3.5

Adjusted Signal

3.5

Raw Pattern Score

100%

Time Factor

2026-11-01

Last Push

2.3K

Stars

TypeScript

Language

2.8M

Lines of Code

8.8K

Files

6.9K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 5572 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.7/100 · LOW

Are imports declared and package/API names verified? 127 finding(s).

Agent Over-Engineering Ratio 12.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 5011 finding(s).

PR Review Velocity Impact 16.0/100 · LOW

Which changes need focused human review? 6861 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 13HIGH 15MEDIUM 1277LOW 5556

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 6861 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers3849 hits · 3846 pts

Severity	File	Line	Snippet	Context
LOW	slack-app/agent/durable-delivery.js	38	export function startDurableDeliveryRecovery(logger) {	CODE
LOW	slack-app/listeners/actions/journey-run-watcher.js	123	export async function announceAndWatchJourneyRun(client, args) {	CODE
LOW	slack-app/listeners/views/agent-reply-builder.js	127	export function buildCreatedResourceBlocks(createdResources, opts = {}) {	CODE
LOW	discord-app/commands.js	58	export function resolveCommandRegistration({ applicationId, devGuildId } = {}) {	CODE
LOW	discord-app/context.js	54	export function deriveConversationContext(channel, fallbackChannelId) {	CODE
LOW	mcpjam-inspector/bin/start.js	346	async function openTerminalWithMultipleCommands(commands, title) {	CODE
LOW	mcpjam-inspector/bin/start.js	378	async function setupOllamaInSingleTerminal(model) {	CODE
LOW	mcpjam-inspector/server/index.ts	322	function getInspectorFrontendUrlOptions() {	CODE
LOW	mcpjam-inspector/server/env.ts	123	function replaceConvexHostnameSuffix(	CODE
LOW	mcpjam-inspector/server/env.ts	147	export function getInspectorClientRuntimeConfig(): InspectorClientRuntimeConfig {	CODE
LOW	mcpjam-inspector/server/env.ts	206	export function getConfiguredConvexOrigins(): {	CODE
LOW	mcpjam-inspector/server/env.ts	232	export function getInspectorClientRuntimeConfigScript(): string \| null {	CODE
LOW	mcpjam-inspector/server/env.ts	295	export function describeGuestAuthorityMismatch(args: {	CODE
LOW	mcpjam-inspector/server/env.ts	322	function warnOnGuestAuthorityMismatch(env: LoadedInspectorEnv): void {	CODE
LOW	mcpjam-inspector/server/env.ts	337	export function warnOnConvexDevMisconfiguration(env: LoadedInspectorEnv): void {	CODE
LOW	mcpjam-inspector/server/config.ts	143	export function browserShapeRedactionEnabled(	CODE
LOW	mcpjam-inspector/server/config.ts	154	export function browserSecretPlaceholdersEnabled(	CODE
LOW	…pector/server/middleware/registry-derive-rate-limit.ts	56	export function resetRegistryDeriveRateLimitForTests(): void {	CODE
LOW	…pector/server/middleware/registry-derive-rate-limit.ts	60	export function consumeRegistryDeriveRateLimit(c: Context): Response \| null {	CODE
LOW	…pector/server/middleware/registry-derive-rate-limit.ts	100	export async function registryDeriveRateLimitMiddleware(	CODE
LOW	…pjam-inspector/server/middleware/slack-service-auth.ts	187	export function resetSlackRateLimitForTests(): void {	CODE
LOW	…pjam-inspector/server/middleware/slack-service-auth.ts	369	export function isValidDiscordServiceToken(token: string): boolean {	CODE
LOW	…erver/middleware/server-connection-claim-rate-limit.ts	55	function createIpFixedWindowLimiter(options: {	CODE
LOW	…erver/middleware/server-connection-claim-rate-limit.ts	143	export function resetServerConnectionClaimRateLimitForTests(): void {	CODE
LOW	…erver/middleware/server-connection-claim-rate-limit.ts	158	export function resetServerConnectionStateRateLimitForTests(): void {	CODE
LOW	…erver/middleware/server-connection-claim-rate-limit.ts	175	export function resetServerConnectionAuthorizeRateLimitForTests(): void {	CODE
LOW	mcpjam-inspector/server/middleware/bearer-auth.ts	123	export function resetWorkOSRateLimitForTests(): void {	CODE
LOW	mcpjam-inspector/server/middleware/bearer-auth.ts	143	function canValidateWorkosApiKeysHere(): boolean {	CODE
LOW	mcpjam-inspector/server/middleware/bearer-auth.ts	470	function warnAuthKitKeysUnavailable(	CODE
LOW	mcpjam-inspector/server/middleware/bearer-auth.ts	489	export function resetAuthKitKeysWarningForTests(): void {	CODE
LOW	mcpjam-inspector/server/middleware/indexing-headers.ts	92	export async function indexingHeadersMiddleware(	CODE
LOW	…nspector/server/middleware/mcp-operation-rate-limit.ts	298	return async function mcpOperationRateLimitMiddleware(	CODE
LOW	…nspector/server/middleware/mcp-operation-rate-limit.ts	319	export function mcpOperationRateLimitSizeForTests(): number {	CODE
LOW	…nspector/server/middleware/mcp-operation-rate-limit.ts	323	export function resetMcpOperationRateLimitForTests(): void {	CODE
LOW	…m-inspector/server/middleware/internal-service-auth.ts	55	export function getConfiguredInspectorServiceToken(): string \| null {	CODE
LOW	…m-inspector/server/middleware/internal-service-auth.ts	74	export function isAuthorizedInternalServiceRequest(c: Context): boolean {	CODE
LOW	…m-inspector/server/middleware/internal-service-auth.ts	88	export function internalServiceAuthMiddleware(): MiddlewareHandler {	CODE
LOW	…-inspector/server/middleware/passthrough-rate-limit.ts	241	export async function passthroughRateLimitMiddleware(	CODE
LOW	…-inspector/server/middleware/passthrough-rate-limit.ts	311	export function resetPassthroughRateLimitForTests(): void {	CODE
LOW	mcpjam-inspector/server/middleware/audio-daily-limit.ts	129	export function resetAudioDailyLimitForTests(): void {	CODE
LOW	mcpjam-inspector/server/middleware/audio-daily-limit.ts	134	export function audioDailyLimitWindowCountForTests(): number {	CODE
LOW	mcpjam-inspector/server/middleware/audio-daily-limit.ts	166	export async function audioDailyLimitMiddleware(	CODE
LOW	…jam-inspector/server/middleware/request-log-context.ts	51	function captureUnreportedAgentFailure(	CODE
LOW	…jam-inspector/server/middleware/request-log-context.ts	133	export async function requestLogContextMiddleware(c: Context, next: Next) {	CODE
LOW	mcpjam-inspector/server/middleware/origin-validation.ts	96	function getConfiguredAllowedHosts(): string[] {	CODE
LOW	mcpjam-inspector/server/middleware/origin-validation.ts	124	function getWildcardGatedAllowedHosts(): string[] {	CODE
LOW	mcpjam-inspector/server/middleware/origin-validation.ts	262	export async function originValidationMiddleware(	CODE
LOW⚡	…pector/server/middleware/conformance-run-rate-limit.ts	55	export function resetConformanceRunRateLimitForTests(): void {	CODE
LOW⚡	…pector/server/middleware/conformance-run-rate-limit.ts	60	export function conformanceRunRateLimitWindowCountForTests(): number {	CODE
LOW⚡	…pector/server/middleware/conformance-run-rate-limit.ts	66	export async function conformanceRunRateLimitMiddleware(	CODE
LOW	…am-inspector/server/middleware/surface-service-auth.ts	43	export function isValidDiscordServiceToken(token: string): boolean {	CODE
LOW	…m-inspector/server/middleware/require-verified-auth.ts	77	return async function requireVerifiedAuthMiddleware(c: Context, next: Next) {	CODE
LOW	…pjam-inspector/server/middleware/session-revocation.ts	74	export function sessionCheckUnavailableResponse(c: Context): Response {	CODE
LOW	…pector/server/middleware/require-service-credential.ts	15	export function requireServiceCredentialRoute(	CODE
LOW	…-inspector/server/middleware/sandbox-host-partition.ts	131	export function applySandboxHostPartition(app: Hono): void {	CODE
LOW	mcpjam-inspector/server/middleware/security-headers.ts	204	export function buildReportOnlyContentSecurityPolicy(	CODE
LOW	mcpjam-inspector/server/middleware/security-headers.ts	218	function reportOnlyContentSecurityPolicy(scriptNonce: string \| undefined): string {	CODE
LOW	mcpjam-inspector/server/middleware/security-headers.ts	228	export function resetContentSecurityPolicyForTests(): void {	CODE
LOW	mcpjam-inspector/server/middleware/security-headers.ts	277	export async function securityHeadersMiddleware(	CODE
LOW	…m-inspector/server/middleware/mcp-egress-rate-limit.ts	48	function isTransientCoordinatorError(error: unknown): boolean {	CODE
3789 more matches not shown…

Decorative Section Separators1162 hits · 3502 pts

Severity	File	Line	Snippet	Context
MEDIUM	slack-app/railway.toml	17	# ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	slack-app/railway.toml	33	# ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	discord-app/app.js	164	// ── /mcpjam connect ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	discord-app/app.js	199	// ── The agent turn ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	discord-app/app.js	380	// ── Approval buttons ────────────────────────────────────────────────────────	COMMENT
MEDIUM	discord-app/app.js	540	// ── Slash-command registration ──────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	3	// ── Why this exists ──────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	22	// ── Why the ordering matters ─────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	28	// ── What it is not ───────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/config.ts	251	// ── Hosted elicitation (MCP 2025-11-25) ─────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/config.ts	283	// ── Hosted MRTR continuation transport (MCP 2026-07-28 §12.5) ────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/ui-resource-meta.ts	328	// ── csp ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/ui-resource-meta.ts	346	// ── permissions ──────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/ui-resource-meta.ts	358	// ── prefersBorder ────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/ui-resource-meta.ts	376	// ── domain ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/chat-stream-chunks.ts	45	// ── text ─────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/chat-stream-chunks.ts	55	// ── reasoning ────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/chat-stream-chunks.ts	68	// ── tools ────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/chat-stream-chunks.ts	124	// ── finish / error ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/chat-stream-chunks.ts	143	// ── emit wrappers (build + write, return the chunk) ──────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	5573	// ── Hosted MRTR resume pre-phase (§12.5, PR5) ─────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/server-skill-tools.ts	729	// ── listSkills ───────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/server-skill-tools.ts	773	// ── loadSkill ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/server-skill-tools.ts	896	// ── listSkillFiles ───────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/server-skill-tools.ts	925	// ── readSkillFile ────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mrtr-hosted-collector.ts	72	// ── Suspend signal ─────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	mcpjam-inspector/server/utils/mrtr-hosted-collector.ts	153	// ── Binding fingerprint ──────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mrtr-hosted-collector.ts	474	// ── Safe display ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mrtr-hosted-collector.ts	591	// ── Suspending collector ──────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mrtr-hosted-collector.ts	717	// ── Resume primitive ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…jam-inspector/server/utils/model-selection-settings.ts	206	// ── Reasoning effort on a direct provider call ─────────────────────────────	COMMENT
MEDIUM	…pjam-inspector/server/utils/mrtr-continuation-state.ts	39	// ── Wire contract (mirrors mcpjam-backend PR3a — keep in sync by hand) ────────	COMMENT
MEDIUM	…pjam-inspector/server/utils/mrtr-continuation-state.ts	120	// ── HTTP plumbing (mirrors harness-session-state.postSessionState) ────────────	COMMENT
MEDIUM	…pjam-inspector/server/utils/mrtr-continuation-state.ts	240	// ── Codec ─────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…pjam-inspector/server/utils/mrtr-continuation-state.ts	360	// ── Client (one function per FROZEN route) ────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/history-provenance.ts	249	// ── signatures ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/history-provenance.ts	587	// ── metadata helpers ───────────────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/history-provenance.ts	653	// ── 1. signing a live stream ───────────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/history-provenance.ts	970	// ── 2. verifying what comes back ───────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/history-provenance.ts	1322	// ── 1b. signing what gets persisted ────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/history-provenance.ts	1494	// ── 3 + 4. what the model is shown ─────────────────────────────────────────	COMMENT
MEDIUM	mcpjam-inspector/server/utils/computers/cloud-skills.ts	275	// ── supporting files (v2) ──────────────────────────────────────────────────	COMMENT
MEDIUM	…spector/server/utils/computers/convex-skills-client.ts	353	// ── supporting files (v2) ──────────────────────────────────────────────────	COMMENT
MEDIUM	…inspector/server/utils/harness/e2b-sandbox-provider.ts	407	// ── file I/O ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…inspector/server/utils/harness/e2b-sandbox-provider.ts	459	// ── exec ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	…inspector/server/utils/harness/e2b-sandbox-provider.ts	493	// ── spawn (long-lived; adapt E2B callbacks → ReadableStreams) ──────	COMMENT
MEDIUM	…inspector/server/utils/harness/e2b-sandbox-provider.ts	594	// ── infra surface ─────────────────────────────────────────────────	COMMENT
MEDIUM	…spector/server/utils/harness/harness-provider-error.ts	100	// ── Codex app-server ─────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/utils/harness/docker/docker-sandbox-provider.ts	390	// ── file I/O ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/utils/harness/docker/docker-sandbox-provider.ts	422	// ── exec ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	…server/utils/harness/docker/docker-sandbox-provider.ts	543	// ── infra surface ─────────────────────────────────────────────────	COMMENT
MEDIUM	…ess/docker/__tests__/hosted-harness-docker.e2e.test.ts	351	// ── Normalization ────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…ctor/server/utils/harness/local/supervised-provider.ts	927	// ── file I/O (confined to the granted roots) ──────────────────────	COMMENT
MEDIUM	…ctor/server/utils/harness/local/supervised-provider.ts	1004	// ── exec ──────────────────────────────────────────────────────────	COMMENT
MEDIUM	…ctor/server/utils/harness/local/supervised-provider.ts	1148	// ── infra surface ─────────────────────────────────────────────────	COMMENT
MEDIUM	…pector/server/utils/harness/local/runtime-lifecycle.ts	457	// ── Runtime use ─────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…pector/server/utils/harness/local/runtime-lifecycle.ts	559	// ── Staging ownership ───────────────────────────────────────────────────────	COMMENT
MEDIUM	…jam-inspector/server/utils/harness/local/local-turn.ts	354	// ── Reserve the runtime BEFORE verifying it ──────────────────────────────	COMMENT
MEDIUM	…nspector/server/utils/harness/local/runtime-install.ts	1478	// ── disk-space ──────────────────────────────────────────────────────	COMMENT
MEDIUM	…nspector/server/utils/harness/local/runtime-install.ts	1502	// ── download ────────────────────────────────────────────────────────	COMMENT
1102 more matches not shown…

Over-Commented Block1441 hits · 1328 pts

Severity	File	Line	Snippet	Context
LOW	slack-app/railway.toml	1	# Railway service config for mcpjam-slack-app.	COMMENT
LOW	slack-app/railway.toml	21	#	COMMENT
LOW	slack-app/tests/user-value-chain-labels.test.js	81	// different question from the chain sentence: not WHERE the request stopped	COMMENT
LOW	slack-app/tests/listeners/actions/run-watcher.test.js	221	// the EMPTY-ITEMS path under a comment claiming to test `unverified`.	COMMENT
LOW	slack-app/installations/store.js	181	const startedAtGeneration = currentGeneration(teamId);	COMMENT
LOW	slack-app/listeners/actions/proposal-button.js	281	});	COMMENT
LOW	slack-app/listeners/views/app-home-builder.js	121	// being truncated, so both caps are applied here.	COMMENT
LOW	.spike-codex-appserver/schema/regen.sh	1	#!/usr/bin/env bash	COMMENT
LOW	discord-app/app.js	61	// put this client on a second source of truth: `config.convexServiceToken`	COMMENT
LOW	discord-app/app.js	301	// never worked; binding on a channel-mode target would claim a	COMMENT
LOW	vitest/src/index.ts	301	// omission. `GateReport` gained a `waived` outcome for the HOSTED	COMMENT
LOW	mcpjam-inspector/vite.main.config.ts	81	// No importer means this is an entry point. `build.lib.entry` is	COMMENT
LOW	mcpjam-inspector/vite.main.config.ts	221	// `src/main.ts` dynamically imports the WHOLE server, so the server's	COMMENT
LOW	mcpjam-inspector/vite.main.config.ts	241	"playwright",	COMMENT
LOW	mcpjam-inspector/vite.main.config.ts	261	// eagerly at startup — defeating the fix for PR #2418's	COMMENT
LOW	mcpjam-inspector/vite.preload.config.ts	1	import { defineConfig } from "vite";	COMMENT
LOW	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	1	// mcpjam-job-launcher — whole-tree cleanup for the local harness on Windows.	COMMENT
LOW	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	21	//	COMMENT
LOW	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	61	}	COMMENT
LOW	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	121		COMMENT
LOW	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	221	// `self` is this process's own image, and it is resolved BEFORE anything is	COMMENT
LOW	mcpjam-inspector/tools/mcpjam-job-launcher/main.go	281	}	COMMENT
LOW	mcpjam-inspector/server/sentry.ts	61	),	COMMENT
LOW	mcpjam-inspector/server/app.ts	161		COMMENT
LOW	mcpjam-inspector/server/app.ts	341	} else {	COMMENT
LOW	mcpjam-inspector/server/app.ts	381	// Browser Panel data plane (W4): watch the browser an agent is driving, and	COMMENT
LOW	mcpjam-inspector/server/app.ts	461	// in server/index.ts for why the gate had to go.	COMMENT
LOW	mcpjam-inspector/server/app.ts	481	// session exists), and mounted before the static/SPA fallback, whose	COMMENT
LOW	mcpjam-inspector/server/tsup.config.ts	81	"posthog-node",	COMMENT
LOW	mcpjam-inspector/server/index.ts	361		COMMENT
LOW	mcpjam-inspector/server/index.ts	381	// server/app.ts::createHonoApp.	COMMENT
LOW	mcpjam-inspector/server/index.ts	481		COMMENT
LOW	mcpjam-inspector/server/index.ts	501	// the DEPLOY, not about any page: only this process knows which hostnames it	COMMENT
LOW	mcpjam-inspector/server/index.ts	561	}	COMMENT
LOW	mcpjam-inspector/server/index.ts	581	app.route("/api/internal/agent-turns", internalAgentTurns);	COMMENT
LOW	mcpjam-inspector/server/index.ts	681	resolveWorkosApiBaseUrl(process.env);	COMMENT
LOW	mcpjam-inspector/server/index.ts	701		COMMENT
LOW	mcpjam-inspector/server/index.ts	721	app.route("/tlm", relayRoutes);	COMMENT
LOW	mcpjam-inspector/server/index.ts	1081	// Inside the guarded path so a rejecting worker still reaches the rest of	COMMENT
LOW	mcpjam-inspector/server/index.ts	1101	// that `server.close()` would leave attached to an exiting process.	COMMENT
LOW	mcpjam-inspector/server/env.ts	161	) ?? normalizeUrlOrigin(process.env.VITE_CONVEX_URL);	COMMENT
LOW	mcpjam-inspector/server/middleware/session-auth.ts	61	// non-/api bypass: analytics must flow before any session exists. It must	COMMENT
LOW	mcpjam-inspector/server/middleware/session-auth.ts	81	// in when they arrive — establishing who they are is the entire point of	COMMENT
LOW	mcpjam-inspector/server/middleware/session-auth.ts	101	// `/api/internal/server-connections/dispatch`, so the slash costs nothing.	COMMENT
LOW	mcpjam-inspector/server/middleware/bearer-auth.ts	381	c.set("guestId", result.guestId);	COMMENT
LOW	mcpjam-inspector/server/middleware/bearer-auth.ts	441	// middleware forward the bearer to Convex, which verifies it anyway.	COMMENT
LOW	…-inspector/server/middleware/passthrough-rate-limit.ts	261	const tokenKey = token === null ? null : bearerKey(token);	COMMENT
LOW	mcpjam-inspector/server/middleware/web-body-limit.ts	21	export const DEFAULT_WEB_BODY_LIMIT = 1024 * 1024; // 1MB	COMMENT
LOW	mcpjam-inspector/server/middleware/web-body-limit.ts	41	//	COMMENT
LOW	…er/middleware/__tests__/passthrough-rate-limit.test.ts	321	});	COMMENT
LOW	mcpjam-inspector/server/utils/v1-convex-token.ts	41		COMMENT
LOW	mcpjam-inspector/server/utils/mrtr-hosted-chat.ts	321	);	COMMENT
LOW	mcpjam-inspector/server/utils/host-runtime-config.ts	141	// token empty) is recognized as blank rather than sent on as the	COMMENT
LOW	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	721	// rule below: see {@link orgPolicyRefusalSlug}.	COMMENT
LOW	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	2481	// declaration is handed. Both REQUIRED and both positioned before the	COMMENT
LOW	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	2581	// the loop. processStream then returned NORMALLY with whatever	COMMENT
LOW	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	2881	// `mcpjam_rate_limit`, i.e. OUR outage.	COMMENT
LOW	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	3401	return false;	COMMENT
LOW	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	3801	onModelHandover,	COMMENT
LOW	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	3961	// that resolves the study's model and tools. This proof is required even	COMMENT
1381 more matches not shown…

AI Slop Vocabulary89 hits · 345 pts

Severity	File	Line	Snippet	Context
MEDIUM	…pector/server/utils/harness/host-executed-mcp-tools.ts	23	* ## Direct, not through the harness MCP proxy	COMMENT
MEDIUM	mcpjam-inspector/server/routes/mcp/http-adapters.ts	169	// Unified HTTP adapter for adapter-http + manager-http (same robust	COMMENT
MEDIUM⚡	.github/dependabot.yml	90	# The AI SDK harness adapters are pinned to the exact version the local	COMMENT
MEDIUM⚡	.github/dependabot.yml	91	# harness evidence was gathered against (`adapterVersion` in	COMMENT
MEDIUM⚡	.github/dependabot.yml	92	# mcpjam-inspector/server/utils/harness/local/compatibility.ts), because	COMMENT
MEDIUM	.github/dependabot.yml	128	# so even its patches need a person. The harness adapters keep their own	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	1	# The publication pipeline for ONE harness's runtime pack, end to end:	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	6	# Called by `local-harness-pack-prebuild.yml` in the background when a pack	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	8	# `prepare-release.yml`, once per harness, before it opens the version PR —	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	9	# which adopts what the prebuild published. The pipeline writes nothing to main: each harness hands the	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	10	# release a `local-harness-pin-<harness>` artifact (a pin, an equivalence	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	17	# re-derives its plan from what exists, keyed by (harness, inputs fingerprint)	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	18	# — see `scripts/local-harness-publication.mjs`:	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	32	# release"), and the `report` job says exactly that in the harness's failure	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	40	# in them. `local-harness-pack.yml` is, and is what it calls to build.	COMMENT
MEDIUM	.github/workflows/local-harness-pack-pipeline.yml	71	# The conformance workflow takes one version input per harness.	COMMENT
MEDIUM	.github/workflows/local-harness-pack-pipeline.yml	113	# per harness, and a missing one means a pipeline that did not finish.	COMMENT
MEDIUM	.github/workflows/release.yml	72	# Read only: the local harness gate verifies pinned packs' provenance.	COMMENT
MEDIUM	.github/workflows/release.yml	73	# `local-harness-contract` grants itself the OIDC and attestation writes it	COMMENT
MEDIUM⚡	.github/workflows/release.yml	283	# provenance from local-harness-pack.yml on main (and every equivalence	COMMENT
MEDIUM⚡	.github/workflows/release.yml	284	# record relied on, from local-harness-pack-pipeline.yml) — signed by our	COMMENT
MEDIUM⚡	.github/workflows/release.yml	294	# Every pack this build may SELECT: the desired one per harness, and the	COMMENT
MEDIUM	.github/workflows/release.yml	651	# harness runtime contract succeeded: the npm Inspector offers local	COMMENT
MEDIUM	.github/workflows/release.yml	1068	# Attested by `local-harness-contract`: the layer digest and the packs	COMMENT
MEDIUM	.github/workflows/release.yml	1150	# release (`v`, not a `local-harness-pack-` one) by date. 30 reaches	COMMENT
MEDIUM	.github/workflows/local-harness-conformance.yml	14	# may select (`check-local-harness-release.mjs --evidence`).	COMMENT
MEDIUM	.github/workflows/local-harness-conformance.yml	19	# run where is `scripts/plan-local-harness-conformance.mjs`.	COMMENT
MEDIUM	.github/workflows/local-harness-conformance.yml	102	# The versions AND the harness selection: a release calls this twice (its	COMMENT
MEDIUM	.github/workflows/local-harness-conformance.yml	172	# The SDK first: the browser harness bundle in `pretest` pulls in	COMMENT
MEDIUM	.github/workflows/local-harness-conformance.yml	875	# harness's evidence certifies that harness alone (D4).	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-prebuild.yml	3	# Builds local-harness runtime packs IN THE BACKGROUND, ahead of the release	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-prebuild.yml	5	# Node, the build scripts), this runs `local-harness-pack-pipeline.yml` for	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-prebuild.yml	6	# every harness: one whose inputs did not move is up to date in a minute; one	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-prebuild.yml	12	# path. A failure opens the harness's failure issue days before anyone starts a	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-prebuild.yml	15	# One pipeline per harness at a time: it shares the `local-harness-pack-<id>`	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack-prebuild.yml	19	# one planning job per harness.	COMMENT
MEDIUM	.github/workflows/local-harness-pack-prebuild.yml	67	# Signing that waits for a person would hold the per-harness group	COMMENT
MEDIUM	.github/workflows/lint.yml	102	# harness moves (in the job summary). The release gate is still strict.	COMMENT
MEDIUM	.github/workflows/lint.yml	106	# No `check-local-harness-release.mjs --assets` here. It compares the	COMMENT
MEDIUM	.github/workflows/test.yml	456	# See mcpjam-inspector/e2e/telemetry/browser-harness.ts.	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	1	# Builds a local-harness runtime pack — the per-platform tree a supervised	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	2	# native harness (Claude Code, Codex) launches from. One harness per run: each	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	3	# harness's pack has its own semver and its own release	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	4	# (`local-harness-pack-v<ver>` for Claude Code, which keeps the names it first	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	5	# shipped under; `local-harness-pack-<harness>-v<ver>` for every other one).	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	18	# pipeline (`local-harness-pack-pipeline.yml`) is what normally calls this;	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	75	# this file is a pack input of EVERY harness, and a choice list naming	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	76	# them would make adding a harness republish all the others.	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	191	# Only the harness recipe's inputs are needed: the pack build reads the	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	296	# The build refuses a harness with no recipe module.	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	375	# The FLAT map too. `docs/local-harness.md` tells an operator to paste	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	384	# Scoped to this harness and version, here and in `sign`/`publish`:	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	386	# every harness in ONE run, so a bare `local-harness-pack-*` picks up	COMMENT
MEDIUM⚡	.github/workflows/local-harness-pack.yml	387	# the other harness's packs too.	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	467	# The signing key lives in the `local-harness-pack-release` environment,	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	470	# the pack — not by a person approving this job (see docs/local-harness.md).	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	526	# Finishing a complete draft this harness's earlier run left behind: its	COMMENT
MEDIUM	.github/workflows/local-harness-pack.yml	565	# Mirrors packReleaseTag in scripts/local-harness-pack-harnesses.mjs.	COMMENT
MEDIUM⚡	.github/workflows/hosted-harness-docker.yml	1	# The HOSTED harness stream mapping, run for real in CI.	COMMENT
MEDIUM⚡	.github/workflows/hosted-harness-docker.yml	4	# Docker container built from the computer template's harness bake context	COMMENT
29 more matches not shown…

Hallucination Indicators13 hits · 155 pts

Severity	File	Line	Snippet	Context
CRITICAL	…k-app/tests/listeners/actions/run-suite-button.test.js	61	assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 1);	CODE
CRITICAL⚡	…k-app/tests/listeners/actions/run-suite-button.test.js	98	assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 1);	CODE
CRITICAL⚡	…k-app/tests/listeners/actions/run-suite-button.test.js	99	assert.strictEqual(args.client.chat.postEphemeral.mock.callCount(), 1);	CODE
CRITICAL⚡	…k-app/tests/listeners/actions/run-suite-button.test.js	106	assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 0);	CODE
CRITICAL⚡	…k-app/tests/listeners/actions/run-suite-button.test.js	107	assert.strictEqual(args.client.chat.postEphemeral.mock.callCount(), 1);	CODE
CRITICAL⚡	…k-app/tests/listeners/actions/run-suite-button.test.js	114	assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 1);	CODE
CRITICAL	…k-app/tests/listeners/actions/run-suite-button.test.js	141	assert.strictEqual(args.client.chat.postMessage.mock.callCount(), 0);	CODE
CRITICAL	…k-app/tests/listeners/actions/run-suite-button.test.js	142	assert.strictEqual(args.client.chat.postEphemeral.mock.callCount(), 1);	CODE
CRITICAL	…ack-app/tests/listeners/events/app-home-opened.test.js	37	assert.strictEqual(fakeClient.assistant.threads.setSuggestedPrompts.mock.callCount(), 0);	CODE
CRITICAL	…ack-app/tests/listeners/events/app-home-opened.test.js	43	assert.strictEqual(fakeClient.assistant.threads.setSuggestedPrompts.mock.callCount(), 1);	CODE
CRITICAL	…-inspector/server/services/plugin-host/turn-context.ts	105	input.c.req.raw.signal.throwIfAborted();	CODE
CRITICAL	…shared/__tests__/browser-agent-contract-parity.test.ts	122	const act = doc.components.schemas.BrowserAgentCommand.oneOf.find(	CODE
CRITICAL	…client/src/hooks/__tests__/usePostHogRelayAuth.test.ts	23	state.posthog.set_config.mock.calls.map(	CODE

Structural Annotation Overuse90 hits · 133 pts

Severity	File	Line	Snippet	Context
LOW	…r/server/utils/__tests__/mcpjam-stream-handler.test.ts	3927	// Step 1: model returns a tool call. Step 2: tool result fed in,	COMMENT
LOW	…r/server/services/evals/__tests__/evals-runner.test.ts	5824	// Step 2: 25 in / 13 out cumulative (i.e. step 2 contributed	COMMENT
LOW	…r/server/services/evals/__tests__/evals-runner.test.ts	6080	// Step 1: model says "Step1 text", calls tool A, gets a result.	COMMENT
LOW	…r/server/services/evals/__tests__/evals-runner.test.ts	6106	// Step 2: model says "Step2 text", calls tool B, gets a result.	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	55	### Step 1: Tool Detection (`part-switch.tsx:77-225`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	103	### Step 2: Render MCPAppsRenderer (`part-switch.tsx:165-222`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	126	### Step 3: Fetch Widget HTML from Server (`mcp-apps-renderer.tsx:342-447`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	153	### Step 4: Server-Side Resource Fetching (`apps.ts:116-224`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	183	### Step 5: Create Double-Iframe Sandbox (`sandboxed-iframe.tsx`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	216	### Step 6: Sandbox Proxy Initialization (`sandbox-proxy.html`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	252	### Step 7: CSP Injection and HTML Loading (`sandbox-proxy.html:93-180`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	291	### Step 8: AppBridge Connection (`mcp-apps-renderer.tsx:849-930`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	323	### Step 9: Widget Initialization (Guest UI → Host)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	364	### Step 10: Send Tool Input & Result (`mcp-apps-renderer.tsx:938-977`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	391	### Step 11: Interactive Phase - Bridge Handlers (`mcp-apps-renderer.tsx:635-847`)	COMMENT
LOW	…nt/src/components/chat-v2/thread/MCP_APPS_RENDERING.md	438	### Step 12: Host Context Updates (`mcp-apps-renderer.tsx:932-936`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	86	### Step 1: Origin Calculation (`sandboxed-iframe.tsx:90-109`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	122	### Step 2: Outer Iframe Creation (`sandboxed-iframe.tsx:213-222`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	163	### Step 3: Sandbox Proxy Loads (`sandbox-proxy.html:244-251`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	192	### Step 4: Host Receives Ready Signal (`sandboxed-iframe.tsx:130-174`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	230	### Step 5: Host Sends HTML & CSP (`sandboxed-iframe.tsx:192-210`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	265	### Step 6: Sandbox Proxy Builds CSP (`sandbox-proxy.html:93-181`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	339	### Step 7: CSP Injection into HTML (`sandbox-proxy.html:215-241`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	389	### Step 8: Inner Iframe Loading (`sandbox-proxy.html:254-306`)	COMMENT
LOW	…src/components/chat-v2/thread/DOUBLE_IFRAME_SANDBOX.md	443	### Step 9: Message Relay	COMMENT
LOW⚡	…t/src/components/__tests__/OAuthFlowTab.agent.test.tsx	264	// Step 1: land on generate_pkce_parameters.	COMMENT
LOW⚡	…t/src/components/__tests__/OAuthFlowTab.agent.test.tsx	269	// Step 2: the PKCE advance produces the authorization URL; the handler	COMMENT
LOW⚡	…client/src/hooks/__tests__/use-persisted-host.test.tsx	148	// Step 1: re-affirm existing lead (the picker always sends the	COMMENT
LOW⚡	…client/src/hooks/__tests__/use-persisted-host.test.tsx	151	// Step 2: write the new compare array including the new host.	COMMENT
LOW⚡	…lient/src/hooks/__tests__/use-persisted-model.test.tsx	81	// Step 1: re-affirm existing lead (the picker always sends the	COMMENT
LOW⚡	…lient/src/hooks/__tests__/use-persisted-model.test.tsx	85	// Step 2: write the new compare array including the new model.	COMMENT
LOW	sdk/tests/oauth/hardening-shared-pass.test.ts	336	// Step 1: fetch the CIMD document.	COMMENT
LOW	sdk/tests/oauth/hardening-shared-pass.test.ts	353	// Step 2: validate — must NOT issue a second fetch.	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1877	// Step 9: Authorization URL is ready - user should open it in browser	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1887	// Step 10: Validate authorization code and prepare for token exchange	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	607	// Step 1: Make initial MCP request without token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	654	// Step 2: Request MCP server and expect 401 Unauthorized via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	797	// Step 3: Extract resource metadata URL and prepare request	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	849	// Step 2: Fetch and parse resource metadata using official SDK helper	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1061	// Step 3: Request Authorization Server Metadata	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1097	// Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1341	// Step 5: Client Registration (CIMD > Pre-registered > DCR)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1532	// Step 6: Dynamic Client Registration (RFC 7591)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1768	// Step 7: Generate PKCE parameters	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1812	// Step 8: Build authorization URL	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1995	// Step 11: Exchange authorization code for access token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	2275	// Step 12: Make an authenticated stateless MCP request to verify the	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	2337	// Step 13: Execute the authenticated stateless verify request	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1289	// Step 9: Authorization URL is ready - user should open it in browser	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1299	// Step 10: Validate authorization code and prepare for token exchange	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	306	// Step 1: Make initial MCP request without token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	350	// Step 2: Request MCP server and expect 401 Unauthorized via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	493	// Step 3: Extract resource metadata URL and prepare request	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	545	// Step 2: Fetch and parse resource metadata using official SDK helper	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	781	// Step 3: Request Authorization Server Metadata	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	817	// Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	960	// Step 5: Dynamic Client Registration (if registration_endpoint exists)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1090	// Step 6: Dynamic Client Registration (RFC 7591)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1191	// Step 7: Generate PKCE parameters	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1228	// Step 8: Build authorization URL	COMMENT
30 more matches not shown…

Cross-Language Confusion (JS/TS)15 hits · 108 pts

Severity	File	Line	Snippet	Context
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	21	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	25	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	28	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	32	elif version == 6:	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	34	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	42	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	45	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	51	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	55	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	64	return None	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	94	elif outgoing and proto == 6 and flags & 2 and not flags & 16:	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	101	elif not outgoing and proto == 6:	CODE
HIGH⚡	…erver/services/github-checks/network-monitor-script.ts	111	elif reverse in self.established and flags & 4:	CODE
HIGH	…erver/services/github-checks/network-monitor-script.ts	134	print(json.dumps(row, separators=(',', ':')), flush=True)	CODE
HIGH	…rvices/github-checks/__tests__/network-monitor.test.ts	263	print(json.dumps(rows))	CODE

Fake / Example Data99 hits · 104 pts

Severity	File	Line	Snippet	Context
LOW	slack-app/tests/listeners/events/run-and-reply.test.js	78	return { ts: 'placeholder' };	CODE
LOW	slack-app/tests/listeners/events/run-and-reply.test.js	83	assert.equal(updates[0].ts, 'placeholder');	CODE
LOW	…pike-codex-appserver/schema/0.149.1/ClientRequest.json	3959	"placeholder": {	CODE
LOW	…codex-appserver/schema/0.149.1/ServerNotification.json	3764	"placeholder": {	CODE
LOW	…pserver/__fixtures__/schema/0.163.0/ClientRequest.json	4306	"placeholder": {	CODE
LOW	…er/__fixtures__/schema/0.163.0/ServerNotification.json	4153	"placeholder": {	CODE
LOW	…ess/codex-appserver/__tests__/adapter-contract.test.ts	254	sandboxCredentialEnvironment: { CODEX_API_KEY: "placeholder" },	CODE
LOW	…ils/harness/codex-appserver/__tests__/do-start.test.ts	109	auth: { CODEX_API_KEY: "placeholder", OPENAI_BASE_URL: "http://gw" },	CODE
LOW	…ils/harness/codex-appserver/__tests__/do-start.test.ts	132	expect(box.spawns[0]!.env.CODEX_API_KEY).toBe("placeholder");	CODE
LOW	…ils/harness/codex-appserver/__tests__/do-start.test.ts	163	auth: { CODEX_API_KEY: "placeholder", OPENAI_BASE_URL: "http://gw" },	CODE
LOW	…-inspector/server/routes/web/__tests__/caniuse.test.ts	287	{ email: "user@example.com" },	CODE
LOW	…-inspector/server/routes/web/__tests__/caniuse.test.ts	304	body: JSON.stringify({ email: "user@example.com" }),	CODE
LOW	…spector/server/services/__tests__/xaa-mint-dcr.test.ts	72	email: "user@example.com",	CODE
LOW	mcpjam-inspector/shared/__tests__/log-scrubber.test.ts	49	expect(scrubLogPayload({ email: "user@example.com" })).toEqual({	CODE
LOW	mcpjam-inspector/shared/__tests__/log-scrubber.test.ts	114	expect(result.message).not.toContain("user@example.com");	CODE
LOW	…jam-inspector/shared/__tests__/secret-scrubber.test.ts	257	const megabyteOfProse = "lorem ipsum dolor sit amet. ".repeat(40_000);	CODE
LOW	…jam-inspector/shared/__tests__/secret-scrubber.test.ts	257	const megabyteOfProse = "lorem ipsum dolor sit amet. ".repeat(40_000);	CODE
LOW	…jam-inspector/shared/__tests__/secret-scrubber.test.ts	378	const prose = "lorem ipsum dolor sit amet. ".repeat(40_000);	CODE
LOW	…jam-inspector/shared/__tests__/secret-scrubber.test.ts	378	const prose = "lorem ipsum dolor sit amet. ".repeat(40_000);	CODE
LOW	…m-inspector/shared/__tests__/oauth-connections.test.ts	34	make("a", { id: "1", email: "same@example.com", name: "Acme Corp" }),	CODE
LOW	…ts/sidebar/__tests__/sidebar-context-switcher.test.tsx	231	user: { id: "user_1", email: "user@example.com" },	CODE
LOW	…mponents/evals/__tests__/pattern-match-fields.test.tsx	258	expect(atLeast).toHaveAttribute("placeholder", "1");	CODE
LOW	…mponents/evals/__tests__/pattern-match-fields.test.tsx	391	expect(tool).toHaveAttribute("placeholder", "Any tool");	CODE
LOW	…mponents/evals/__tests__/pattern-match-fields.test.tsx	403	expect(argument).toHaveAttribute("placeholder", "Whole input");	CODE
LOW	…mponents/evals/__tests__/pattern-match-fields.test.tsx	466	expect(field).toHaveAttribute("placeholder", "Whole output");	CODE
LOW	…mponents/evals/__tests__/pattern-match-fields.test.tsx	555	).toHaveAttribute("placeholder", "Whole output");	CODE
LOW	…t/src/components/evals/__tests__/trace-viewer.test.tsx	1393	frame="none" interactive={false} widgetPolicy="placeholder"	CODE
LOW	…t/src/components/evals/__tests__/trace-viewer.test.tsx	1397	widgetPolicy: "placeholder", interactive: false,	CODE
LOW	…onnection/__tests__/ConnectionAccountsSection.test.tsx	83	profile: { id: "x", email: "same@example.com", name: "Acme Corp" },	CODE
LOW	…jam-inspector/client/src/components/chat-v2/thread.tsx	87	widgetPolicy?: "live" \| "placeholder";	CODE
LOW	…jam-inspector/client/src/components/chat-v2/thread.tsx	443	{widgetPolicy !== "placeholder" && (	CODE
LOW	…lient/src/components/chat-v2/__tests__/Thread.test.tsx	112	<Thread {...defaultProps} messages={[]} widgetPolicy="placeholder" />,	CODE
LOW	…t/src/components/chat-v2/__tests__/PartSwitch.test.tsx	304	widgetPolicy="placeholder"	CODE
LOW	…/client/src/components/chat-v2/thread/message-view.tsx	80	widgetPolicy?: "live" \| "placeholder";	CODE
LOW	…/src/components/chat-v2/thread/widget-presentation.tsx	3	const WidgetPresentation = createContext<"live" \| "placeholder">("live");	CODE
LOW	…/src/components/chat-v2/thread/widget-presentation.tsx	8	<WidgetPresentation.Provider value="placeholder">	CODE
LOW	…client/src/components/chat-v2/thread/widget-replay.tsx	112	if (presentation === "placeholder") {	CODE
LOW	…r/client/src/components/chat-v2/thread/part-switch.tsx	140	(presentation === "placeholder" \|\| props.widgetPolicy === "placeholder") &&	CODE
LOW	…r/client/src/components/chat-v2/thread/part-switch.tsx	168	if (presentation === "placeholder") {	CODE
LOW	…r/client/src/components/chat-v2/thread/part-switch.tsx	254	widgetPolicy?: "live" \| "placeholder";	CODE
LOW	…r/client/src/components/chat-v2/thread/part-switch.tsx	639	widgetPolicy === "placeholder" &&	CODE
LOW	…ponents/chat-v2/thread/mcp-apps/checkout-dialog-v2.tsx	180	setName("John Doe");	CODE
LOW	…ponents/chat-v2/thread/mcp-apps/checkout-dialog-v2.tsx	183	setLine1("123 Main St");	CODE
LOW	…-v2/thread/__tests__/static-widget-transcript.test.tsx	65	...(mode === "prop" ? { widgetPolicy: "placeholder" } : {}),	CODE
LOW	…t/src/components/xaa/__tests__/IdJagInspector.test.tsx	37	email: "user@example.com",	CODE
LOW	…rc/components/score/__tests__/ScoreRunnerView.test.tsx	83	"placeholder",	CODE
LOW	…mponents/evaluate/__tests__/create-suite-page.test.tsx	416	expect(nameInput).toHaveAttribute("placeholder", DEFAULT_CREATE_SUITE_NAME);	CODE
LOW	…mponents/evaluate/__tests__/create-suite-page.test.tsx	444	expect(nameInput).toHaveAttribute("placeholder", "Suite 3");	CODE
LOW	…mponents/evaluate/__tests__/create-suite-page.test.tsx	478	"placeholder",	CODE
LOW	…/src/components/evaluate/__tests__/case-spine.test.tsx	1336	expect(outcome.getAttribute("placeholder")).toBe(	CODE
LOW	…t/src/components/__tests__/ProjectSettingsTab.test.tsx	38	useAuth: () => ({ user: { email: "admin@example.com" } }),	CODE
LOW	…t/src/components/__tests__/ProjectSettingsTab.test.tsx	112	{ email: "admin@example.com", role: "admin", projectRole: "admin" },	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2115	email: "admin@example.com",	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2122	email: "admin@example.com",	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2131	user: { email: "admin@example.com" },	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2179	email: "admin@example.com",	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2186	email: "admin@example.com",	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2195	user: { email: "admin@example.com" },	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2307	email: "admin@example.com",	CODE
LOW⚡	…components/__tests__/OrganizationsTab.billing.test.tsx	2314	email: "admin@example.com",	CODE
39 more matches not shown…

Verbosity Indicators69 hits · 101 pts

Severity	File	Line	Snippet	Context
LOW	…r/server/utils/__tests__/mcpjam-stream-handler.test.ts	3927	// Step 1: model returns a tool call. Step 2: tool result fed in,	COMMENT
LOW	…r/server/services/evals/__tests__/evals-runner.test.ts	5824	// Step 2: 25 in / 13 out cumulative (i.e. step 2 contributed	COMMENT
LOW	…r/server/services/evals/__tests__/evals-runner.test.ts	6080	// Step 1: model says "Step1 text", calls tool A, gets a result.	COMMENT
LOW	…r/server/services/evals/__tests__/evals-runner.test.ts	6106	// Step 2: model says "Step2 text", calls tool B, gets a result.	COMMENT
LOW⚡	…t/src/components/__tests__/OAuthFlowTab.agent.test.tsx	264	// Step 1: land on generate_pkce_parameters.	COMMENT
LOW⚡	…t/src/components/__tests__/OAuthFlowTab.agent.test.tsx	269	// Step 2: the PKCE advance produces the authorization URL; the handler	COMMENT
LOW⚡	…client/src/hooks/__tests__/use-persisted-host.test.tsx	148	// Step 1: re-affirm existing lead (the picker always sends the	COMMENT
LOW⚡	…client/src/hooks/__tests__/use-persisted-host.test.tsx	151	// Step 2: write the new compare array including the new host.	COMMENT
LOW⚡	…lient/src/hooks/__tests__/use-persisted-model.test.tsx	81	// Step 1: re-affirm existing lead (the picker always sends the	COMMENT
LOW⚡	…lient/src/hooks/__tests__/use-persisted-model.test.tsx	85	// Step 2: write the new compare array including the new model.	COMMENT
LOW	sdk/tests/oauth/hardening-shared-pass.test.ts	336	// Step 1: fetch the CIMD document.	COMMENT
LOW	sdk/tests/oauth/hardening-shared-pass.test.ts	353	// Step 2: validate — must NOT issue a second fetch.	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1877	// Step 9: Authorization URL is ready - user should open it in browser	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1887	// Step 10: Validate authorization code and prepare for token exchange	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	607	// Step 1: Make initial MCP request without token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	654	// Step 2: Request MCP server and expect 401 Unauthorized via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	797	// Step 3: Extract resource metadata URL and prepare request	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	849	// Step 2: Fetch and parse resource metadata using official SDK helper	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1061	// Step 3: Request Authorization Server Metadata	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1097	// Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1341	// Step 5: Client Registration (CIMD > Pre-registered > DCR)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1532	// Step 6: Dynamic Client Registration (RFC 7591)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1768	// Step 7: Generate PKCE parameters	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1812	// Step 8: Build authorization URL	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	1995	// Step 11: Exchange authorization code for access token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	2275	// Step 12: Make an authenticated stateless MCP request to verify the	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2026-07-28.ts	2337	// Step 13: Execute the authenticated stateless verify request	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1289	// Step 9: Authorization URL is ready - user should open it in browser	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1299	// Step 10: Validate authorization code and prepare for token exchange	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	306	// Step 1: Make initial MCP request without token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	350	// Step 2: Request MCP server and expect 401 Unauthorized via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	493	// Step 3: Extract resource metadata URL and prepare request	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	545	// Step 2: Fetch and parse resource metadata using official SDK helper	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	781	// Step 3: Request Authorization Server Metadata	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	817	// Step 4: Fetch authorization server metadata (try multiple endpoints) via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	960	// Step 5: Dynamic Client Registration (if registration_endpoint exists)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1090	// Step 6: Dynamic Client Registration (RFC 7591)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1191	// Step 7: Generate PKCE parameters	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1228	// Step 8: Build authorization URL	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1378	// Step 11: Exchange authorization code for access token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1658	// Step 12: Make authenticated MCP request (initialize to establish session)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-06-18.ts	1717	// Step 13: Make actual authenticated request to verify token (initialize with auth)	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	906	// Step 9: Wait for authorization code	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	914	// Step 10: Prepare token exchange	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	298	// Step 2: Request MCP server and expect 401 or 200	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	402	// Step 3: Start authorization server metadata discovery	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	433	// Step 4: Fetch authorization server metadata with fallback	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	593	// Step 5: Client Registration	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	713	// Step 6: Dynamic Client Registration	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	814	// Step 7: Generate PKCE parameters (REQUIRED for 2025-03-26)	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	849	// Step 8: Build authorization URL	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	988	// Step 11: Exchange authorization code for access token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	1249	// Step 12: Make authenticated MCP request	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-03-26.ts	1304	// Step 13: Make actual authenticated request	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts	1497	// Step 9: Authorization URL is ready - user should open it in browser	COMMENT
LOW⚡	sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts	1507	// Step 10: Validate authorization code and prepare for token exchange	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts	330	// Step 1: Make initial MCP request without token	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts	374	// Step 2: Request MCP server and expect 401 Unauthorized via backend proxy	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts	516	// Step 3: Extract resource metadata URL and prepare request	COMMENT
LOW	sdk/src/oauth/state-machines/debug-oauth-2025-11-25.ts	568	// Step 2: Fetch and parse resource metadata using official SDK helper	COMMENT
9 more matches not shown…

Modern AI Meta-Vocabulary24 hits · 70 pts

Severity	File	Line	Snippet	Context
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	1550	// agentic-loop catch). Optional.	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	2583	// post-stream epilogue, and the outer agentic loop marked the	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	3995	// Persist only once at the end of the full agentic loop via	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	4962	// agentic loop reads as `settledWithError`.	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	5015	// `ambiguous` on `user_server_hop`, the same hop the agentic loop	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	5358	// bringing down the agentic loop after a client disconnect.	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	5369	// agentic loop), so a caller with only `write` cannot distinguish	COMMENT
MEDIUM	mcpjam-inspector/server/utils/mcpjam-stream-handler.ts	5913	// Site (3) — outer agentic-loop catch. Mid-stream provider errors	COMMENT
MEDIUM	…jam-inspector/server/utils/harness/run-harness-turn.ts	3169	// caps MCPJam's emulated agentic loop; the harness exposes no equivalent	COMMENT
MEDIUM	…ctor/server/utils/__tests__/empty-step-failure.test.ts	76	// throw escapes to the agentic loop's catch, which emits an engine error of	COMMENT
MEDIUM	…nspector/server/utils/__tests__/assistant-turn.test.ts	125	// module error INSIDE the branch; the throw escapes to the agentic loop's	COMMENT
MEDIUM	…r/server/utils/__tests__/mcpjam-stream-handler.test.ts	4277	// on `traceTurn.turnSpans` during the agentic loop but only	COMMENT
MEDIUM	…r/server/utils/__tests__/mcpjam-stream-handler.test.ts	4496	// the outer agentic loop synthesized a finish and marked the	COMMENT
MEDIUM	…r/server/utils/__tests__/mcpjam-stream-handler.test.ts	4537	// (outer agentic-loop catch) instead of silently breaking the	COMMENT
MEDIUM	…r/server/utils/__tests__/mcpjam-stream-handler.test.ts	4560	// and the agentic loop treated the turn as successful. The result was a	COMMENT
MEDIUM	…r/server/services/evals/__tests__/evals-runner.test.ts	3547	// engine's agentic loop catches an error AFTER partial messages	COMMENT
MEDIUM	…-inspector/server/services/sessionSimulation/runner.ts	1099	// agentic personas drive rendered widgets by screenshots. Evals stay	COMMENT
MEDIUM	…/client/src/lib/__tests__/hosted-oauth-failure.test.ts	7	"Uncaught Error: HTTP 530 trying to load OAuth metadata from https://eliya.descope.team/.well-known/oauth-authorizatio	CODE
MEDIUM	…/client/src/lib/__tests__/hosted-oauth-failure.test.ts	22	"GET https://eliya.descope.team/.well-known/oauth-authorization-server/v1/apps/agentic/P3HPHwb4OyQsnBBe0qSh1lzd0	CODE
MEDIUM	sdk/tests/node-builtin-guard.test.ts	6	// ever assert that the scaffold found NOTHING, so a scaffold that matches nothing	COMMENT
MEDIUM	sdk/src/HostRunner.ts	1015	// Add response messages (assistant + tool messages from agentic loop).	COMMENT
MEDIUM	sdk/src/tool-extraction.ts	47	// Extract from steps (multi-step agentic loop)	COMMENT
MEDIUM	sdk/src/contract/stage-derivation.ts	1078	// tolerated — so a raw read of `unexpected` reports a PASSING agentic	COMMENT
MEDIUM	sdk/src/contract/__tests__/decision-labels.test.ts	51	// our own spend guardrails — so the run says nothing about the server under	COMMENT

Example Usage Blocks7 hits · 10 pts

Severity	File	Line	Snippet	Context
LOW	.github/scripts/convex-health-check.sh	4	# Usage:	COMMENT
LOW	.github/scripts/reap-preview-envs.sh	14	# Usage:	COMMENT
LOW	.github/scripts/railway-set-vars.sh	10	# Usage:	COMMENT
LOW	.github/scripts/workos-cleanup.sh	4	# Usage:	COMMENT
LOW	.github/scripts/railway-env.sh	10	# Usage:	COMMENT
LOW	.github/scripts/railway-retry.sh	4	# Usage:	COMMENT
LOW	.github/scripts/railway-wait-deploy.sh	14	# Usage:	COMMENT

Self-Referential Comments2 hits · 8 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	.github/workflows/local-harness-pack-pipeline.yml	39	# This file is NOT a pack input: it decides when packs are built, not what is	COMMENT
MEDIUM	…am-eval-import/examples/promptfoo/promptfooconfig.yaml	2	# This file is DATA for the conversion. Nothing here is executed by the skill.	COMMENT

Overly Generic Function Names1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	…-inspector/server/utils/harness/local/model-gateway.ts	224	async function handleRequest(	CODE

MCPJam/inspector

Open-Source Code Quality, Security and Technical Debt Review