0.7

Adjusted Signal

0.7

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

5.0K

Stars

TypeScript

Language

189.7K

Lines of Code

675

Files

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 96 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 1 finding(s).

Agent Over-Engineering Ratio 0.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 32 finding(s).

PR Review Velocity Impact 2.9/100 · LOW

Which changes need focused human review? 97 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 5LOW 91

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 97 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Structural Annotation Overuse23 hits · 50 pts

Severity	File	Line	Snippet	Context
LOW	README_KO.md	119	# Step 1: 설치 디렉토리로 이동 (존재하지 않는 경우 생성)	COMMENT
LOW⚡	README_KO.md	130	# Step 3: MCSManager 설치 디렉토리 준비	COMMENT
LOW⚡	README_KO.md	134	# Step 4: 최신 MCSManager 릴리스 다운로드	COMMENT
LOW⚡	README_KO.md	138	# Step 5: 의존성 설치	COMMENT
LOW⚡	README_KO.md	142	# Step 6: 두 개의 터미널 창을 열거나 screen/tmux 사용	COMMENT
LOW⚡	README_KO.md	167	# Step 1: Node.js 설치 (이미 설치된 경우 건너뜀)	COMMENT
LOW⚡	README_KO.md	173	# Step 2: curl을 사용하여 최신 릴리스 다운로드	COMMENT
LOW⚡	README_KO.md	176	# Step 3: 다운로드한 아카이브 압축 해제	COMMENT
LOW⚡	README_KO.md	179	# Step 4: 압축이 해제된 디렉토리로 이동	COMMENT
LOW⚡	README_KO.md	182	# Step 5: 설치 프로그램에 실행 권한을 부여하고 실행	COMMENT
LOW⚡	README_KO.md	186	# Step 6: 두 개의 터미널 창을 열거나 screen/tmux를 사용하여 서비스를 병렬로 실행	COMMENT
LOW	README.md	119	# Step 1: Navigate to the installation directory (create it if it doesn't exist)	COMMENT
LOW⚡	README.md	130	# Step 3: Prepare the MCSManager installation directory	COMMENT
LOW⚡	README.md	134	# Step 4: Download the latest MCSManager release	COMMENT
LOW⚡	README.md	138	# Step 5: Install dependencies	COMMENT
LOW⚡	README.md	142	# Step 6: Open two terminal windows or use screen/tmux	COMMENT
LOW⚡	README.md	150	# Step 7: Access the panel in your browser	COMMENT
LOW⚡	README.md	168	# Step 1: Install Node.js (skip if already installed)	COMMENT
LOW⚡	README.md	174	# Step 2: Download the latest release using curl	COMMENT
LOW⚡	README.md	177	# Step 3: Extract the downloaded archive	COMMENT
LOW⚡	README.md	180	# Step 4: Enter the extracted directory	COMMENT
LOW⚡	README.md	183	# Step 5: Make the installer executable and run it	COMMENT
LOW⚡	README.md	187	# Step 6: Open two terminal windows or use screen/tmux to run services in parallel	COMMENT

Over-Commented Block36 hits · 36 pts

Severity	File	Line	Snippet	Context
LOW	panel/src/app/entity/setting.ts	21	reverseProxyHeader: string = "X-Real-IP";	COMMENT
LOW	panel/src/app/service/upgrade_service.ts	1	// Panel (web) self-update service.	COMMENT
LOW	panel/src/app/service/proxy_addr.ts	1	import { URL } from "node:url";	COMMENT
LOW	panel/src/app/service/terminal_bridge.ts	21	// Wire protocol (matches the daemon's stream_router + instance_event_router	COMMENT
LOW	panel/src/app/service/gateway_token.ts	1	import crypto from "crypto";	COMMENT
LOW	…/test/integration/suites/security_sso_redirect.test.ts	1	import { describe, it, expect, beforeAll, afterAll } from "vitest";	COMMENT
LOW	…/test/integration/suites/security_sso_redirect.test.ts	21	// panel's `redirect_uri` with `?code=...&state=...`	COMMENT
LOW	…/test/integration/suites/security_sso_redirect.test.ts	41	// X-Forwarded-Proto / X-Forwarded-Host / Host (no allowlist)	COMMENT
LOW	…/test/integration/suites/security_sso_redirect.test.ts	61	// #2 I1(c) forged header, proxy OFF ....... header ignored (RED-able)	COMMENT
LOW	common/test/integration/suites/user.test.ts	21	// Coverage matrix (see task-6-brief):	COMMENT
LOW	common/test/integration/suites/auth.test.ts	1	import { describe, it, expect } from "vitest";	COMMENT
LOW	common/test/integration/suites/auth.test.ts	221	world.instance.uuid = r.data.instanceUuid;	COMMENT
LOW	common/test/integration/suites/files.test.ts	21	downloadFromDaemon,	COMMENT
LOW	common/test/integration/suites/files.test.ts	41	// mkdir → upload → list paginated · CRUD round-trip (UTF-8 "中文") · zip/decompress	COMMENT
LOW	common/test/integration/suites/instance.test.ts	21	// body — NO ~52MB jar download; fast + deterministic), uploads the test.mjs	COMMENT
LOW	common/test/integration/suites/instance.test.ts	501	world.instance.uuid = undefined;	COMMENT
LOW	common/test/integration/suites/streams.test.ts	21	} from "../lib";	COMMENT
LOW	common/test/integration/suites/streams.test.ts	41	//	COMMENT
LOW	…mmon/test/integration/suites/security_instance.test.ts	21	di,	COMMENT
LOW	common/test/integration/suites/docker.test.ts	21	//	COMMENT
LOW	common/test/integration/suites/proxy_advanced.test.ts	21	sleep,	COMMENT
LOW	common/test/integration/suites/security_files.test.ts	21	di,	COMMENT
LOW	common/test/integration/suites/security_files.test.ts	41	// GatewayToken instead, so those premises do not hold. Proxy-mode data-plane	COMMENT
LOW	common/test/integration/suites/security_auth.test.ts	21	} from "../lib";	COMMENT
LOW	common/test/integration/suites/dataplane.test.ts	21	saveState,	COMMENT
LOW	common/test/integration/suites/dataplane.test.ts	41	// browser connects directly to the daemon.	COMMENT
LOW	common/test/integration/suites/security_user.test.ts	21	// REAL daemon + panel per invocation. Self-contained: the first `it` ensures	COMMENT
LOW	common/test/integration/lib/settings.ts	1	import { requestPanel } from "./http";	COMMENT
LOW	common/test/integration/lib/security.ts	1	import { expect } from "vitest";	COMMENT
LOW	common/src/mcping.ts	101	let status = await this.getStatus();	COMMENT
LOW	common/src/mcping.ts	121	// "Heap Used:",	COMMENT
LOW	daemon/src/tools/system_user.ts	61	gid = result.gid;	COMMENT
LOW	daemon/src/service/upgrade_service.ts	1	// Daemon self-update service.	COMMENT
LOW	daemon/src/service/__test__/pentest_security.test.ts	41		COMMENT
LOW	daemon/src/service/__test__/pentest_security.test.ts	261	// s2 → "s1/.." (lexically folds to "." — looks safe)	COMMENT
LOW	.github/workflows/codeql.yml	1	# For most projects, this workflow file will not need changing; you simply need	COMMENT

Hyper-Verbose Identifiers32 hits · 32 pts

Severity	File	Line	Snippet	Context
LOW	panel/src/app/middleware/limit.ts	39	export function requestConcurrencyLimiter(url: string) {	CODE
LOW	panel/src/app/utils/integration_test_mode.ts	32	export function parseUnsafeIntegrationTestModeArg(argv: readonly string[] = process.argv): void {	CODE
LOW	panel/src/app/utils/integration_test_mode.ts	46	export function getUnsafeIntegrationTestModeKey(): string \| null {	CODE
LOW	panel/src/app/utils/integration_test_mode.ts	54	export function isUnsafeIntegrationTestRequest(apiKey: unknown): boolean {	CODE
LOW	panel/src/app/service/operation_logger.ts	40	export function getOperationLoggerOperator(ctx: Koa.ParameterizedContext) {	CODE
LOW	panel/src/app/service/frontend_layout.ts	43	export function resetFrontendLayoutConfig() {	CODE
LOW	panel/src/app/service/frontend_layout.ts	62	function getDefaultFrontendLayoutConfig(): IPageLayoutConfig[] {	CODE
LOW	panel/src/app/service/instance_service.ts	150	export function checkInstanceAdvancedParams(	CODE
LOW	frontend/src/lang/i18n.ts	184	export function resolveWithEnglishFallback(translate: TranslateFn, args: any[]): string {	CODE
LOW	frontend/src/components/fc/index.ts	172	export async function useDockerCapabilityEditDialog(data: DockerCapabilityItem[] = []) {	CODE
LOW	frontend/src/components/fc/index.ts	183	export async function useDockerDeviceEditDialog(data: DockerDeviceItem[] = []) {	CODE
LOW	frontend/src/components/fc/index.ts	247	export async function openDockerVersionSelectDialog() {	CODE
LOW	frontend/src/components/fc/index.ts	265	export async function openInstanceReinstallDialog(	CODE
LOW	frontend/src/hooks/useTerminalTouch.ts	99	export function attachTerminalTouchControls({	CODE
LOW	frontend/src/hooks/terminalHistoryReplayGate.ts	12	export function createTerminalHistoryReplayGate() {	CODE
LOW	frontend/src/hooks/useOverviewChart.ts	146	function getSimpleChartDefaultOption() {	CODE
LOW	common/src/upgrade.ts	42	export function migrateLegacyUpdateSourceUrl(current?: string): string {	CODE
LOW	common/src/docker_utils.ts	6	export function normalizeDockerArchitecture(architecture: string \| undefined): string {	CODE
LOW	common/src/process_tools.ts	181	function readLinuxChildrenFromProc(pid: number): number[] \| null {	CODE
LOW	daemon/src/tools/docker_workspace_path.ts	3	export function resolveDockerWorkspacePath(	CODE
LOW	daemon/src/tools/file_ownership.ts	29	export async function resolveInstanceFileOwnership(	CODE
LOW	daemon/src/tools/file_ownership.ts	57	export async function syncPathOwnershipWithinRoot(	CODE
LOW	daemon/src/tools/file_ownership.ts	97	export async function syncInstancePathOwnership(	CODE
LOW	daemon/src/entity/instance/process_config.ts	106	function convertPropertiesWriteValues(obj: any): any {	CODE
LOW	daemon/src/middlewares/precheck.ts	18	export async function uploadFileCheckMiddleware(ctx: Context, next: () => Promise<void>) {	CODE
LOW	daemon/src/middlewares/precheck.ts	48	export async function uploadSpeedLimitMiddleware(ctx: Context, next: () => Promise<void>) {	CODE
LOW	daemon/src/service/docker_process_service.ts	50	function isDockerNameConflictError(error: any): boolean {	CODE
LOW	daemon/src/service/docker_process_service.ts	76	async function waitForContainerNameRelease(	CODE
LOW	daemon/src/service/docker_process_service.ts	93	async function createContainerWithNameRetry(	CODE
LOW	daemon/src/service/docker_service.ts	20	function resolveDockerOptionsFromEnv(): Docker.DockerOptions {	CODE
LOW	daemon/src/service/docker_service.ts	31	function parseDockerHostToDockerOptions(dockerHost: string): Docker.DockerOptions \| undefined {	CODE
LOW	…vice/async_task_service/__test__/quick_install.test.ts	69	async function expectSanitizedDownloadFailure(	CODE

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	panel/src/app/service/mod_manager_service.ts	294	// But that's risky. Let's stick to the current logic but ensure it's robust.	COMMENT
MEDIUM	…ntend/src/widgets/instance/mod-manager/useModUpload.ts	27	// Better: check if file has size or use a more robust check if available	COMMENT
MEDIUM	common/test/integration/suites/instance.test.ts	649	// (output may carry terminal control bytes — assert substring, robust).	COMMENT
MEDIUM	common/test/integration/suites/instance.test.ts	737	// robust contract; the streams suite covers exact-line broadcast.	COMMENT

Cross-Language Confusion (JS/TS)1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	daemon/src/entity/instance/instance.ts	457	print(data: any) {	CODE

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	openspec/changes/market-dialog-navigation/design.md	35	### 2. Keep market flow orchestration in the market dialog	COMMENT

MCSManager/MCSManager

Open-Source Code Quality, Security and Technical Debt Review