Testing and evaluation platform to chat, inspect, and debug MCP servers, MCP apps, and ChatGPT apps.
This report presents the forensic synthetic code analysis of MCPJam/inspector, a TypeScript project with 2,119 GitHub stars. SynthScan v2.0 examined 1,157,192 lines of code across 3947 source files, recording 3114 pattern matches distributed across 10 syntactic categories. The overall adjusted score of 3.6 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 3114 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | slack-app/agent/binding-cache.js | 166 | export function coalesceChannelBindingRead(teamId, channelId, read) { | CODE |
| LOW | slack-app/listeners/views/agent-reply-builder.js | 127 | export function buildCreatedResourceBlocks(createdResources, opts = {}) { | CODE |
| LOW | mcpjam-inspector/bin/start.js | 338 | async function openTerminalWithMultipleCommands(commands, title) { | CODE |
| LOW | mcpjam-inspector/bin/start.js | 370 | async function setupOllamaInSingleTerminal(model) { | CODE |
| LOW | mcpjam-inspector/server/index.ts | 245 | function getInspectorFrontendUrlOptions() { | CODE |
| LOW | mcpjam-inspector/server/env.ts | 100 | function replaceConvexHostnameSuffix( | CODE |
| LOW | mcpjam-inspector/server/env.ts | 119 | export function getInspectorClientRuntimeConfig(): InspectorClientRuntimeConfig { | CODE |
| LOW | mcpjam-inspector/server/env.ts | 141 | export function getInspectorClientRuntimeConfigScript(): string | null { | CODE |
| LOW | mcpjam-inspector/server/env.ts | 177 | export function warnOnConvexDevMisconfiguration(env: LoadedInspectorEnv): void { | CODE |
| LOW | …pjam-inspector/server/middleware/slack-service-auth.ts | 191 | export function resetSlackRateLimitForTests(): void { | CODE |
| LOW | …pjam-inspector/server/middleware/slack-service-auth.ts | 366 | export function isValidDiscordServiceToken(token: string): boolean { | CODE |
| LOW | mcpjam-inspector/server/middleware/bearer-auth.ts | 104 | export function resetWorkOSRateLimitForTests(): void { | CODE |
| LOW | …jam-inspector/server/middleware/request-log-context.ts | 45 | export async function requestLogContextMiddleware(c: Context, next: Next) { | CODE |
| LOW | mcpjam-inspector/server/middleware/origin-validation.ts | 98 | export async function originValidationMiddleware( | CODE |
| LOW⚡ | …pector/server/middleware/conformance-run-rate-limit.ts | 55 | export function resetConformanceRunRateLimitForTests(): void { | CODE |
| LOW⚡ | …pector/server/middleware/conformance-run-rate-limit.ts | 60 | export function conformanceRunRateLimitWindowCountForTests(): number { | CODE |
| LOW⚡ | …pector/server/middleware/conformance-run-rate-limit.ts | 66 | export async function conformanceRunRateLimitMiddleware( | CODE |
| LOW | …am-inspector/server/middleware/surface-service-auth.ts | 40 | export function isValidDiscordServiceToken(token: string): boolean { | CODE |
| LOW | mcpjam-inspector/server/middleware/security-headers.ts | 22 | export async function securityHeadersMiddleware( | CODE |
| LOW | mcpjam-inspector/server/middleware/guest-rate-limit.ts | 24 | export function resetGuestRateLimitForTests(): void { | CODE |
| LOW | …nspector/server/test/support/oauth-proxy-fetch-mock.ts | 46 | export async function executeOAuthProxyViaFetch( | CODE |
| LOW | …nspector/server/test/support/oauth-proxy-fetch-mock.ts | 90 | export async function fetchOAuthMetadataViaFetch( | CODE |
| LOW | mcpjam-inspector/server/utils/live-chat-trace-stream.ts | 48 | function getLatestUserMessageIndex(messageHistory: ModelMessage[]): number { | CODE |
| LOW | mcpjam-inspector/server/utils/live-chat-trace-stream.ts | 57 | export function getPromptMessageStartIndex( | CODE |
| LOW | mcpjam-inspector/server/utils/live-chat-trace-stream.ts | 183 | export function setToolSpanMessageRangesFromResults( | CODE |
| LOW | mcpjam-inspector/server/utils/guest-auth.ts | 27 | export async function getProductionGuestAuthSession(): Promise< | CODE |
| LOW | mcpjam-inspector/server/utils/guest-auth.ts | 66 | export async function getProductionGuestAuthHeader(): Promise<string | null> { | CODE |
| LOW | mcpjam-inspector/server/utils/chat-ingestion.ts | 298 | export function stampSenderUserIdsOnSessionMessages( | CODE |
| LOW | mcpjam-inspector/server/utils/chat-ingestion.ts | 375 | export async function persistChatSessionToConvex( | CODE |
| LOW | mcpjam-inspector/server/utils/server-secrets.ts | 173 | export async function fetchRuntimeServerSecrets(args: { | CODE |
| LOW | mcpjam-inspector/server/utils/mcp-app-widget-capture.ts | 54 | function readServerIdFromToolOutput(value: unknown): string | undefined { | CODE |
| LOW | mcpjam-inspector/server/utils/mcp-app-widget-capture.ts | 70 | export function extractHtmlFromResourceContent(content: unknown): string { | CODE |
| LOW | mcpjam-inspector/server/utils/mcp-app-widget-capture.ts | 129 | export function normalizeWidgetPermissions( | CODE |
| LOW | mcpjam-inspector/server/utils/mcp-app-widget-capture.ts | 135 | function collectToolSnapshotSources( | CODE |
| LOW | mcpjam-inspector/server/utils/mcp-app-widget-capture.ts | 310 | function detectScreenshotMediaType(base64: string): "image/jpeg" | "image/png" { | CODE |
| LOW | mcpjam-inspector/server/utils/mcp-app-widget-capture.ts | 424 | export async function captureMcpAppWidgetSnapshots(params: { | CODE |
| LOW | mcpjam-inspector/server/utils/v1-convex-token.ts | 149 | export async function getConvexBearerForRequest(c: Context): Promise<string> { | CODE |
| LOW | mcpjam-inspector/server/utils/v1-convex-token.ts | 173 | export async function getConvexBearerForDelegation( | CODE |
| LOW | mcpjam-inspector/server/utils/mrtr-hosted-chat.ts | 273 | function buildErrorToolResultMessage( | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 32 | function canReplaySourcelessImageMedia( | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 47 | function linkedResourceReaderForPart( | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 65 | function readServerIdFromToolResultPart(part: unknown): string | undefined { | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 125 | function hasImageResourceLinkCandidate(result: unknown): boolean { | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 144 | function isImageOmissionMarkerText(text: string): boolean { | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 154 | function readReplayableImageModelOutput( | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 226 | export function createLinkedResourceServerIdResolver(args: { | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 262 | function stripInternalProviderOptions(part: unknown): unknown { | CODE |
| LOW | …inspector/server/utils/mcp-tool-result-model-output.ts | 407 | export async function convertToMcpjamModelMessages( | CODE |
| LOW | mcpjam-inspector/server/utils/guest-session-pepper.ts | 3 | export function getGuestSessionHashPepper(): string { | CODE |
| LOW | mcpjam-inspector/server/utils/internal-log-context.ts | 44 | export function mapInternalToRequestContext( | CODE |
| LOW | …am-inspector/server/utils/direct-chat-sse-callbacks.ts | 39 | export function buildDirectChatTraceCallbacks( | CODE |
| LOW | …or/server/utils/normalize-model-messages-for-convex.ts | 10 | export function normalizeModelMessagesForConvex( | CODE |
| LOW | mcpjam-inspector/server/utils/host-runtime-config.ts | 57 | function normalizeHostRuntimeConfig( | CODE |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 102 | function isModelVisibleImageOutput(value: unknown): boolean { | CODE |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 149 | function isApprovalFreeMetaToolName( | CODE |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 233 | function readLinkedMcpResourceWithManager( | CODE |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 256 | export function warnIfChatAbortSignalMissing( | CODE |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 815 | function hasUnresolvedClientFulfilledToolCalls( | CODE |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 871 | function createToolCallIdNormalizer( | CODE |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 900 | function getPromptAssistantStepBaseIndex( | CODE |
| 1898 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | slack-app/railway.toml | 17 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | slack-app/railway.toml | 33 | # ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/config.ts | 88 | // ── Hosted elicitation (MCP 2025-11-25) ───────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/config.ts | 120 | // ── Hosted MRTR continuation transport (MCP 2026-07-28 §12.5) ──────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/chat-stream-chunks.ts | 45 | // ── text ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/chat-stream-chunks.ts | 55 | // ── reasoning ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/chat-stream-chunks.ts | 68 | // ── tools ──────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/chat-stream-chunks.ts | 110 | // ── finish / error ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/chat-stream-chunks.ts | 129 | // ── emit wrappers (build + write, return the chunk) ────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 3108 | // ── Hosted MRTR resume pre-phase (§12.5, PR5) ───────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/server-skill-tools.ts | 568 | // ── listSkills ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/server-skill-tools.ts | 607 | // ── loadSkill ──────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/server-skill-tools.ts | 706 | // ── listSkillFiles ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/server-skill-tools.ts | 731 | // ── readSkillFile ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mrtr-hosted-collector.ts | 70 | // ── Suspend signal ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | mcpjam-inspector/server/utils/mrtr-hosted-collector.ts | 148 | // ── Binding fingerprint ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mrtr-hosted-collector.ts | 461 | // ── Safe display ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mrtr-hosted-collector.ts | 569 | // ── Suspending collector ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mrtr-hosted-collector.ts | 682 | // ── Resume primitive ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pjam-inspector/server/utils/mrtr-continuation-state.ts | 37 | // ── Wire contract (mirrors mcpjam-backend PR3a — keep in sync by hand) ──────── | COMMENT |
| MEDIUM | …pjam-inspector/server/utils/mrtr-continuation-state.ts | 116 | // ── HTTP plumbing (mirrors harness-session-state.postSessionState) ──────────── | COMMENT |
| MEDIUM | …pjam-inspector/server/utils/mrtr-continuation-state.ts | 218 | // ── Codec ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pjam-inspector/server/utils/mrtr-continuation-state.ts | 338 | // ── Client (one function per FROZEN route) ──────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/computers/cloud-skills.ts | 197 | // ── supporting files (v2) ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …spector/server/utils/computers/convex-skills-client.ts | 287 | // ── supporting files (v2) ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …inspector/server/utils/harness/e2b-sandbox-provider.ts | 176 | // ── file I/O ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …inspector/server/utils/harness/e2b-sandbox-provider.ts | 213 | // ── exec ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …inspector/server/utils/harness/e2b-sandbox-provider.ts | 240 | // ── spawn (long-lived; adapt E2B callbacks → ReadableStreams) ────── | COMMENT |
| MEDIUM | …inspector/server/utils/harness/e2b-sandbox-provider.ts | 312 | // ── infra surface ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …server/utils/harness/__tests__/plugin-delivery.test.ts | 207 | // ── End-to-end: resolved environment spec → Computer sandbox ──────────────── | COMMENT |
| MEDIUM | …pjam-inspector/server/__tests__/in-app-browser.test.ts | 9 | // ─── detectInAppBrowser() ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pjam-inspector/server/__tests__/in-app-browser.test.ts | 157 | // ─── generateRedirectPage() ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | …pjam-inspector/server/__tests__/in-app-browser.test.ts | 208 | // ─── inAppBrowserMiddleware ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/convex-errors.ts | 124 | // ── Mixed-version fallbacks: a deployment that still throws prose. ──────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/images.ts | 68 | // ── Public DTO mappers (clean `id`; no raw `environmentId`/`buildId` leak) ───── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/images.ts | 227 | // ── Schemas ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/images.ts | 251 | // ── Routes ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/environments.ts | 46 | // ── Convex row shapes (hand-mirrored from convex/projectEnvironments.ts) ───── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/environments.ts | 106 | // ── Public DTO mappers (clean `id`; no Convex `environmentId` leak) ────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/environments.ts | 303 | // ── Schemas ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/environments.ts | 370 | // ── Routes ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/hosts.ts | 35 | // ── Convex row shapes (mirrored from client/src/hooks/useClients.ts) ──────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/hosts.ts | 52 | // ── Public DTO mappers (clean names; no Convex `hostId` leak) ──────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/hosts.ts | 179 | // ── Schemas ───────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/hosts.ts | 219 | // ── Routes ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 92 | // ── Public authoring contract: TestStep[] ↔ internal case fields ────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 212 | // ── Request schema ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 330 | // ── Author-only suite-create schema ────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 434 | // ── Model validation ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 491 | // ── Concurrency gate ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 541 | // ── Convex read client ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 913 | // ── DTO mapping ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 1012 | // ── Public eval-edit surface: schemas, translation, DTOs ───────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 1105 | // ── Case DTO ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 1198 | // ── Suite-detail DTO ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 1660 | // ── Routes ─────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/evals.ts | 2249 | // ── Eval suite/case editing routes ─────────────────────────────────── | COMMENT |
| MEDIUM | mcpjam-inspector/server/routes/v1/agent-op-registry.ts | 235 | // ── Parameter preview ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | …or/server/routes/v1/__tests__/proposed-actions.test.ts | 186 | // ── The clicker is the authorizer ──────────────────────────────────── | COMMENT |
| MEDIUM | …or/server/routes/v1/__tests__/proposed-actions.test.ts | 276 | // ── The proposal is the contract ───────────────────────────────────── | COMMENT |
| 342 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | slack-app/railway.toml | 1 | # Railway service config for mcpjam-slack-app. | COMMENT |
| LOW | slack-app/railway.toml | 21 | # | COMMENT |
| LOW | slack-app/agent/turn-target.js | 221 | boundThread: true, | COMMENT |
| LOW | slack-app/agent/turn-runner.js | 341 | dedupe.release(eventKey); | COMMENT |
| LOW | slack-app/agent/turn-runner.js | 401 | // `proposed` server-side, so the buttons stay live. | COMMENT |
| LOW | slack-app/agent/turn-runner.js | 461 | dedupe.complete(eventKey); | COMMENT |
| LOW | slack-app/installations/store.js | 181 | const startedAtGeneration = currentGeneration(teamId); | COMMENT |
| LOW | slack-app/listeners/actions/proposal-button.js | 181 | // The wording follows the action's KIND, which the server sends. "It's away" | COMMENT |
| LOW | mcpjam-inspector/vite.main.config.ts | 41 | }, | COMMENT |
| LOW | mcpjam-inspector/server/app.ts | 101 | // dispatch classifies newly-added hosted models correctly. Memoized. | COMMENT |
| LOW | mcpjam-inspector/server/app.ts | 261 | app.route("/api/mcp", mcpRoutes); | COMMENT |
| LOW | mcpjam-inspector/server/app.ts | 321 | // auth (see session-auth.ts UNPROTECTED_PREFIXES) and no tokens returned; | COMMENT |
| LOW | mcpjam-inspector/server/tsup.config.ts | 41 | // Sentry packages with native modules must remain external | COMMENT |
| LOW | mcpjam-inspector/server/index.ts | 481 | // OUTSIDE /api so it bypasses session auth (analytics flows before any | COMMENT |
| LOW | mcpjam-inspector/server/middleware/session-auth.ts | 61 | "/api/apps/mcp-apps/", // MCP Apps widgets - loaded in sandboxed iframes, can't send headers | COMMENT |
| LOW | mcpjam-inspector/server/utils/log-scrubber.ts | 21 | const ALLOWLISTED_KEYS = new Set(["emaildomain"]); | COMMENT |
| LOW | mcpjam-inspector/server/utils/log-scrubber.ts | 41 | // upstream error messages routinely quote full URLs | COMMENT |
| LOW | mcpjam-inspector/server/utils/mrtr-hosted-chat.ts | 321 | ); | COMMENT |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 1281 | const { value, done } = await reader.read(); | COMMENT |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 2021 | onEngineError, | COMMENT |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 3101 | if (handled) { | COMMENT |
| LOW | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 3381 | cleanupError | COMMENT |
| LOW | mcpjam-inspector/server/utils/direct-chat-turn.ts | 661 | // (set in `prepareStep` below) narrows what the model sees, but a | COMMENT |
| LOW | mcpjam-inspector/server/utils/direct-chat-turn.ts | 921 | : undefined, | COMMENT |
| LOW | mcpjam-inspector/server/utils/local-server-resolver.ts | 581 | options?.clientCapabilities ?? | COMMENT |
| LOW | mcpjam-inspector/server/utils/local-server-resolver.ts | 641 | // Header precedence for HTTP servers: Convex-stored server headers form the | COMMENT |
| LOW | mcpjam-inspector/server/utils/local-server-resolver.ts | 701 | COMMENT | |
| LOW | …jam-inspector/server/utils/org-model-stream-handler.ts | 441 | // partials weren't persisted). `runDirectChatTurn.onPersist` fires | COMMENT |
| LOW | …jam-inspector/server/utils/org-model-stream-handler.ts | 601 | // of a partial transcript. | COMMENT |
| LOW | …pjam-inspector/server/utils/mcp-app-browser-harness.ts | 621 | deviceScaleFactor: 1, | COMMENT |
| LOW | …pjam-inspector/server/utils/mcp-app-browser-harness.ts | 821 | } | COMMENT |
| LOW | …pjam-inspector/server/utils/mcp-app-browser-harness.ts | 841 | // resource vs frame). Set before mount so first subresource fetches are | COMMENT |
| LOW | mcpjam-inspector/server/utils/org-model-config.ts | 361 | } | COMMENT |
| LOW | mcpjam-inspector/server/utils/client-ip.ts | 1 | import type { Context } from "hono"; | COMMENT |
| LOW | mcpjam-inspector/server/utils/hosted-egress-guard.ts | 201 | ); | COMMENT |
| LOW | mcpjam-inspector/server/utils/chat-v2-orchestration.ts | 1001 | COMMENT | |
| LOW | mcpjam-inspector/server/utils/chat-v2-orchestration.ts | 1021 | // Host-declined server tools (see `excludeMcpToolNames`). Deletes by name | COMMENT |
| LOW | mcpjam-inspector/server/utils/chat-v2-orchestration.ts | 1101 | // Returns its input UNCHANGED when no selected server declares the | COMMENT |
| LOW | mcpjam-inspector/server/utils/chat-v2-orchestration.ts | 1121 | // The user-assigned label from OUR registry, never | COMMENT |
| LOW | mcpjam-inspector/server/utils/chat-v2-orchestration.ts | 1201 | // WebMCP UI tools are exempt from progressive discovery: the catalog is | COMMENT |
| LOW | mcpjam-inspector/server/utils/resolve-turn-runtime.ts | 181 | // forwarded a provider string to `runDirectChatTurn`, so its llm/step | COMMENT |
| LOW | mcpjam-inspector/server/utils/assistant-turn.ts | 521 | capturedMessages = fullHistory; | COMMENT |
| LOW | mcpjam-inspector/server/utils/assistant-turn.ts | 541 | // SURFACE the fallback (not a silent emulated swap) so it's visible in logs/ | COMMENT |
| LOW | mcpjam-inspector/server/utils/assistant-turn.ts | 581 | ? await runHarnessTurn(handlerOptions, opts.streamSink) | COMMENT |
| LOW | mcpjam-inspector/server/utils/guest-spend-ip.ts | 41 | } | COMMENT |
| LOW | mcpjam-inspector/server/utils/chatbox-runtime-config.ts | 81 | // but a share-link visitor controls that body; trusting it would let anyone | COMMENT |
| LOW | mcpjam-inspector/server/utils/chatbox-runtime-config.ts | 101 | builtInToolIds?: string[]; | COMMENT |
| LOW | …inspector/server/utils/harness/e2b-sandbox-provider.ts | 141 | // provider both are the same operation — reconnect to the SAME long-lived box. | COMMENT |
| LOW | mcpjam-inspector/server/utils/harness/registry.ts | 441 | const m = modelId.toLowerCase(); | COMMENT |
| LOW | mcpjam-inspector/server/utils/harness/registry.ts | 621 | supportsNativeToolApproval: false, | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 441 | // attribution, fingerprint — relies on the canonical form, so a bare id can't | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 521 | let capturedHarnessCommit: HarnessSessionCommitPayload | undefined; | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 541 | // `stepStartedAt` clocks the synthetic per-step agent (llm) span — the span | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 741 | // (step 3b) and the CLI runs with dummy creds — the inspector never | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 761 | // | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 801 | : { mcpJson: { mcpServers: {} }, keyToServerId: {} }; | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 1001 | // Nothing is reserved, nothing is woken: the box exists, is live, and | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 1041 | } | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 1061 | // still bounds the write either way. | COMMENT |
| LOW | …jam-inspector/server/utils/harness/run-harness-turn.ts | 1121 | // (permissionMode was computed above, before the runtime fingerprint.) | COMMENT |
| 449 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …r/server/utils/__tests__/mcpjam-stream-handler.test.ts | 2406 | // Step 1: model returns a tool call. Step 2: tool result fed in, | COMMENT |
| LOW | …r/server/services/evals/__tests__/evals-runner.test.ts | 4223 | // Step 2: 25 in / 13 out cumulative (i.e. step 2 contributed | COMMENT |
| LOW | …r/server/services/evals/__tests__/evals-runner.test.ts | 4470 | // Step 1: model says "Step1 text", calls tool A, gets a result. | COMMENT |
| LOW | …r/server/services/evals/__tests__/evals-runner.test.ts | 4496 | // Step 2: model says "Step2 text", calls tool B, gets a result. | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 55 | ### Step 1: Tool Detection (`part-switch.tsx:77-225`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 103 | ### Step 2: Render MCPAppsRenderer (`part-switch.tsx:165-222`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 126 | ### Step 3: Fetch Widget HTML from Server (`mcp-apps-renderer.tsx:342-447`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 153 | ### Step 4: Server-Side Resource Fetching (`apps.ts:116-224`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 183 | ### Step 5: Create Double-Iframe Sandbox (`sandboxed-iframe.tsx`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 216 | ### Step 6: Sandbox Proxy Initialization (`sandbox-proxy.html`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 252 | ### Step 7: CSP Injection and HTML Loading (`sandbox-proxy.html:93-180`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 291 | ### Step 8: AppBridge Connection (`mcp-apps-renderer.tsx:849-930`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 323 | ### Step 9: Widget Initialization (Guest UI → Host) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 364 | ### Step 10: Send Tool Input & Result (`mcp-apps-renderer.tsx:938-977`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 391 | ### Step 11: Interactive Phase - Bridge Handlers (`mcp-apps-renderer.tsx:635-847`) | COMMENT |
| LOW | …nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md | 438 | ### Step 12: Host Context Updates (`mcp-apps-renderer.tsx:932-936`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 86 | ### Step 1: Origin Calculation (`sandboxed-iframe.tsx:90-109`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 122 | ### Step 2: Outer Iframe Creation (`sandboxed-iframe.tsx:213-222`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 163 | ### Step 3: Sandbox Proxy Loads (`sandbox-proxy.html:244-251`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 192 | ### Step 4: Host Receives Ready Signal (`sandboxed-iframe.tsx:130-174`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 230 | ### Step 5: Host Sends HTML & CSP (`sandboxed-iframe.tsx:192-210`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 265 | ### Step 6: Sandbox Proxy Builds CSP (`sandbox-proxy.html:93-181`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 339 | ### Step 7: CSP Injection into HTML (`sandbox-proxy.html:215-241`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 389 | ### Step 8: Inner Iframe Loading (`sandbox-proxy.html:254-306`) | COMMENT |
| LOW | …src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md | 443 | ### Step 9: Message Relay | COMMENT |
| LOW⚡ | …t/src/components/__tests__/OAuthFlowTab.agent.test.tsx | 236 | // Step 1: land on generate_pkce_parameters. | COMMENT |
| LOW⚡ | …t/src/components/__tests__/OAuthFlowTab.agent.test.tsx | 241 | // Step 2: the PKCE advance produces the authorization URL; the handler | COMMENT |
| LOW⚡ | …client/src/hooks/__tests__/use-persisted-host.test.tsx | 148 | // Step 1: re-affirm existing lead (the picker always sends the | COMMENT |
| LOW⚡ | …client/src/hooks/__tests__/use-persisted-host.test.tsx | 151 | // Step 2: write the new compare array including the new host. | COMMENT |
| LOW⚡ | …lient/src/hooks/__tests__/use-persisted-model.test.tsx | 35 | // Step 1: re-affirm existing lead (the picker always sends the | COMMENT |
| LOW⚡ | …lient/src/hooks/__tests__/use-persisted-model.test.tsx | 39 | // Step 2: write the new compare array including the new model. | COMMENT |
| LOW | sdk/tests/oauth/hardening-shared-pass.test.ts | 336 | // Step 1: fetch the CIMD document. | COMMENT |
| LOW | sdk/tests/oauth/hardening-shared-pass.test.ts | 353 | // Step 2: validate — must NOT issue a second fetch. | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2156 | // Step 9: Authorization URL is ready - user should open it in browser | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2166 | // Step 10: Validate authorization code and prepare for token exchange | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 956 | // Step 1: Make initial MCP request without token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1003 | // Step 2: Request MCP server and expect 401 Unauthorized via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1123 | // Step 3: Extract resource metadata URL and prepare request | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1175 | // Step 2: Fetch and parse resource metadata using official SDK helper | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1343 | // Step 3: Request Authorization Server Metadata | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1379 | // Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1618 | // Step 5: Client Registration (CIMD > Pre-registered > DCR) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1811 | // Step 6: Dynamic Client Registration (RFC 7591) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2047 | // Step 7: Generate PKCE parameters | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2091 | // Step 8: Build authorization URL | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2274 | // Step 11: Exchange authorization code for access token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2554 | // Step 12: Make an authenticated stateless MCP request to verify the | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2616 | // Step 13: Execute the authenticated stateless verify request | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1489 | // Step 9: Authorization URL is ready - user should open it in browser | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1499 | // Step 10: Validate authorization code and prepare for token exchange | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 574 | // Step 1: Make initial MCP request without token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 618 | // Step 2: Request MCP server and expect 401 Unauthorized via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 738 | // Step 3: Extract resource metadata URL and prepare request | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 790 | // Step 2: Fetch and parse resource metadata using official SDK helper | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 981 | // Step 3: Request Authorization Server Metadata | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1017 | // Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1158 | // Step 5: Dynamic Client Registration (if registration_endpoint exists) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1290 | // Step 6: Dynamic Client Registration (RFC 7591) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1391 | // Step 7: Generate PKCE parameters | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1428 | // Step 8: Build authorization URL | COMMENT |
| 30 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …k-app/tests/listeners/actions/run-suite-button.test.js | 61 | assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 1); | CODE |
| CRITICAL⚡ | …k-app/tests/listeners/actions/run-suite-button.test.js | 98 | assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 1); | CODE |
| CRITICAL⚡ | …k-app/tests/listeners/actions/run-suite-button.test.js | 99 | assert.strictEqual(args.client.chat.postEphemeral.mock.callCount(), 1); | CODE |
| CRITICAL⚡ | …k-app/tests/listeners/actions/run-suite-button.test.js | 106 | assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 0); | CODE |
| CRITICAL⚡ | …k-app/tests/listeners/actions/run-suite-button.test.js | 107 | assert.strictEqual(args.client.chat.postEphemeral.mock.callCount(), 1); | CODE |
| CRITICAL⚡ | …k-app/tests/listeners/actions/run-suite-button.test.js | 114 | assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 1); | CODE |
| CRITICAL | …k-app/tests/listeners/actions/run-suite-button.test.js | 141 | assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 0); | CODE |
| CRITICAL | …k-app/tests/listeners/actions/run-suite-button.test.js | 142 | assert.strictEqual(args.client.chat.postEphemeral.mock.callCount(), 1); | CODE |
| CRITICAL | …ack-app/tests/listeners/events/app-home-opened.test.js | 37 | assert.strictEqual(fakeClient.assistant.threads.setSuggestedPrompts.mock.callCount(), 0); | CODE |
| CRITICAL | …ack-app/tests/listeners/events/app-home-opened.test.js | 43 | assert.strictEqual(fakeClient.assistant.threads.setSuggestedPrompts.mock.callCount(), 1); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …r/server/utils/__tests__/mcpjam-stream-handler.test.ts | 2406 | // Step 1: model returns a tool call. Step 2: tool result fed in, | COMMENT |
| LOW | …r/server/services/evals/__tests__/evals-runner.test.ts | 4223 | // Step 2: 25 in / 13 out cumulative (i.e. step 2 contributed | COMMENT |
| LOW | …r/server/services/evals/__tests__/evals-runner.test.ts | 4470 | // Step 1: model says "Step1 text", calls tool A, gets a result. | COMMENT |
| LOW | …r/server/services/evals/__tests__/evals-runner.test.ts | 4496 | // Step 2: model says "Step2 text", calls tool B, gets a result. | COMMENT |
| LOW⚡ | …t/src/components/__tests__/OAuthFlowTab.agent.test.tsx | 236 | // Step 1: land on generate_pkce_parameters. | COMMENT |
| LOW⚡ | …t/src/components/__tests__/OAuthFlowTab.agent.test.tsx | 241 | // Step 2: the PKCE advance produces the authorization URL; the handler | COMMENT |
| LOW⚡ | …client/src/hooks/__tests__/use-persisted-host.test.tsx | 148 | // Step 1: re-affirm existing lead (the picker always sends the | COMMENT |
| LOW⚡ | …client/src/hooks/__tests__/use-persisted-host.test.tsx | 151 | // Step 2: write the new compare array including the new host. | COMMENT |
| LOW⚡ | …lient/src/hooks/__tests__/use-persisted-model.test.tsx | 35 | // Step 1: re-affirm existing lead (the picker always sends the | COMMENT |
| LOW⚡ | …lient/src/hooks/__tests__/use-persisted-model.test.tsx | 39 | // Step 2: write the new compare array including the new model. | COMMENT |
| LOW | sdk/tests/oauth/hardening-shared-pass.test.ts | 336 | // Step 1: fetch the CIMD document. | COMMENT |
| LOW | sdk/tests/oauth/hardening-shared-pass.test.ts | 353 | // Step 2: validate — must NOT issue a second fetch. | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2156 | // Step 9: Authorization URL is ready - user should open it in browser | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2166 | // Step 10: Validate authorization code and prepare for token exchange | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 956 | // Step 1: Make initial MCP request without token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1003 | // Step 2: Request MCP server and expect 401 Unauthorized via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1123 | // Step 3: Extract resource metadata URL and prepare request | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1175 | // Step 2: Fetch and parse resource metadata using official SDK helper | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1343 | // Step 3: Request Authorization Server Metadata | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1379 | // Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1618 | // Step 5: Client Registration (CIMD > Pre-registered > DCR) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 1811 | // Step 6: Dynamic Client Registration (RFC 7591) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2047 | // Step 7: Generate PKCE parameters | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2091 | // Step 8: Build authorization URL | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2274 | // Step 11: Exchange authorization code for access token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2554 | // Step 12: Make an authenticated stateless MCP request to verify the | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts | 2616 | // Step 13: Execute the authenticated stateless verify request | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1489 | // Step 9: Authorization URL is ready - user should open it in browser | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1499 | // Step 10: Validate authorization code and prepare for token exchange | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 574 | // Step 1: Make initial MCP request without token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 618 | // Step 2: Request MCP server and expect 401 Unauthorized via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 738 | // Step 3: Extract resource metadata URL and prepare request | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 790 | // Step 2: Fetch and parse resource metadata using official SDK helper | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 981 | // Step 3: Request Authorization Server Metadata | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1017 | // Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1158 | // Step 5: Dynamic Client Registration (if registration_endpoint exists) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1290 | // Step 6: Dynamic Client Registration (RFC 7591) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1391 | // Step 7: Generate PKCE parameters | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1428 | // Step 8: Build authorization URL | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1578 | // Step 11: Exchange authorization code for access token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1858 | // Step 12: Make authenticated MCP request (initialize to establish session) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts | 1917 | // Step 13: Make actual authenticated request to verify token (initialize with auth) | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 1106 | // Step 9: Wait for authorization code | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 1114 | // Step 10: Prepare token exchange | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 521 | // Step 2: Request MCP server and expect 401 or 200 | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 600 | // Step 3: Start authorization server metadata discovery | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 631 | // Step 4: Fetch authorization server metadata with fallback | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 791 | // Step 5: Client Registration | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 913 | // Step 6: Dynamic Client Registration | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 1014 | // Step 7: Generate PKCE parameters (REQUIRED for 2025-03-26) | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 1049 | // Step 8: Build authorization URL | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 1188 | // Step 11: Exchange authorization code for access token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 1449 | // Step 12: Make authenticated MCP request | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts | 1504 | // Step 13: Make actual authenticated request | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts | 1778 | // Step 9: Authorization URL is ready - user should open it in browser | COMMENT |
| LOW⚡ | sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts | 1788 | // Step 10: Validate authorization code and prepare for token exchange | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts | 681 | // Step 1: Make initial MCP request without token | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts | 725 | // Step 2: Request MCP server and expect 401 Unauthorized via backend proxy | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts | 844 | // Step 3: Extract resource metadata URL and prepare request | COMMENT |
| LOW | sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts | 896 | // Step 2: Fetch and parse resource metadata using official SDK helper | COMMENT |
| 9 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 743 | // agentic-loop catch). Optional. | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 1290 | // post-stream epilogue, and the outer agentic loop marked the | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 2175 | // Persist only once at the end of the full agentic loop via | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 2978 | // bringing down the agentic loop after a client disconnect. | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 2989 | // agentic loop), so a caller with only `write` cannot distinguish | COMMENT |
| MEDIUM | mcpjam-inspector/server/utils/mcpjam-stream-handler.ts | 3334 | // Site (3) — outer agentic-loop catch. No structured body, | COMMENT |
| MEDIUM | …jam-inspector/server/utils/harness/run-harness-turn.ts | 1341 | // caps MCPJam's *emulated* agentic loop; the harness exposes no equivalent | COMMENT |
| MEDIUM | …r/server/utils/__tests__/mcpjam-stream-handler.test.ts | 2747 | // on `traceTurn.turnSpans` during the agentic loop but only | COMMENT |
| MEDIUM | …r/server/utils/__tests__/mcpjam-stream-handler.test.ts | 2901 | // the outer agentic loop synthesized a finish and marked the | COMMENT |
| MEDIUM | …r/server/utils/__tests__/mcpjam-stream-handler.test.ts | 2942 | // (outer agentic-loop catch) instead of silently breaking the | COMMENT |
| MEDIUM | …r/server/utils/__tests__/mcpjam-stream-handler.test.ts | 2965 | // and the agentic loop treated the turn as successful. The result was a | COMMENT |
| MEDIUM | …r/server/services/evals/__tests__/evals-runner.test.ts | 2348 | // engine's agentic loop catches an error AFTER partial messages | COMMENT |
| MEDIUM | …-inspector/server/services/sessionSimulation/runner.ts | 656 | // agentic personas drive rendered widgets by screenshots. Evals stay | COMMENT |
| MEDIUM | mcpjam-inspector/docs/eval-agentic-interact-design.md | 1 | # Design: per-step agentic interact (computer-use) in evals | COMMENT |
| MEDIUM | mcpjam-inspector/docs/eval-agentic-interact-design.md | 129 | ## Deferred surface (explicit follow-on, not in the first agentic PR) | COMMENT |
| MEDIUM | sdk/src/HostRunner.ts | 796 | // Add response messages (assistant + tool messages from agentic loop) | COMMENT |
| MEDIUM | sdk/src/tool-extraction.ts | 20 | // Extract from steps (multi-step agentic loop) | COMMENT |
| MEDIUM | .github/workflows/mintlify-shepherd.yml | 3 | # Deterministic janitor for Mintlify bot PRs. The event-driven triage workflow | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …-inspector/server/utils/__tests__/log-scrubber.test.ts | 49 | expect(scrubLogPayload({ email: "user@example.com" })).toEqual({ | CODE |
| LOW | …-inspector/server/utils/__tests__/log-scrubber.test.ts | 85 | expect(result.message).not.toContain("user@example.com"); | CODE |
| LOW | …-inspector/server/routes/web/__tests__/caniuse.test.ts | 287 | { email: "user@example.com" }, | CODE |
| LOW | …-inspector/server/routes/web/__tests__/caniuse.test.ts | 304 | body: JSON.stringify({ email: "user@example.com" }), | CODE |
| LOW | …spector/server/services/__tests__/xaa-mint-dcr.test.ts | 72 | email: "user@example.com", | CODE |
| LOW | …ts/sidebar/__tests__/sidebar-context-switcher.test.tsx | 228 | user: { id: "user_1", email: "user@example.com" }, | CODE |
| LOW | …ents/connection/share-usage/ShareUsageThreadDetail.tsx | 638 | widgetPolicy="placeholder" | CODE |
| LOW | …/share-usage/__tests__/ShareUsageThreadDetail.test.tsx | 171 | widgetPolicy: "placeholder", | CODE |
| LOW | …ponents/chat-v2/thread/mcp-apps/checkout-dialog-v2.tsx | 180 | setName("John Doe"); | CODE |
| LOW | …ponents/chat-v2/thread/mcp-apps/checkout-dialog-v2.tsx | 183 | setLine1("123 Main St"); | CODE |
| LOW | …t/src/components/xaa/__tests__/IdJagInspector.test.tsx | 37 | email: "user@example.com", | CODE |
| LOW | …t/src/components/__tests__/ProjectSettingsTab.test.tsx | 30 | useAuth: () => ({ user: { email: "admin@example.com" } }), | CODE |
| LOW | …t/src/components/__tests__/ProjectSettingsTab.test.tsx | 100 | { email: "admin@example.com", role: "admin", projectRole: "admin" }, | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 778 | email: "admin@example.com", | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 785 | email: "admin@example.com", | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 794 | user: { email: "admin@example.com" }, | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 842 | email: "admin@example.com", | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 849 | email: "admin@example.com", | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 858 | user: { email: "admin@example.com" }, | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 970 | email: "admin@example.com", | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 977 | email: "admin@example.com", | CODE |
| LOW⚡ | …components/__tests__/OrganizationsTab.billing.test.tsx | 986 | user: { email: "admin@example.com" }, | CODE |
| LOW | …c/components/__tests__/OrganizationsTab.admin.test.tsx | 172 | createMember({ email: "admin@example.com", role: "admin" }), | CODE |
| LOW | …c/components/__tests__/OrganizationsTab.admin.test.tsx | 185 | createMember({ email: "admin@example.com", role: "admin" }), | CODE |
| LOW | …c/components/__tests__/OrganizationsTab.admin.test.tsx | 299 | currentUserEmail = "admin@example.com"; | CODE |
| LOW | …onents/swarms/__tests__/journey-rubric-editor.test.tsx | 152 | expect(input).toHaveAttribute("placeholder", "Fewer than 3 user turns"); | CODE |
| LOW | …spector/client/src/__tests__/App.hosted-oauth.test.tsx | 35 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 66 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 76 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 132 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 142 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 183 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 194 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 207 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 218 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 229 | email: "user@example.com", | CODE |
| LOW | …/client/src/hooks/__tests__/usePostHogIdentify.test.ts | 240 | email: "user@example.com", | CODE |
| LOW | …/client/src/lib/xaa/__tests__/sequence-actions.test.ts | 25 | email: "user@example.com", | CODE |
| LOW | …pector/client/src/lib/xaa/__tests__/idjag-lint.test.ts | 21 | email: "user@example.com", | CODE |
| LOW | …pector/client/src/lib/xaa/__tests__/idjag-lint.test.ts | 233 | expect(verdict.actual).toContain("user@example.com"); | CODE |
| LOW | sdk/tests/error-describer/describe.test.ts | 342 | const err = new Error("placeholder"); | CODE |
| LOW | sdk/tests/plugin-bundle/parse-plugin-bundle.test.ts | 285 | minimalBundle({ "assets/screenshots/main.txt": "placeholder" }) | CODE |
| LOW | chat-ui/README.md | 33 | widgetPolicy="placeholder" | CODE |
| LOW | chat-ui/README.md | 51 | | `widgetPolicy` | `"placeholder" \| "hidden"` | `"placeholder"` | CODE |
| LOW | chat-ui/src/message-view.tsx | 55 | widgetPolicy = "placeholder", | CODE |
| LOW | chat-ui/src/types.ts | 7 | export type WidgetPolicy = "placeholder" | "hidden"; | CODE |
| LOW | chat-ui/src/read-only-transcript.tsx | 58 | widgetPolicy = "placeholder", | CODE |
| LOW | chat-ui/src/part-switch.tsx | 72 | widgetPolicy = "placeholder", | CODE |
| LOW | chat-ui/src/part-switch.tsx | 144 | } else if (widgetPolicy === "placeholder") { | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/convex-health-check.sh | 4 | # Usage: | COMMENT |
| LOW | .github/scripts/railway-set-vars.sh | 10 | # Usage: | COMMENT |
| LOW | .github/scripts/workos-cleanup.sh | 4 | # Usage: | COMMENT |
| LOW | .github/scripts/railway-env.sh | 10 | # Usage: | COMMENT |
| LOW | .github/scripts/railway-retry.sh | 4 | # Usage: | COMMENT |
| LOW | .github/scripts/railway-wait-deploy.sh | 14 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | mcpjam-inspector/server/routes/mcp/http-adapters.ts | 192 | // Unified HTTP adapter for adapter-http + manager-http (same robust | COMMENT |
| MEDIUM | …spector/client/src/components/evals/judges-section.tsx | 95 | // manual). The nuanced "enabled but manual-only" state stays reachable | COMMENT |
| LOW | .github/workflows/mintlify-triage.yml | 95 | # reached no outcome — failing it would just add noise. | COMMENT |