` (default) asks when the turn starts. `on_use`	COMMENT
LOW	librechat.example.yaml	761	# Authorization: "Bearer {{LIBRECHAT_OPENID_ACCESS_TOKEN}}"	COMMENT
LOW	librechat.example.yaml	781	# iconPath: /home/user/LibreChat/client/public/assets/logo.svg	COMMENT
LOW	librechat.example.yaml	801	# supportedIds: ["asst_supportedAssistantId1", "asst_supportedAssistantId2"]	COMMENT
LOW	librechat.example.yaml	821	# # Maximum provider error characters retained without content protection (0 hides detail).	COMMENT
LOW	librechat.example.yaml	841	# maxToolCallArgBytesByTool:	COMMENT
LOW	librechat.example.yaml	861	# # Enabling this sends a bounded snapshot (up to 4,000 characters) of the	COMMENT
LOW	librechat.example.yaml	881	# # (optional) Maximum explicit subagents per agent, for both the flat list and	COMMENT
LOW	librechat.example.yaml	901	# ttlMs: 3600000 # active manifest lifetime, at most 24 hours	COMMENT
LOW	librechat.example.yaml	921	# # every agent on its fixed machine (for example while older API replicas still run).	COMMENT
LOW	librechat.example.yaml	941	# # `remote-bridge` backend leases work to an outbound @librechat/code worker.	COMMENT
LOW	librechat.example.yaml	961	# # Lets authenticated users create principal-bound environments and	COMMENT
LOW	librechat.example.yaml	981	# # New strict fields require all LibreChat API replicas to be updated first.	COMMENT
LOW	librechat.example.yaml	1001	# fileWrite:	COMMENT
LOW	librechat.example.yaml	1021	# completionWakeups: true	COMMENT
LOW	librechat.example.yaml	1041	# enabled: true # set false to turn the feature off	COMMENT
LOW	librechat.example.yaml	1061	# # retentionDays: 180 # an unused connection is removed after this; each use extends it	COMMENT
LOW	librechat.example.yaml	1081	# batchTimeoutSeconds: 20	COMMENT
LOW	librechat.example.yaml	1101	# toolApproval:	COMMENT
LOW	librechat.example.yaml	1121	# retainedAnswers:	COMMENT
LOW	librechat.example.yaml	1141	# userId: '507f1f77bcf86cd799439011'	COMMENT
LOW	librechat.example.yaml	1161	# headers:	COMMENT
LOW	librechat.example.yaml	1181	# X-Conversation-Id: '{{LIBRECHAT_BODY_CONVERSATIONID}}'	COMMENT
LOW	librechat.example.yaml	1201	#	COMMENT
LOW	librechat.example.yaml	1221	# # The deploymentName is the actual Vertex AI model ID used for API calls	COMMENT
LOW	librechat.example.yaml	1241	# deploymentName: claude-3-5-haiku@20241022	COMMENT
LOW	librechat.example.yaml	1281	models:	COMMENT
102 more matches not shown…

Structural Annotation Overuse54 hits · 104 pts

Severity	File	Line	Snippet	Context
LOW	config/smart-reinstall.js	143	// Step 1: Dependencies	COMMENT
LOW	config/smart-reinstall.js	163	// Step 2: Build via Turborepo	COMMENT
LOW	packages/data-schemas/README.md	134	### Step 1: Create the Type Definition	COMMENT
LOW	packages/data-schemas/README.md	153	### Step 2: Update Types Index	COMMENT
LOW	packages/data-schemas/README.md	161	### Step 3: Create the Schema	COMMENT
LOW	packages/data-schemas/README.md	180	### Step 4: Create the Model Factory	COMMENT
LOW	packages/data-schemas/README.md	196	### Step 5: Update Models Index	COMMENT
LOW	packages/data-schemas/README.md	210	### Step 6: Create Database Methods	COMMENT
LOW	packages/data-schemas/README.md	235	### Step 7: Update Methods Index	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	667	// Step 1: Extract token info	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	671	// Step 2: Validate token	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	675	// Step 3: Process placeholders	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	967	// Step 1: preProcessGraphTokens resolves graph token placeholders (async)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	973	// Step 2: processMCPEnv resolves user and env placeholders (sync)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1005	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1011	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1083	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1089	// Step 2: processMCPEnv with customUserVars	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1116	// Step 1: preProcessGraphTokens (no-op since no graph placeholders)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1122	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1155	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1161	// Step 2: processMCPEnv	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1072	// Step 2: Store tokens with valid expiry first	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1082	// Step 3: Verify tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1091	// Step 4: Simulate token expiry by directly updating the stored token's expiresAt	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1094	// Step 5: Revoke refresh token on server side (simulating server-side revocation)	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1097	// Step 6: Try to get tokens — refresh should fail, return null	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1154	// Step 9: Complete the flow	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1162	// Step 10: Store the new tokens	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1174	// Step 11: Verify new tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1183	// Step 12: Verify new token works against server	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1058	// Step 1: Get initial tokens	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1124	// Step 7: Simulate the re-auth flow via FlowStateManager	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1140	// Step 8: Get a new auth code and exchange for tokens (simulating user re-auth)	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	242	// Step 1: Save message	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	245	// Step 2: Check for replacement	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	249	// Step 3: Emit if not replaced	COMMENT
LOW	api/server/services/PermissionService.js	524	// Step 1: Get all group IDs user should be member of	COMMENT
LOW	api/server/services/PermissionService.js	552	// Step 2: Try to add user to existing groups (fast operation)	COMMENT
LOW	api/server/services/PermissionService.js	567	// Step 3: Find which groups don't exist in DB using db layer	COMMENT
LOW	api/server/services/PermissionService.js	578	// Step 4: Fetch details only for missing groups (optimized batch request)	COMMENT
LOW	api/server/services/PermissionService.js	590	// Step 5: Upsert missing groups (race-safe by design)	COMMENT
LOW	api/server/services/PermissionService.js	607	// Step 6: Add user to all newly created/upserted groups	COMMENT
LOW	api/server/services/PermissionService.js	632	// Step 7: Remove user from Entra groups they're no longer member of	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	200	// Step 1: Extract highlighted spans	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	209	// Step 2: Extract composite blocks	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	224	// Step 3: Extract standalone citations (not in composites)	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	241	// Step 4: Clean up text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	315	// Step 1: Process highlighted text first (simplify by just making it bold in markdown)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	321	// Step 2: Find all standalone citations and composite citation blocks	COMMENT
LOW	client/src/hooks/Messages/useCopyToClipboard.ts	370	// Step 3: Process each citation and build the reference mapping	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	514	// Step 4: Apply all replacements (from longest to shortest to avoid nested replacement issues)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	520	// Step 5: Remove any orphaned composite blocks at the end of the text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	524	// Step 6: Clean up any remaining citation markers	COMMENT

Verbosity Indicators47 hits · 93 pts

Severity	File	Line	Snippet	Context
LOW	config/smart-reinstall.js	143	// Step 1: Dependencies	COMMENT
LOW	config/smart-reinstall.js	163	// Step 2: Build via Turborepo	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	667	// Step 1: Extract token info	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	671	// Step 2: Validate token	COMMENT
LOW⚡	packages/api/src/utils/oidc.spec.ts	675	// Step 3: Process placeholders	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	967	// Step 1: preProcessGraphTokens resolves graph token placeholders (async)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	973	// Step 2: processMCPEnv resolves user and env placeholders (sync)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1005	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1011	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1083	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1089	// Step 2: processMCPEnv with customUserVars	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1116	// Step 1: preProcessGraphTokens (no-op since no graph placeholders)	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1122	// Step 2: processMCPEnv	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1155	// Step 1: preProcessGraphTokens	COMMENT
LOW⚡	packages/api/src/mcp/__tests__/mcp.spec.ts	1161	// Step 2: processMCPEnv	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1072	// Step 2: Store tokens with valid expiry first	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1082	// Step 3: Verify tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1091	// Step 4: Simulate token expiry by directly updating the stored token's expiresAt	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1094	// Step 5: Revoke refresh token on server side (simulating server-side revocation)	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1097	// Step 6: Try to get tokens — refresh should fail, return null	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1154	// Step 9: Complete the flow	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1162	// Step 10: Store the new tokens	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1174	// Step 11: Verify new tokens work	COMMENT
LOW⚡	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1183	// Step 12: Verify new token works against server	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1058	// Step 1: Get initial tokens	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1124	// Step 7: Simulate the re-auth flow via FlowStateManager	COMMENT
LOW	…ages/api/src/mcp/__tests__/MCPOAuthTokenExpiry.test.ts	1140	// Step 8: Get a new auth code and exchange for tokens (simulating user re-auth)	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	242	// Step 1: Save message	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	245	// Step 2: Check for replacement	COMMENT
LOW⚡	…er/controllers/agents/__tests__/jobReplacement.spec.js	249	// Step 3: Emit if not replaced	COMMENT
LOW	api/server/services/PermissionService.js	524	// Step 1: Get all group IDs user should be member of	COMMENT
LOW	api/server/services/PermissionService.js	552	// Step 2: Try to add user to existing groups (fast operation)	COMMENT
LOW	api/server/services/PermissionService.js	567	// Step 3: Find which groups don't exist in DB using db layer	COMMENT
LOW	api/server/services/PermissionService.js	578	// Step 4: Fetch details only for missing groups (optimized batch request)	COMMENT
LOW	api/server/services/PermissionService.js	590	// Step 5: Upsert missing groups (race-safe by design)	COMMENT
LOW	api/server/services/PermissionService.js	607	// Step 6: Add user to all newly created/upserted groups	COMMENT
LOW	api/server/services/PermissionService.js	632	// Step 7: Remove user from Entra groups they're no longer member of	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	200	// Step 1: Extract highlighted spans	COMMENT
LOW⚡	client/src/utils/__tests__/citations.test.ts	209	// Step 2: Extract composite blocks	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	224	// Step 3: Extract standalone citations (not in composites)	COMMENT
LOW	client/src/utils/__tests__/citations.test.ts	241	// Step 4: Clean up text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	315	// Step 1: Process highlighted text first (simplify by just making it bold in markdown)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	321	// Step 2: Find all standalone citations and composite citation blocks	COMMENT
LOW	client/src/hooks/Messages/useCopyToClipboard.ts	370	// Step 3: Process each citation and build the reference mapping	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	514	// Step 4: Apply all replacements (from longest to shortest to avoid nested replacement issues)	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	520	// Step 5: Remove any orphaned composite blocks at the end of the text	COMMENT
LOW⚡	client/src/hooks/Messages/useCopyToClipboard.ts	524	// Step 6: Clean up any remaining citation markers	COMMENT

AI Slop Vocabulary12 hits · 31 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	1420	# # - "enabled_full": Include comprehensive trace details (recommended for debugging)	COMMENT
MEDIUM	search/compose.yml	64	# differential-test harness at	COMMENT
MEDIUM	…ckages/data-schemas/src/methods/convoStructure.spec.ts	104	// buildTree is order-robust: a child sorted before its parent must still	COMMENT
MEDIUM	…ckages/data-schemas/src/methods/convoStructure.spec.ts	173	// Interleaved timestamps scramble retrieval order, but the order-robust	COMMENT
MEDIUM	packages/api/src/tools/toolkits/web.ts	6	Use this tool when the user's request calls for it, whether directly, indirectly, or implicitly, or when answering requi	CODE
MEDIUM	.github/workflows/workspace-acceptance.yml	85	# The native harness retains private identities and cookies for local debugging.	COMMENT
MEDIUM	api/server/utils/import/__data__/chatgpt-export.json	606	"result": "# \u30100\u20202014 Volkswagen Transporter MPG - Actual MPG from 14 2014 ... - Fuelly\u2020www.fu	CODE
MEDIUM	api/server/utils/import/__data__/chatgpt-export.json	783	"text": "# \u30100\u20202014 Volkswagen Transporter MPG - Actual MPG from 14 2014 ... - Fuelly\u2020ww	CODE
MEDIUM	api/server/utils/import/__data__/chatgpt-citations.json	20	"result": "# 【0†Signal Sciences - Crunchbase Company Profile & Funding†www.crunchbase.com】\nFounded Date Mar	CODE
MEDIUM	api/server/utils/import/__data__/chatgpt-citations.json	199	"text": "# 【0†Signal Sciences - Crunchbase Company Profile & Funding†www.crunchbase.com】\nFounded Date	CODE
MEDIUM	e2e/config/librechat.e2e.yaml	34	# Scheduled chats are EXPERIMENTAL and default-off, so the e2e harness must opt in	COMMENT
MEDIUM	e2e/config/librechat.real.yaml	12	# Local stdio fixture reused from the mock harness: gives the real model a	COMMENT

Modern AI Meta-Vocabulary5 hits · 15 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	570	# ragMs: 30000 # RAG API queries for file search and message context	COMMENT
MEDIUM	e2e/config/librechat.e2e.yaml	463	# Short enough that a stalled fake RAG query fails the tool call well inside a test.	COMMENT
MEDIUM	helm/librechat-rag-api/readme.md	1	# Librechat RAG API Helm CHart	COMMENT
MEDIUM	helm/librechat-rag-api/values.yaml	1	# Required as vectorDB for RAG	COMMENT
MEDIUM	helm/librechat/values.yaml	125	# only lite RAG is supported	COMMENT

Redundant / Tautological Comments10 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	librechat.example.yaml	460	# Set retainAgentFiles to true to keep persistent agent resource files from expiring under	COMMENT
LOW	redis-config/stop-cluster.sh	22	# Check if still running and force kill if needed	COMMENT
LOW	redis-config/start-redis-tls.sh	6	# Check if Redis is already running	COMMENT
LOW	redis-config/start-cluster.sh	17	# Check if Redis is installed	COMMENT
LOW	redis-config/start-cluster.sh	26	# Check if Redis CLI is available	COMMENT
LOW	redis-config/start-cluster.sh	40	# Check if all nodes are running	COMMENT
LOW	redis-config/start-cluster.sh	57	# Check if cluster is already initialized	COMMENT
LOW	utils/update_env.py	58	# Check if the environment variable is set in the local environment	COMMENT
LOW	packages/data-provider/check_updates.sh	33	# Check if this date is within the last three days	COMMENT
LOW	client/check_updates.sh	32	# Check if this date is within the last three days	COMMENT

Slop Phrases5 hits · 14 pts

Severity	File	Line	Snippet	Context
MEDIUM	librechat.example.yaml	1338	# For `apiKey` and `baseURL`, you can use environment variables that you define.	COMMENT
MEDIUM	librechat.example.yaml	1380	# For `apiKey` and `baseURL`, you can use environment variables that you define.	COMMENT
MEDIUM	api/server/utils/import/__data__/chatgpt-export.json	1127	"To find the point where all intervals intersect, you need to determine the common overlap region among al	CODE
MEDIUM	helm/librechat-rag-api/values.yaml	30	# postgres-password is needed to enable pgvector extension. If you enable it manually you can use "password" and use	COMMENT
MEDIUM	helm/librechat/examples/dns-configuration.yaml	37	# Note: For simple host-to-IP mappings, you can also use hostAliases	COMMENT

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	config/test-subdirectory-setup.sh	10	# Usage:	COMMENT
LOW	…/agents/responses/__tests__/responses-api.live.test.sh	7	# Usage:	COMMENT

Unused Imports1 hit · 0 pts

Severity	File	Line	Snippet	Context
LOW	.github/scripts/test_main_promotion.py	3		CODE

LibreChat-AI/LibreChat

Open-Source Code Quality, Security and Technical Debt Review