A Low-Code MCP Framework for Building Complex and Innovative RAG Pipelines
This report summarizes scanner evidence for OpenBMB/UltraRAG, a Python project with 5,717 GitHub stars. SynthScan examined 68,569 lines of code across 217 source files, recording 554 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 11.9 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 292 finding(s).
Are imports declared and package/API names verified? 45 finding(s).
Are wrappers, guards, and repeated structures necessary? 339 finding(s).
Which changes need focused human review? 554 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 554 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | ui/backend/pipeline_manager.py | 616 | Execute multi-turn conversation generation. Args: callback: Stream callback function dy | STRING |
| HIGH | ui/backend/pipeline_manager.py | 666 | Run chat pipeline execution. Args: callback: Stream callback function dynamic_params: O | STRING |
| HIGH | ui/backend/pipeline_manager.py | 2280 | Parse arbitrary YAML text and return safe Python object. Args: yaml_content: YAML content string Retur | STRING |
| HIGH | ui/backend/pipeline_manager.py | 2336 | Save YAML text content directly to file. Args: name: Pipeline name yaml_content: YAML content strin | STRING |
| HIGH | ui/backend/pipeline_manager.py | 2372 | Rename a pipeline file. Args: old_name: Current pipeline name new_name: New pipeline name Retu | STRING |
| HIGH | ui/backend/pipeline_manager.py | 3205 | Upload multiple files to knowledge base. Args: file_objs: List of file objects to upload Returns: | STRING |
| HIGH | ui/backend/pipeline_manager.py | 3280 | Delete a knowledge base file or collection. Args: category: File category (raw, corpus, chunks, collection, | STRING |
| HIGH | ui/backend/pipeline_manager.py | 3427 | Run knowledge base pipeline tool. Args: pipeline_name: Name of the pipeline to run target_file_path | STRING |
| HIGH | servers/benchmark/src/benchmark.py | 19 | Load data from file in various formats (jsonl, json, parquet). Args: path: Path to the data file li | STRING |
| HIGH | servers/benchmark/src/benchmark.py | 128 | Load benchmark data from file with key mapping and optional shuffling. Args: benchmark: Dictionary containi | STRING |
| HIGH | servers/reranker/src/reranker.py | 158 | Rerank passages for queries using the initialized reranker backend. Args: query_list: List of query | STRING |
| HIGH | servers/corpus/src/corpus.py | 23 | Validate and sanitize file path to prevent path traversal attacks. Args: user_path: User-provided file | STRING |
| HIGH | servers/retriever/src/retriever.py | 937 | Search for passages using query embeddings. Args: query_list: List of query strings top | STRING |
| HIGH | servers/retriever/src/retriever.py | 1131 | Search using remote retriever deployment. Args: retriever_url: URL of remote retriever service | STRING |
| HIGH | servers/retriever/src/index_backends/faiss_backend.py | 180 | Search for similar passages using FAISS index. Args: query_embeddings: 2D numpy array of query embe | STRING |
| HIGH | servers/retriever/src/index_backends/milvus_backend.py | 86 | Resolve Milvus URI from config. Args: index_path: URI string from config Returns: | STRING |
| HIGH | servers/retriever/src/index_backends/milvus_backend.py | 314 | Search for similar passages using Milvus index. Args: query_embeddings: 2D numpy array of query emb | STRING |
| HIGH | servers/prompt/src/prompt.py | 21 | Validate template path to prevent path traversal. Args: template_path: Path to template file | STRING |
| HIGH | servers/prompt/src/prompt.py | 48 | Load Jinja2 template from file with security validation. Args: template_path: Path to template file Re | STRING |
| HIGH | servers/evaluation/src/evaluation.py | 377 | Evaluate retrieval results using pytrec_eval. Args: qrels_path: Path to TREC qrels file run_path: P | STRING |
| HIGH | servers/evaluation/src/evaluation.py | 434 | Save evaluation results to JSON file and optionally display as Markdown table. Args: results: Dictionary of | STRING |
| HIGH | servers/generation/src/generation.py | 86 | Extract text content from various prompt formats. Args: prompt_ls: List of prompts in various forma | STRING |
| HIGH | servers/generation/src/generation.py | 125 | Convert image path to data URL. Args: path_or_url: Image file path or URL Returns: | STRING |
| HIGH | servers/generation/src/generation.py | 316 | Internal method to generate responses from message lists. Args: msg_ls: List of message lists (one | STRING |
| HIGH | servers/generation/src/generation.py | 626 | Generate responses with multimodal inputs (text + images). Args: multimodal_path: List of image pat | STRING |
| HIGH | servers/generation/src/local_generation.py | 46 | Extract text content from various prompt formats. Args: prompt_ls: List of prompts in various forma | STRING |
| HIGH | servers/generation/src/local_generation.py | 81 | Convert image path to data URL. Args: path_or_url: Image file path or URL Returns: | STRING |
| HIGH | servers/router/src/router.py | 25 | Route queries to state1 or state2 based on query value. Args: query_list: List of query strings Return | STRING |
| HIGH | src/ultrarag/server.py | 330 | Register a prompt with UltraRAG-specific output annotation support. Args: name_or_fn: Prompt name o | STRING |
| HIGH | src/ultrarag/server.py | 480 | Build a tool/prompt entry for server.yaml. Args: meta: Metadata dictionary containing function info | STRING |
| HIGH | src/ultrarag/client.py | 391 | Pad sub-list to match skeleton structure. Args: skeleton: Skeleton list structure paren | STRING |
| HIGH | src/ultrarag/client.py | 606 | Get input data for a tool execution step. Args: server_name: Name of the server tool_na | STRING |
| HIGH | src/ultrarag/client.py | 1189 | Load pipeline context from configuration files. Args: config_path: Path to pipeline configuration file | STRING |
| HIGH | src/ultrarag/api.py | 151 | Get a proxy for the specified server. Args: server: Name of the server to access Returns: | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/backend/kb_visibility_store.py | 412 | except Exception: | STRING |
| LOW | ui/backend/chat_store.py | 353 | except Exception: | STRING |
| LOW | ui/backend/chat_store.py | 372 | except Exception: | STRING |
| LOW⚡ | ui/backend/app.py | 98 | except Exception as e: | CODE |
| LOW⚡ | ui/backend/app.py | 535 | except Exception as exc: | CODE |
| LOW⚡ | ui/backend/app.py | 541 | except Exception as exc: | CODE |
| LOW | ui/backend/app.py | 308 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 418 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 455 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 914 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 934 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 953 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 984 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1003 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1016 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1044 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1067 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1113 | except Exception: | CODE |
| LOW | ui/backend/app.py | 1393 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1424 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1480 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1621 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1713 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1730 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1827 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 1926 | except Exception as exc: | CODE |
| LOW | ui/backend/app.py | 1989 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 2031 | except Exception as exc: | CODE |
| LOW | ui/backend/app.py | 2036 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 2049 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 2110 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 2460 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 2477 | except Exception: | CODE |
| LOW | ui/backend/app.py | 2480 | except Exception: | CODE |
| LOW | ui/backend/app.py | 2556 | except Exception: | CODE |
| LOW | ui/backend/app.py | 2572 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 2683 | except Exception as e: | CODE |
| LOW | ui/backend/app.py | 2773 | except Exception: | CODE |
| LOW | ui/backend/app.py | 2824 | except Exception: | CODE |
| MEDIUM | ui/backend/pipeline_manager.py | 55 | def _safe_stdio_del(self): | CODE |
| MEDIUM | ui/backend/pipeline_manager.py | 1077 | def run_bg(): | CODE |
| MEDIUM | ui/backend/pipeline_manager.py | 1926 | def _run() -> None: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1497 | except Exception: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1851 | except Exception: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1918 | except Exception as exc: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1930 | except Exception as exc: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3327 | except Exception as e: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3340 | except Exception as e: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3353 | except Exception as e: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3536 | except Exception: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3541 | except Exception as exc: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3547 | except Exception: | CODE |
| LOW | ui/backend/pipeline_manager.py | 64 | except Exception as exc: # pragma: no cover - best effort guard | CODE |
| LOW | ui/backend/pipeline_manager.py | 69 | except Exception as exc: # pragma: no cover - defensive | CODE |
| LOW | ui/backend/pipeline_manager.py | 94 | except Exception as exc: | CODE |
| LOW | ui/backend/pipeline_manager.py | 98 | except Exception as exc: # pragma: no cover - defensive | CODE |
| LOW | ui/backend/pipeline_manager.py | 200 | except Exception: | CODE |
| LOW | ui/backend/pipeline_manager.py | 259 | except Exception: | CODE |
| LOW | ui/backend/pipeline_manager.py | 339 | except Exception: | CODE |
| LOW | ui/backend/pipeline_manager.py | 422 | except Exception as e: | CODE |
| 120 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/frontend/src/shared/lib/pipelinePreview.ts | 424 | export function serializePipelinePreviewToYaml(nodes: PipelinePreviewNode[]): string { | CODE |
| LOW | ui/frontend/src/shared/api/pipelines.ts | 46 | export async function stopPipelineChatGeneration(sessionId: string): Promise<unknown> { | CODE |
| LOW | ui/frontend/src/shared/api/pipelines.ts | 67 | export async function startPipelineBackgroundChat( | CODE |
| LOW | ui/frontend/src/shared/api/backgroundTasks.ts | 33 | export async function clearCompletedBackgroundTasks(): Promise<{ status: string; count: number }> { | CODE |
| LOW⚡ | ui/frontend/src/pages/ChatPage.tsx | 255 | function getCurrentUserMemoryCollectionNameSet(rawUserId: string): Set<string> { | CODE |
| LOW⚡ | ui/frontend/src/pages/ChatPage.tsx | 260 | function filterCurrentUserMemoryCollections( | CODE |
| LOW⚡ | ui/frontend/src/pages/ChatPage.tsx | 270 | function isInternalMemoryCollection(name: string): boolean { | CODE |
| LOW⚡ | ui/frontend/src/pages/ChatPage.tsx | 276 | function filterVisibleKbCollections(collections: KbFileEntry[]): KbFileEntry[] { | CODE |
| LOW | ui/backend/auth.py | 328 | def _ensure_users_table_columns(self, conn: sqlite3.Connection) -> None: | CODE |
| LOW | ui/backend/auth.py | 339 | def _ensure_default_admin_user(self, conn: sqlite3.Connection) -> None: | CODE |
| LOW | ui/backend/kb_visibility_store.py | 50 | def normalize_collection_name(self, raw_name: Any) -> str: | STRING |
| LOW | ui/backend/kb_visibility_store.py | 275 | def filter_viewable_collections( | STRING |
| LOW⚡ | ui/backend/app.py | 105 | def _normalize_memory_user_id(raw_user_id: Optional[str]) -> str: | CODE |
| LOW⚡ | ui/backend/app.py | 112 | def _is_internal_memory_collection_name(raw_name: Any) -> bool: | CODE |
| LOW⚡ | ui/backend/app.py | 119 | def _current_user_memory_collection_names(user_id: str) -> Set[str]: | CODE |
| LOW⚡ | ui/backend/app.py | 550 | def _filter_collections_by_acl( | CODE |
| LOW | ui/backend/app.py | 142 | def _sanitize_export_filename(title: str) -> str: | CODE |
| LOW | ui/backend/app.py | 161 | def _build_content_disposition(filename: str) -> str: | CODE |
| LOW | ui/backend/app.py | 424 | def _run_memory_sync_background( | CODE |
| LOW | ui/backend/app.py | 503 | def _get_authenticated_user_id() -> Optional[str]: | CODE |
| LOW | ui/backend/app.py | 516 | def _ensure_legacy_collection_visibility(collection_names: List[str]) -> None: | CODE |
| LOW | ui/backend/app.py | 618 | def _build_effective_model_settings(raw_settings: Any) -> Dict[str, Dict[str, str]]: | CODE |
| LOW | ui/backend/app.py | 635 | def _get_authenticated_user_model_settings() -> Dict[str, Dict[str, str]]: | CODE |
| LOW | ui/backend/app.py | 863 | def auth_update_model_settings() -> Response: | CODE |
| LOW | ui/backend/app.py | 1314 | def _normalize_chat_history_for_store(raw_messages: Any) -> list[dict[str, Any]]: | CODE |
| LOW | ui/backend/app.py | 1402 | def _stream_with_chat_persistence(base_stream): | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1484 | def get_memory_collection_name(user_id: Optional[str]) -> str: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1492 | def pipeline_uses_memory_retrieval(pipeline_name: Optional[str]) -> bool: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1846 | def _get_collection_row_count(client: Any, collection_name: str) -> int: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1855 | def clear_user_memory_collection_vectors(user_id: Optional[str]) -> Dict[str, Any]: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1923 | def _trigger_memory_sync_async(user_id: str) -> None: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 1936 | def _resolve_memory_server_alias_from_session( | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3332 | def _delete_milvus_collection(name: str) -> Dict[str, str]: | CODE |
| LOW⚡ | ui/backend/pipeline_manager.py | 3345 | def _delete_qdrant_collection(name: str) -> Dict[str, str]: | CODE |
| LOW | ui/backend/pipeline_manager.py | 152 | def _normalize_collection_name(raw_name: str) -> str: | CODE |
| LOW | ui/backend/pipeline_manager.py | 167 | def _make_safe_collection_name(display_name: str) -> tuple[str, str]: | CODE |
| LOW | ui/backend/pipeline_manager.py | 237 | def _extract_display_name_from_desc(desc: str, fallback: str) -> str: | CODE |
| LOW | ui/backend/pipeline_manager.py | 314 | def _is_generation_server_path(server_path: str) -> bool: | CODE |
| LOW | ui/backend/pipeline_manager.py | 319 | def _is_retriever_server_path(server_path: str) -> bool: | CODE |
| LOW | ui/backend/pipeline_manager.py | 334 | def _resolve_generation_server_alias(pipeline_name: Optional[str]) -> str: | CODE |
| LOW | ui/backend/pipeline_manager.py | 352 | def _extract_non_empty_model_settings(raw_settings: Any) -> Dict[str, Dict[str, str]]: | CODE |
| LOW | ui/backend/pipeline_manager.py | 533 | def _build_demo_backend_overrides( | CODE |
| LOW | ui/backend/pipeline_manager.py | 1584 | def _list_project_memory_files(user_id: str) -> List[Path]: | CODE |
| LOW | ui/backend/pipeline_manager.py | 1594 | def _snapshot_project_memory_files(user_id: str, files: List[Path]) -> Dict[str, Any]: | CODE |
| LOW | ui/backend/pipeline_manager.py | 1612 | def _parse_project_memory_turn_chunks( | CODE |
| LOW | ui/backend/pipeline_manager.py | 1959 | def _resolve_memory_server_alias(pipeline_name: Optional[str]) -> Optional[str]: | CODE |
| LOW | ui/backend/pipeline_manager.py | 2012 | def resolve_memory_collection_for_pipeline( | CODE |
| LOW | ui/backend/pipeline_manager.py | 2030 | def trigger_memory_sync_for_pipeline( | CODE |
| LOW | ui/backend/pipeline_manager.py | 2044 | def _normalize_memory_user_id(user_id: Optional[str]) -> str: | CODE |
| LOW | ui/backend/pipeline_manager.py | 2078 | def _auto_save_memory_chat_turn( | CODE |
| LOW | ui/backend/pipeline_manager.py | 2279 | def parse_pipeline_yaml_content(yaml_content: str) -> Dict: | CODE |
| LOW | ui/backend/pipeline_manager.py | 2869 | def clear_completed_background_tasks(user_id: str = "") -> int: | CODE |
| LOW⚡ | tests/servers/benchmark/test_key_map_alignment.py | 81 | def test_a_record_missing_a_key_does_not_shift_the_other_columns(): | CODE |
| LOW⚡ | tests/servers/benchmark/test_key_map_alignment.py | 90 | def test_columns_are_the_same_length(): | CODE |
| LOW⚡ | tests/servers/benchmark/test_key_map_alignment.py | 96 | def test_skipped_records_are_reported(): | CODE |
| LOW⚡ | tests/servers/benchmark/test_key_map_alignment.py | 103 | def test_shuffling_a_ragged_file_does_not_raise(): | CODE |
| LOW⚡ | tests/servers/benchmark/test_key_map_alignment.py | 112 | def test_shuffling_keeps_each_question_with_its_own_answer(): | CODE |
| LOW⚡ | tests/servers/benchmark/test_key_map_alignment.py | 119 | def test_complete_records_are_unchanged(): | CODE |
| LOW⚡ | tests/servers/benchmark/test_key_map_alignment.py | 126 | def test_limit_still_applies_after_skipping(): | CODE |
| LOW | tests/servers/retriever/test_faiss_search_padding.py | 61 | def test_padding_slots_are_not_returns_as_the_last_document(tmp_path): | CODE |
| 60 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | script/case_study.py | 324 | let lightboxEl = null; | CODE |
| HIGH⚡ | script/case_study.py | 325 | let lightboxImgEl = null; | CODE |
| HIGH⚡ | script/case_study.py | 326 | let lightboxCloseBtn = null; | CODE |
| HIGH⚡ | script/case_study.py | 479 | (function w(x){ if(x==null)return; if(Array.isArray(x)){x.forEach(w);} | CODE |
| HIGH⚡ | script/case_study.py | 481 | else if(typeof x==="string"&&isImagePath(x)){out.push(x);} })(v); | CODE |
| HIGH⚡ | script/case_study.py | 486 | (function w(x){ if(!ok)return; if(x==null)return; if(Array.isArray(x)){x.forEach(w);} | CODE |
| HIGH⚡ | script/case_study.py | 495 | var stepName = String((st && st.step) != null ? st.step : "unknown"); | CODE |
| HIGH⚡ | script/case_study.py | 496 | var memory = (st && st.memory) != null ? st.memory : {}; | CODE |
| HIGH | script/case_study.py | 377 | openLightbox(img.dataset.fullSrc || img.src, altLabel || img.alt || ""); | CODE |
| HIGH | script/case_study.py | 436 | history.replaceState(null, "", `#case-${state.idx}`); | CODE |
| HIGH | script/case_study.py | 462 | var names = steps.map(function(s){ return (s && s.step) ? s.step : "unknown"; }); | CODE |
| HIGH | script/case_study.py | 532 | } else if (imagesOnly && imgs.length > 0) { | CODE |
| HIGH | script/case_study.py | 548 | else { try { pt = JSON.stringify(val, null, 2); } catch(e) { pt = String(val); } } | CODE |
| HIGH | script/case_study.py | 583 | var allOpen = bodies.length > 0 && bodies.every(function(c){ return c.classList.contains("open"); }); | CODE |
| HIGH | script/case_study.py | 612 | history.replaceState(null, "", `#case-${state.idx}`); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | ui/backend/pipeline_manager.py | 1409 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 1468 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 259 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 1902 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 2584 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 1128 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 3511 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 3547 | except Exception: | CODE |
| HIGH | ui/backend/pipeline_manager.py | 3629 | except Exception: | CODE |
| HIGH | script/case_study.py | 84 | except Exception: | CODE |
| HIGH | servers/corpus/src/corpus.py | 661 | except Exception: | CODE |
| HIGH | servers/corpus/src/corpus.py | 474 | except Exception: | CODE |
| HIGH | servers/retriever/src/retriever.py | 1347 | except ImportError: | CODE |
| HIGH | servers/retriever/src/index_backends/milvus_backend.py | 303 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/backend/app.py | 461 | CODE | |
| LOW | ui/backend/app.py | 1267 | CODE | |
| LOW | ui/backend/app.py | 2355 | CODE | |
| LOW | ui/backend/app.py | 2464 | CODE | |
| LOW | ui/backend/app.py | 1402 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1049 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1161 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1385 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1450 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1492 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1677 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1855 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1980 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 2302 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 2467 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 2963 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 3279 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 3358 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 3415 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1203 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1526 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 2310 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 2970 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 3675 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 2545 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 3689 | CODE | |
| LOW | script/case_study.py | 29 | CODE | |
| LOW | script/case_study.py | 109 | CODE | |
| LOW | script/case_study.py | 120 | CODE | |
| LOW | servers/benchmark/src/benchmark.py | 15 | CODE | |
| LOW | servers/reranker/src/reranker.py | 36 | CODE | |
| LOW | servers/reranker/src/reranker.py | 151 | CODE | |
| LOW | servers/corpus/src/corpus.py | 131 | CODE | |
| LOW | servers/corpus/src/corpus.py | 169 | CODE | |
| LOW | servers/corpus/src/corpus.py | 364 | CODE | |
| LOW | servers/corpus/src/corpus.py | 515 | CODE | |
| LOW | servers/corpus/src/corpus.py | 674 | CODE | |
| LOW | servers/corpus/src/corpus.py | 849 | CODE | |
| LOW | servers/corpus/src/corpus.py | 971 | CODE | |
| LOW | servers/corpus/src/corpus.py | 399 | CODE | |
| LOW | servers/retriever/src/retriever.py | 82 | CODE | |
| LOW | servers/retriever/src/retriever.py | 209 | CODE | |
| LOW | servers/retriever/src/retriever.py | 558 | CODE | |
| LOW | servers/retriever/src/retriever.py | 738 | CODE | |
| LOW | servers/retriever/src/retriever.py | 930 | CODE | |
| LOW | servers/retriever/src/retriever.py | 151 | CODE | |
| LOW | servers/retriever/src/index_backends/milvus_backend.py | 217 | CODE | |
| LOW | …rs/retriever/src/websearch_backends/zhipuai_backend.py | 38 | CODE | |
| LOW | …rs/retriever/src/websearch_backends/zhipuai_backend.py | 68 | CODE | |
| LOW | servers/prompt/src/prompt.py | 294 | CODE | |
| LOW | servers/prompt/src/prompt.py | 732 | CODE | |
| LOW | servers/prompt/src/prompt.py | 797 | CODE | |
| LOW | servers/prompt/src/prompt.py | 826 | CODE | |
| LOW | servers/prompt/src/prompt.py | 862 | CODE | |
| LOW | servers/prompt/src/prompt.py | 908 | CODE | |
| LOW | servers/evaluation/src/evaluation.py | 371 | CODE | |
| LOW | servers/evaluation/src/evaluation.py | 429 | CODE | |
| LOW | servers/evaluation/src/evaluation.py | 508 | CODE | |
| LOW | servers/evaluation/src/evaluation.py | 565 | CODE | |
| LOW | servers/evaluation/src/evaluation.py | 589 | CODE | |
| 30 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | AGENTS.md | 30 | │ ├── client.py # CLI + pipeline engine + run/build orchestration | CODE |
| MEDIUM | docs/llms.txt | 2648 | # RAG Demo for UltraRAG UI | COMMENT |
| MEDIUM | docs/llms.txt | 3282 | # Vanilla RAG with Corpus Indexing Demo | COMMENT |
| MEDIUM | docs/llms.txt | 3798 | ## What is RAG? | COMMENT |
| MEDIUM | docs/llms.txt | 3934 | ## Build RAG Pipeline | COMMENT |
| MEDIUM | docs/llms.txt | 3957 | ### Write RAG Pipeline | COMMENT |
| MEDIUM | examples/experiments/rag_deploy.yaml | 1 | # RAG Deploy Demo | COMMENT |
| MEDIUM | examples/experiments/rag_loop.yaml | 1 | # RAG Loop Demo | COMMENT |
| MEDIUM | examples/experiments/rag_branch.yaml | 1 | # RAG Branch Demo | COMMENT |
| MEDIUM | examples/experiments/rag_multiple_choice.yaml | 1 | # Vanilla RAG Demo for Multiple Choice Datasets | COMMENT |
| MEDIUM | examples/experiments/rag_wow.yaml | 1 | # Vanilla RAG Demo for WoW Dataset | COMMENT |
| MEDIUM | examples/experiments/vanilla_rag.yaml | 1 | # Vanilla RAG Demo | COMMENT |
| MEDIUM | examples/experiments/rag_full.yaml | 1 | # Vanilla RAG with Corpus Indexing Demo | COMMENT |
| MEDIUM | examples/experiments/multimodal_rag.yaml | 1 | # Multi-Modal RAG Demo | COMMENT |
| MEDIUM | examples/demos/RAG_memory.yaml | 1 | # RAG Memory Demo for UltraRAG UI | COMMENT |
| MEDIUM | examples/demos/RAG_web.yaml | 1 | # RAG Demo for UltraRAG UI | COMMENT |
| MEDIUM | examples/demos/RAG.yaml | 1 | # RAG Demo for UltraRAG UI | COMMENT |
| MEDIUM | servers/retriever/parameter.yaml | 30 | # Provider-prefixed embedding model routes to any LiteLLM-supported provider, | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/backend/app.py | 2223 | # ========================================= | COMMENT |
| MEDIUM | ui/backend/app.py | 2225 | # ========================================= | COMMENT |
| MEDIUM | ui/backend/app.py | 2350 | # ========================================= | COMMENT |
| MEDIUM | ui/backend/app.py | 2352 | # ========================================= | COMMENT |
| MEDIUM | src/ultrarag/cli.py | 14 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | COMMENT |
| MEDIUM | src/ultrarag/cli.py | 16 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | COMMENT |
| MEDIUM | src/ultrarag/cli.py | 56 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM | src/ultrarag/cli.py | 58 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM | src/ultrarag/cli.py | 152 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM | src/ultrarag/cli.py | 154 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM | src/ultrarag/cli.py | 353 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM | src/ultrarag/cli.py | 355 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM | src/ultrarag/cli.py | 413 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM | src/ultrarag/cli.py | 415 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM⚡ | src/ultrarag/cli.py | 520 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| MEDIUM⚡ | src/ultrarag/cli.py | 522 | # ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/backend/auth.py | 1 | CODE | |
| LOW | ui/backend/kb_visibility_store.py | 1 | CODE | |
| LOW | ui/backend/chat_store.py | 1 | CODE | |
| LOW | ui/backend/storage_paths.py | 1 | CODE | |
| LOW | ui/backend/app.py | 1 | CODE | |
| LOW | ui/backend/pipeline_manager.py | 1 | CODE | |
| LOW | servers/memory/src/memory.py | 1 | CODE | |
| LOW | servers/memory/src/memory.py | 7 | CODE | |
| LOW | servers/retriever/src/retriever.py | 1346 | CODE | |
| LOW | servers/retriever/src/bm25_tokenizer.py | 1 | CODE | |
| LOW | servers/retriever/src/index_backends/qdrant_backend.py | 1 | CODE | |
| LOW | servers/retriever/src/index_backends/qdrant_backend.py | 4 | CODE | |
| LOW | servers/retriever/src/index_backends/faiss_backend.py | 1 | CODE | |
| LOW | servers/retriever/src/index_backends/__init__.py | 1 | CODE | |
| LOW | servers/retriever/src/index_backends/base.py | 1 | CODE | |
| LOW | servers/retriever/src/index_backends/milvus_backend.py | 1 | CODE | |
| LOW | servers/retriever/src/index_backends/milvus_backend.py | 5 | CODE | |
| LOW | …rs/retriever/src/websearch_backends/zhipuai_backend.py | 1 | CODE | |
| LOW | servers/retriever/src/websearch_backends/__init__.py | 1 | CODE | |
| LOW | servers/retriever/src/websearch_backends/exa_backend.py | 1 | CODE | |
| LOW | servers/retriever/src/websearch_backends/base.py | 1 | CODE | |
| LOW | …ers/retriever/src/websearch_backends/tavily_backend.py | 1 | CODE | |
| LOW | servers/prompt/src/prompt.py | 1 | CODE | |
| LOW | servers/generation/src/local_generation.py | 2 | CODE | |
| LOW | servers/router/src/router.py | 1 | CODE | |
| LOW | servers/router/src/router.py | 2 | CODE | |
| LOW | src/ultrarag/server.py | 3 | CODE | |
| LOW | src/ultrarag/server.py | 9 | CODE | |
| LOW | src/ultrarag/server.py | 14 | CODE | |
| LOW | src/ultrarag/server.py | 17 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | docs/llms.txt | 3093 | ## Step 1: Compile Pipeline | COMMENT |
| LOW⚡ | docs/llms.txt | 3101 | ## Step 2: Run | COMMENT |
| LOW⚡ | docs/llms.txt | 3109 | ## Step 3: Create New Parameter File | COMMENT |
| LOW | docs/llms.txt | 3046 | ## Step 1: Compile and Configure Parameters | COMMENT |
| LOW | docs/llms.txt | 3050 | ## Step 2: Create Debug Configuration File | COMMENT |
| LOW | docs/llms.txt | 3075 | ## Step 3: Start Debugging | COMMENT |
| LOW | docs/llms.txt | 3275 | ## Step 1: Write Pipeline Configuration File | COMMENT |
| LOW | docs/llms.txt | 3312 | ## Step 2: Compile Pipeline and Adjust Parameters | COMMENT |
| LOW | docs/llms.txt | 3449 | ## Step 3: Run Pipeline | COMMENT |
| LOW | docs/llms.txt | 3463 | ## Step 4: Visual Analysis Case Study | COMMENT |
| LOW | docs/llms.txt | 4979 | ### Step 1: Configure Alias Server | COMMENT |
| LOW | docs/llms.txt | 5010 | ### Step 2: Call Separately in Pipeline | COMMENT |
| LOW | docs/llms.txt | 6208 | ### Step 1: Create Server File | COMMENT |
| LOW | docs/llms.txt | 6224 | ### Step 2: Implement Tool Functions | COMMENT |
| LOW | docs/llms.txt | 6248 | ### Step 3: Configure Parameter File | COMMENT |
| LOW | docs/llms.txt | 6312 | ### Step 1: Prepare Prompt Template | COMMENT |
| LOW | docs/llms.txt | 6327 | ### Step 2: Implement Tool in Prompt Server | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | servers/reranker/src/reranker.py | 0 | remove banned keys and none values from dictionary. args: d: dictionary to filter banned: list of keys to remove returns | STRING |
| HIGH | servers/retriever/src/retriever.py | 0 | remove banned keys and none values from dictionary. args: d: dictionary to filter banned: list of keys to remove returns | STRING |
| HIGH | servers/generation/src/generation.py | 0 | remove banned keys and none values from dictionary. args: d: dictionary to filter banned: list of keys to remove returns | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ui/backend/pipeline_manager.py | 2357 | # Write file | COMMENT |
| LOW | ui/backend/pipeline_manager.py | 2387 | # Check if old file exists | COMMENT |
| LOW | ui/backend/pipeline_manager.py | 2392 | # Check if new name already exists in any known pipeline directory | COMMENT |
| LOW | servers/benchmark/src/benchmark.py | 103 | # Check if ret is empty before accessing values | COMMENT |
| LOW | servers/corpus/src/corpus.py | 43 | # Check if safe_path is relative to base_path | COMMENT |
| LOW | servers/custom/src/custom.py | 986 | # Check if already extended | COMMENT |
| LOW | src/ultrarag/client.py | 300 | # Check if there are any branch*_state keys | COMMENT |
| LOW | src/ultrarag/client.py | 1806 | # Check if doc already has [id] prefix | COMMENT |
| LOW | src/ultrarag/client.py | 1971 | # Check if doc already has [id] prefix | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | ui/backend/pipeline_manager.py | 3686 | # Create a progress wrapper for streaming updates | COMMENT |
| MEDIUM | servers/prompt/src/prompt.py | 16 | # Create a sandboxed Jinja2 environment for security | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | servers/retriever/src/index_backends/__init__.py | 44 | __all__ = [ | CODE |
| LOW | servers/retriever/src/websearch_backends/__init__.py | 43 | __all__ = [ | CODE |
| LOW⚡ | src/ultrarag/cli.py | 524 | __all__ = [ | STRING |
| LOW | src/ultrarag/utils.py | 110 | def set_pdeathsig() -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/ultrarag/server.py | 39 | CODE | |
| LOW | src/ultrarag/server.py | 244 | CODE |