Repository Analysis

OpenNHP/opennhp

A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world.

6.0 Low AI signal View on GitHub

Analysis Overview

This report presents the forensic synthetic code analysis of OpenNHP/opennhp, a Go project with 13,824 GitHub stars. SynthScan v2.0 examined 88,553 lines of code across 459 source files, recording 305 pattern matches distributed across 9 syntactic categories. The overall adjusted score of 6.0 places this repository in the Low AI signal band.

The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).

6.0
Adjusted Score
6.0
Raw Score
100%
Time Factor
2026-07-31
Last Push
13.8K
Stars
Go
Language
88.6K
Lines of Code
459
Files
305
Pattern Hits
2026-08-02
Scan Date
0.00
HC Hit Rate

What These Metrics Mean

Adjusted Score
Primary synthetic code indicator. Raw score normalised per 1,000 lines of code and multiplied by the temporal discount factor. This is the definitive comparative metric — use it to rank repositories by AI authorship density.
Raw Score
The unmodified sum of all severity-weighted, context-multiplied pattern match scores before temporal discounting. Reflects the absolute signal strength independent of when the repository was last active.
Time Factor
The temporal discount multiplier (0–100%) applied to the raw score. Repositories last updated before ChatGPT's launch (Nov 2022) receive a 5% factor. Full signal is only assigned to repositories active in the post-adoption era (Jan 2024+).
Pattern Hits
Total count of individual pattern matches across all files and categories. A high hit count with a low score may indicate a very large codebase with isolated AI snippets; a low count with a high score indicates dense, concentrated AI signatures.
HC Hit Rate
High+Critical pattern hits per file, averaged across the repository. This orthogonal signal catches repositories where a few files are densely packed with high-severity AI tells — a strong indicator even when the normalised score appears moderate due to codebase size.
Lines of Code / Files
Total lines and files analysed. The scanner examines 94 file extensions. These denominators are used to normalise the score, enabling fair comparison between repositories of vastly different sizes.

Score History

This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.

Severity Breakdown

Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.

CRITICAL 0HIGH 0MEDIUM 98LOW 207

Directory Score Breakdown

This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.

Pattern Findings

The scanner identified 305 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.

Decorative Section Separators93 hits · 284 pts
SeverityFileLineSnippetContext
MEDIUMterraform/demo/tls.tf1# =============================================================================COMMENT
MEDIUMterraform/demo/tls.tf3# =============================================================================COMMENT
MEDIUMterraform/demo/tls.tf13# =============================================================================COMMENT
MEDIUMterraform/demo/ses.tf1# ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMterraform/demo/ses.tf5# ──────────────────────────────────────────────────────────────────────COMMENT
MEDIUMterraform/demo/ses.tf72# ── SMTP credentials ────────────────────────────────────────────────COMMENT
MEDIUMdocker/docker-compose.multicluster.yaml20 # ── Cluster 1 ────────────────────────────────────────────────────────────COMMENT
MEDIUMdocker/docker-compose.multicluster.yaml65 # ── Cluster 2 (independent identity + AC) ────────────────────────────────COMMENT
MEDIUMdocker/docker-compose.multicluster.yaml110 # ── Browser entrypoint (nginx reverse proxy) ─────────────────────────────COMMENT
MEDIUMdocker/docker-compose.multicluster.yaml136 # ── Shared relay (declares BOTH clusters) ────────────────────────────────COMMENT
MEDIUMdocker/docker-compose.multicluster.yaml157 # ── Protected web target for cluster 1 ───────────────────────────────────COMMENT
MEDIUMdocker/docker-compose.multicluster.yaml174 # ── Protected web target for cluster 2 ───────────────────────────────────COMMENT
MEDIUMdocker/nhp-agent/etc/server.toml27# ─── Cluster form (recommended) ──────────────────────────────────────COMMENT
MEDIUMdocker/nhp-agent/etc/server.toml52# ─── Legacy flat form (auto-upgraded, deprecated) ────────────────────COMMENT
MEDIUMdocker/nhp-server/etc/config.toml20# ─── Demo-only ───────────────────────────────────────────────────────────COMMENT
MEDIUMdocker/nhp-server/etc/config.toml63# ─── Cookie (stateless, multi-instance-safe) ──────────────────────────────COMMENT
MEDIUMdocker/nhp-server/etc2/config.toml20# ─── Demo-only ───────────────────────────────────────────────────────────COMMENT
MEDIUMdocker/nhp-server/etc2/config.toml63# ─── Cookie (stateless, multi-instance-safe) ──────────────────────────────COMMENT
MEDIUMdocker/multicluster/nhp-relay/etc/config.toml48# ────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMdocker/multicluster/nhp-relay/etc/config.toml50# ────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMdocker/nhp-relay/etc/config.toml48# ────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMdocker/nhp-relay/etc/config.toml50# ────────────────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/ac/main/etc/server.toml23# ─── Cluster form (recommended) ──────────────────────────────────────COMMENT
MEDIUMendpoints/ac/main/etc/server.toml36# ─── Legacy single-server form (auto-upgraded, deprecated) ───────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts17// ─── Mock transport factory ───────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts59// ─── Helpers ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts108// ─── Static metadata ──────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts116// ─── Initialization ───────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts174// ─── Server management ────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts206// ─── Identity ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts228// ─── knockResource error cases (no transport needed) ─────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts269// ─── knockResource success path (mocked transport) ───────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts411// ─── Knock body authenticates the HeaderType (on-path flip protection) ───────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts495// ─── Event emitter ────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts592// ─── exitResource ─────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/NHPAgent.test.ts621// ─── close ────────────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/header.test.ts14// ─── NHPHeader (curve25519, 240 bytes) ───────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/header.test.ts147// ─── NHPHeaderEx (gmsm, 304 bytes) ───────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/packet.test.ts18// ─── helpers ─────────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/packet.test.ts37// ─── CURVE25519 ACK round-trip ────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/packet.test.ts140// ─── COK / RNK cookie flow ────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/packet.test.ts176// ─── Error cases ─────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/packet.test.ts254// ─── Anti-replay ─────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/packet.test.ts279// ─── clearServerCookie ────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/test/protocol/packet.test.ts316// ─── GMSM (SM2/SM3/SM4) round-trip ───────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/examples/reg.html453<span class="c-comment">// ── Step 1: generate key pair ─────────────────</span>CODE
MEDIUMendpoints/js-agent/examples/reg.html467<span class="c-comment">// ── Step 2: request OTP (NHP-OTP) ─────────────</span>CODE
MEDIUMendpoints/js-agent/examples/reg.html474<span class="c-comment">// ── Step 3: register key (NHP-REG) ────────────</span>CODE
MEDIUMendpoints/js-agent/examples/reg.html611// ── i18n ──────────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/src/transport/relay.ts98 // ─── Transport interface ──────────────────────────────────────────────────COMMENT
MEDIUMendpoints/js-agent/src/transport/relay.ts152 // ─── Internal ─────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/server/keystore_test.go254// ── OTP tests ──────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/server/keystore_test.go467// ── OTP sweep tests ──────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/server/keystore.go130// ── OTP operations ────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/server/keystore.go344// ── Agent key operations ──────────────────────────────────────────────────COMMENT
MEDIUMendpoints/server/keystore.go571// ── Helpers ───────────────────────────────────────────────────────────────COMMENT
MEDIUMendpoints/agent/main/etc/server.toml38# ─── Local docker environment ─────────────────────────────────────────COMMENT
MEDIUMendpoints/db/main/etc/server.toml28# ─── Cluster form (recommended) ──────────────────────────────────────COMMENT
MEDIUMendpoints/db/main/etc/server.toml37# ─── Legacy single-server form (auto-upgraded, deprecated) ───────────COMMENT
MEDIUMendpoints/relay/relay.go7// ◀──NHP response (encrypted)────────COMMENT
33 more matches not shown…
Over-Commented Block167 hits · 167 pts
SeverityFileLineSnippetContext
LOWterraform/demo/ssh-key.tf1# SSH keypair management.COMMENT
LOWterraform/demo/security-groups.tf1# --- nhp-relay Security Group ---COMMENT
LOWterraform/demo/tls.tf1# =============================================================================COMMENT
LOWterraform/demo/ses.tf61 type = "TXT"COMMENT
LOWdocker/docker-compose.multicluster.yaml1# Local multi-cluster validation stack.COMMENT
LOWdocker/nhp-agent/etc/resource.toml1# Resources the agent should knock on automatically after launch.COMMENT
LOWdocker/nhp-agent/etc/server.toml1# nhp-agent server-peer configuration.COMMENT
LOWdocker/nhp-agent/etc/server.toml21# Per-instance fields:COMMENT
LOWdocker/nhp-agent/etc/server.toml61# Port = 62206COMMENT
LOWdocker/nhp-server/plugins/example/etc/resource.toml1# List resources id and their sub-fields hereCOMMENT
LOWdocker/nhp-server/etc/relay.toml1# NHP Server relay peers configurationCOMMENT
LOWdocker/nhp-server/etc/config.toml1# NHP-Server base configCOMMENT
LOWdocker/nhp-server/etc/config.toml21# Accept RFC1918 / loopback / CGNAT addresses as the SourceAddr field ofCOMMENT
LOWdocker/nhp-server/etc/config.toml41# on, every agent goes through the cookie-stamped handshakeCOMMENT
LOWdocker/nhp-server/etc/config.toml61ForceOverload = falseCOMMENT
LOWdocker/nhp-server/etc2/relay.toml1# NHP Server relay peers configurationCOMMENT
LOWdocker/nhp-server/etc2/config.toml1# NHP-Server base configCOMMENT
LOWdocker/nhp-server/etc2/config.toml21# Accept RFC1918 / loopback / CGNAT addresses as the SourceAddr field ofCOMMENT
LOWdocker/nhp-server/etc2/config.toml41# on, every agent goes through the cookie-stamped handshakeCOMMENT
LOWdocker/nhp-server/etc2/config.toml61ForceOverload = falseCOMMENT
LOWdocker/multicluster/nhp-server-c2/etc/relay.toml1# NHP Server relay peers configurationCOMMENT
LOWdocker/multicluster/nhp-relay/etc/config.toml1# NHP Relay Service ConfigurationCOMMENT
LOWdocker/multicluster/nhp-relay/etc/config.toml41writeTimeoutMs = 10000COMMENT
LOWdocker/nhp-relay/etc/config.toml1# NHP Relay Service ConfigurationCOMMENT
LOWdocker/nhp-relay/etc/config.toml41writeTimeoutMs = 10000COMMENT
LOWdocker/nhp-relay/etc/config.toml81COMMENT
LOWendpoints/ac/main/etc/remote.toml1# NHP-AC remote configCOMMENT
LOWendpoints/ac/main/etc/server.toml1# list the server peers for the AC under [[Servers]] tableCOMMENT
LOWendpoints/ac/main/etc/server.toml21# on nhp-ac; see LoadBalance above)COMMENT
LOWendpoints/ac/main/etc/config.toml1# NHP-AC base configCOMMENT
LOWendpoints/js-agent/examples/reg.html161 #seq-phase-otp .seq-msg { stroke: #58a6ff; }COMMENT
LOWendpoints/js-agent/examples/relay-test.html1441COMMENT
LOWendpoints/server/config.go21 toml "github.com/pelletier/go-toml/v2"COMMENT
LOWendpoints/server/config.go101 // mapping, the relay container sees the request as coming from theCOMMENT
LOWendpoints/server/config.go121 // deployments, broken for multi-instance ones (the failure mode is theCOMMENT
LOWendpoints/server/config.go141 // local demo will never reach — so this flag exists purely to letCOMMENT
LOWendpoints/server/config.go641 log.Warning("ignoring CookieSigningKeyBase64 change: %v (keeping running key)", decodeErr)COMMENT
LOWendpoints/server/config.go681 // Only persist the new base64 into s.config when we actuallyCOMMENT
LOWendpoints/server/udpserver.go321 }COMMENT
LOWendpoints/server/udpserver.go741COMMENT
LOWendpoints/server/udpserver.go761 // identity-aware (see teardownPerRelayCounter); aligning theCOMMENT
LOWendpoints/server/ratelimit.go1package serverCOMMENT
LOWendpoints/server/ratelimit.go21// is ever queued to a connection routine, so flood traffic is droppedCOMMENT
LOWendpoints/server/ratelimit.go41// MEMORY: the entry map is capacity-bounded. An attacker rotating spoofedCOMMENT
LOWendpoints/server/ratelimit.go141 }COMMENT
LOWendpoints/server/constants.go1package serverCOMMENT
LOWendpoints/server/constants.go41 ACOpenCompensationTime = 5 // secondCOMMENT
LOWendpoints/server/constants.go61 // while still capping an attacker's forced ECDH rate per address.COMMENT
LOWendpoints/server/msghandler.go21COMMENT
LOWendpoints/server/msghandler.go81}COMMENT
LOWendpoints/server/msghandler.go101// transitioned to the replacement.COMMENT
LOWendpoints/server/msghandler.go141 }COMMENT
LOWendpoints/server/msghandler.go841 // needs the same pre-ECDH throttle. Dropped-only, no block-listing.COMMENT
LOWendpoints/server/msghandler.go861 // split from the right. See relayConnKeySep for the full reasoning.COMMENT
LOWendpoints/server/msghandler.go901 } else {COMMENT
LOWendpoints/server/msghandler.go941 }COMMENT
LOWendpoints/server/knock_headertype.go1package serverCOMMENT
LOWendpoints/server/knock_headertype.go21//COMMENT
LOWendpoints/server/config_test.go41 config: &Config{COMMENT
LOWendpoints/server/config_test.go181}COMMENT
107 more matches not shown…
Structural Annotation Overuse16 hits · 28 pts
SeverityFileLineSnippetContext
LOWendpoints/js-agent/examples/relay-test.html1802 // Step 1: InitCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1822 // Step 2: Identity + ServerCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1837 // Step 3: Listen for eventsCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1875 // Step 4: Knock — also do a manual fetch to capture raw HTTP response detailsCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1893 // Step 5: ResultCOMMENT
LOWendpoints/agent/main/main.go403 // Step 0: generate a fresh key pair — let the user choose the cipherCOMMENT
LOWendpoints/agent/main/main.go593 // Step 1: OTP request (skipped when --otp is provided).COMMENT
LOWendpoints/agent/main/main.go625 // Step 2: Register public key with OTP.COMMENT
LOWdocs/capture-diagrams.md40### Step 1: Start the VitePress Dev ServerCOMMENT
LOWdocs/capture-diagrams.md49### Step 2: Run the Capture ScriptCOMMENT
LOWexamples/server_plugin/basic/main.go431 // Step 1: validate OTP.COMMENT
LOWexamples/server_plugin/basic/main.go439 // Step 2: register the agent's public key.COMMENT
LOWexamples/server_plugin/basic/main.go447 // Step 3: echo the stored expiry back to the agent so the SDK canCOMMENT
LOWnhp/test/ipv6_support_test.go109 // Step 1: Detect IP typeCOMMENT
LOWnhp/test/ipv6_support_test.go118 // Step 2: Get appropriate CIDR maskCOMMENT
LOWnhp/test/ipv6_support_test.go121 // Step 3: Parse CIDRCOMMENT
Verbosity Indicators14 hits · 26 pts
SeverityFileLineSnippetContext
LOWendpoints/js-agent/examples/relay-test.html1802 // Step 1: InitCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1822 // Step 2: Identity + ServerCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1837 // Step 3: Listen for eventsCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1875 // Step 4: Knock — also do a manual fetch to capture raw HTTP response detailsCOMMENT
LOWendpoints/js-agent/examples/relay-test.html1893 // Step 5: ResultCOMMENT
LOWendpoints/agent/main/main.go403 // Step 0: generate a fresh key pair — let the user choose the cipherCOMMENT
LOWendpoints/agent/main/main.go593 // Step 1: OTP request (skipped when --otp is provided).COMMENT
LOWendpoints/agent/main/main.go625 // Step 2: Register public key with OTP.COMMENT
LOWexamples/server_plugin/basic/main.go431 // Step 1: validate OTP.COMMENT
LOWexamples/server_plugin/basic/main.go439 // Step 2: register the agent's public key.COMMENT
LOWexamples/server_plugin/basic/main.go447 // Step 3: echo the stored expiry back to the agent so the SDK canCOMMENT
LOWnhp/test/ipv6_support_test.go109 // Step 1: Detect IP typeCOMMENT
LOWnhp/test/ipv6_support_test.go118 // Step 2: Get appropriate CIDR maskCOMMENT
LOWnhp/test/ipv6_support_test.go121 // Step 3: Parse CIDRCOMMENT
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMterraform/demo/tls.tf34# Create a certificate signing requestCOMMENT
MEDIUM.github/workflows/build-binaries.yml565 # Create the release using gh CLI (more reliable than action)COMMENT
Fake / Example Data5 hits · 6 pts
SeverityFileLineSnippetContext
LOWendpoints/js-agent/test/NHPAgent.test.ts213 userId: 'user@example.com',CODE
LOWendpoints/js-agent/test/NHPAgent.test.ts223 expect(() => agent.setUser('user@example.com', 'example.org')).not.toThrow();CODE
LOWendpoints/js-agent/test/NHPAgent.test.ts283 agent.setIdentity({ userId: 'user@example.com', deviceId: 'device-001' });CODE
LOWendpoints/js-agent/test/NHPAgent.test.ts656 agent.setIdentity({ userId: 'user@example.com', deviceId: 'device-001' });CODE
LOWendpoints/js-agent/test/NHPAgent.test.ts678 agent.setIdentity({ userId: 'user@example.com', deviceId: 'device-001' });CODE
Excessive Try-Catch Wrapping3 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMdocs/agent_sdk.md1771 print("Error: Failed to read Documents directory")CODE
MEDIUMdocs/zh-cn/agent_sdk.zh-cn.md1785 print("Error: Failed to read Documents directory")CODE
MEDIUMexamples/client_sdk/ios/swift/ViewController.swift19 print("Error: Failed to read Documents directory")CODE
Redundant / Tautological Comments3 hits · 5 pts
SeverityFileLineSnippetContext
LOWterraform/demo/tls.tf16 # Check if stealth CA is configured. If either cert or key is missing/empty,COMMENT
LOWdocker/quick_start.sh235 # Check if image existsCOMMENT
LOW.github/workflows/infra-demo.yml136 # Check if already synced (compare BOTH cert and key to catch partial updates)COMMENT
Example Usage Blocks2 hits · 3 pts
SeverityFileLineSnippetContext
LOWscripts/upload-stealth-ca.sh4# Usage:COMMENT
LOWscripts/generate-nhp-keys.sh7# Usage:COMMENT