Home / PrismML-Eng / Bonsai-demo
AI Slop Code RIsk Monitor

PrismML-Eng/Bonsai-demo

Bonsai Demo

12.2 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for PrismML-Eng/Bonsai-demo, a Shell project with 3,328 GitHub stars. SynthScan examined 22,359 lines of code across 156 source files, recording 155 pattern matches distributed across 10 syntactic categories. The legacy adjusted pattern signal is 12.2 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

12.2
Adjusted Signal
12.2
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
3.3K
Stars
Shell
Language
22.4K
Lines of Code
156
Files
155
Pattern Hits
2026-10-12
Scan Date
0.04
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 21.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 86 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 38.6/100 · MEDIUM

Are wrappers, guards, and repeated structures necessary? 120 finding(s).

PR Review Velocity Impact 44.5/100 · MEDIUM

Which changes need focused human review? 155 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 6MEDIUM 39LOW 110

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 155 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators29 hits · 99 pts
SeverityFileLineSnippetContext
MEDIUM⚡setup.sh151# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh153# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh157# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh159# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh243# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh245# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh254# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh256# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh261# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh263# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh270# ────────────────────────────────────────────────────COMMENT
MEDIUM⚡setup.sh272# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh21# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh23# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh214# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh216# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh287# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh289# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh420# ────────────────────────────────────────────────────COMMENT
MEDIUMsetup.sh422# ────────────────────────────────────────────────────COMMENT
MEDIUMscripts/openwebui/make_demo_db.py62# ── customers ────────────────────────────────────────────────────────────────STRING
MEDIUMscripts/openwebui/make_demo_db.py83# ── orders ───────────────────────────────────────────────────────────────────STRING
MEDIUMscripts/openwebui/make_demo_db.py116# ── support tickets (spike for anchors in May-June 2025: v3 firmware) ────────STRING
MEDIUM.github/workflows/manual-platform-smoke.yml83 # ──────────────────────────────────────────COMMENT
MEDIUM.github/workflows/manual-platform-smoke.yml85 # ──────────────────────────────────────────COMMENT
MEDIUM.github/workflows/manual-platform-smoke.yml376 # ──────────────────────────────────────────COMMENT
MEDIUM.github/workflows/manual-platform-smoke.yml378 # ──────────────────────────────────────────COMMENT
MEDIUM.github/workflows/build-from-source-smoke.yml47 # ──────────────────────────────────────────COMMENT
MEDIUM.github/workflows/build-from-source-smoke.yml49 # ──────────────────────────────────────────COMMENT
Hyper-Verbose Identifiers51 hits · 52 pts
SeverityFileLineSnippetContext
LOWtests/test_seed_openwebui.py30 def test_model_disables_openwebui_citation_rewrite(self):CODE
LOWtests/test_seed_openwebui.py49 def test_prompt_is_generic_bounded_and_date_aware(self):CODE
LOWtests/test_seed_openwebui.py72 def test_repo_owned_code_tool_is_attached_when_jupyter_is_on(self):CODE
LOWtests/test_tool_web_fetch.py60 def test_prefers_article_and_returns_source_metadata(self):CODE
LOWtests/test_tool_web_fetch.py94 def test_navigation_only_page_is_rejected_and_does_not_consume_quota(self):STRING
LOW⚡tests/test_tool_web_fetch.py106 def test_unreadable_page_releases_slot_for_a_retry(self):STRING
LOW⚡tests/test_tool_web_fetch.py116 def test_quota_reservations_include_parallel_inflight_calls(self):STRING
LOW⚡tests/test_tool_web_fetch.py125 def test_binary_content_is_rejected_without_consuming_quota(self):STRING
LOWtests/test_mlx_existing_server.py24 def test_older_families_keep_reuse(self):CODE
LOW⚡tests/test_mlx_setup_paths.py83 def test_current_environment_skips_install(self):STRING
LOW⚡tests/test_mlx_setup_paths.py88 def test_legacy_families_still_require_metal(self):STRING
LOW⚡tests/test_mlx_setup_paths.py96 def test_all_installs_both_runtimes_with_metal(self):STRING
LOWtests/test_smoke_local_api.py37 def test_http_error_body_status_and_timing_are_reported(self):CODE
LOWtests/test_smoke_local_api.py53 def test_non_json_http_error_and_tokenize_request_are_recorded(self):CODE
LOWtests/test_smoke_local_api.py64 def test_successful_http_request_retains_usage_and_timing(self):CODE
LOWtests/test_smoke_local_api.py81 def test_transport_failure_records_timing_without_http_status(self):CODE
LOWtests/test_smoke_local_api.py91 def test_failed_context_check_preserves_actual_answer(self):CODE
LOWtests/test_smoke_local_api.py102 def test_retry_and_final_result(self):CODE
LOWtests/test_smoke_local_api.py106 def test_no_tool_is_not_success(self):CODE
LOW⚡tests/test_smoke_local_api.py118 def test_unbounded_loop_is_stopped(self):CODE
LOW⚡tests/test_smoke_local_api.py122 def test_reasoning_only_is_failure(self):CODE
LOW⚡tests/test_smoke_local_api.py131 def test_truncated_response_is_failure(self):CODE
LOW⚡tests/test_smoke_local_api.py137 def test_cli_exit_and_no_overwrite(self):CODE
LOWtests/test_tool_code_interpreter.py15 def test_progress_only_stderr_is_clean_success(self):CODE
LOWtests/test_tool_code_interpreter.py24 def test_traceback_without_result_is_compact_error(self):CODE
LOWtests/test_tool_code_interpreter.py42 def test_traceback_with_image_is_partial_success(self):CODE
LOWtests/test_tool_code_interpreter.py53 def test_tool_description_is_generic_and_allows_api_discovery(self):CODE
LOWtests/test_tool_code_interpreter.py63 def test_generated_image_is_attached_with_native_compatible_file_event(self):CODE
LOWtests/test_tool_code_interpreter.py85 def test_generated_image_has_model_fallback_without_event_emitter(self):CODE
LOW⚡tests/test_tool_code_interpreter.py99 def test_non_image_result_is_preserved(self):CODE
LOW⚡tests/test_tool_code_interpreter.py105 def test_unrelated_error_does_not_receive_yfinance_advice(self):CODE
LOW⚡tests/test_tool_code_interpreter.py115 def test_nonfatal_warning_is_preserved_without_marking_failure(self):CODE
LOWtests/test_tool_sql.py17 def test_description_names_dialect_and_common_date_trap(self):CODE
LOW⚡tests/test_tool_sql.py43 def test_leading_line_and_block_comments_are_allowed(self):CODE
LOW⚡tests/test_tool_sql.py52 def test_large_detailed_results_are_withheld(self):CODE
LOW⚡tests/test_tool_sql.py61 def test_small_results_include_completeness_marker(self):CODE
LOW⚡tests/test_native_mlx_versions.py12 def test_tested_versions_pass(self):CODE
LOW⚡tests/test_native_mlx_versions.py16 def test_old_importable_environment_is_rejected(self):CODE
LOW⚡tests/test_native_mlx_versions.py22 def test_missing_dependency_is_rejected(self):CODE
LOWscripts/openwebui/tool_code_interpreter.py80def _extract_artifact_markdown(result: str) -> str:CODE
LOWscripts/openwebui/tool_sql.py15def _without_leading_comments(sql: str) -> str:CODE
LOW⚡scripts/agent/test_runner_safety.py57 def test_existing_workspace_is_preserved(self):STRING
LOW⚡scripts/agent/test_runner_safety.py66 def test_dangling_workspace_symlink_is_preserved(self):STRING
LOW⚡scripts/agent/test_runner_safety.py74 def test_missing_task_leaves_no_run_state(self):STRING
LOW⚡scripts/agent/test_runner_safety.py81 def test_missing_feedback_workspace_leaves_no_run_state(self):STRING
LOW⚡scripts/agent/test_runner_safety.py88 def test_relative_workspace_root_is_rejected_before_creation(self):STRING
LOW⚡scripts/agent/test_runner_safety.py95 def test_workspace_created_after_precheck_is_preserved(self):STRING
LOW⚡scripts/agent/test_runner_safety.py102 def test_existing_custom_home_is_preserved(self):STRING
LOWscripts/agent/test_runner_safety.py113 def test_fresh_workspace_with_spaces_reaches_mock_launch(self):STRING
LOWscripts/agent/test_runner_safety.py127 def test_failed_launch_removes_everything_it_created(self):STRING
LOWscripts/agent/test_runner_safety.py143 def test_trace_injection_uses_runner_values(self):STRING
Excessive Try-Catch Wrapping34 hits · 37 pts
SeverityFileLineSnippetContext
LOWscripts/common.sh345except Exception:CODE
LOWscripts/smoke_local_api.py48 except Exception as error:CODE
LOWscripts/smoke_local_api.py150 except Exception as error:CODE
LOWscripts/openwebui/tool_code_interpreter.py113 except Exception:CODE
LOWscripts/openwebui/tool_code_interpreter.py212 except Exception as exc:CODE
LOWscripts/openwebui/tool_sql.py81 except Exception as e:CODE
LOWscripts/openwebui/tool_weather.py51 except Exception as e:CODE
LOWscripts/openwebui/tool_web_fetch.py333 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py129 except Exception:CODE
LOWscripts/openwebui/seed_openwebui.py138 except Exception:CODE
LOWscripts/openwebui/seed_openwebui.py154 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py185 except Exception as e2:CODE
LOWscripts/openwebui/seed_openwebui.py187 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py261 except Exception as e2:CODE
LOWscripts/openwebui/seed_openwebui.py263 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py288 except Exception:CODE
LOWscripts/openwebui/seed_openwebui.py302 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py310 except Exception:CODE
LOWscripts/openwebui/seed_openwebui.py323 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py333 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py345 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py371 except Exception as e:CODE
LOWscripts/openwebui/seed_openwebui.py412 except Exception as e: # never fail the launcherCODE
LOWscripts/agent/logproxy.py24 except Exception:CODE
LOWscripts/agent/logproxy.py32 except Exception: continueCODE
LOWscripts/agent/logproxy.py63 except Exception as e: sys.stderr.write("logproxy: bad INJECT_BODY (%r)\n" % (e,))CODE
LOWscripts/agent/logproxy.py77 except Exception as e:CODE
LOW⚡scripts/agent/logproxy.py96 except Exception as _e:CODE
LOW⚡scripts/agent/logproxy.py103 except Exception: passCODE
LOW⚡scripts/agent/logproxy.py108 except Exception as _e: sys.stderr.write("inject body failed: %r\n"%(_e,))CODE
LOW⚡scripts/agent/logproxy.py150 except Exception: passCODE
LOW⚡scripts/agent/logproxy.py157 except Exception as _e:CODE
LOW⚡scripts/agent/logproxy.py167 except Exception: passCODE
LOWscripts/agent/logproxy.py181 except Exception: passCODE
Empty Error Handlers6 hits · 30 pts
SeverityFileLineSnippetContext
HIGHscripts/openwebui/tool_code_interpreter.py113except Exception:CODE
HIGHscripts/agent/logproxy.py24except Exception:CODE
HIGHscripts/agent/logproxy.py103except Exception: passCODE
HIGHscripts/agent/logproxy.py181except Exception: passCODE
HIGHscripts/agent/logproxy.py167except Exception: passCODE
HIGHscripts/agent/logproxy.py150except Exception: passCODE
Modern AI Meta-Vocabulary10 hits · 28 pts
SeverityFileLineSnippetContext
MEDIUMOPENWEBUI.md1# Open WebUI: the full agentic demoCOMMENT
MEDIUMREADME.md328## Open WebUI (Optional): the full agentic demoCOMMENT
MEDIUMREADME.md456├── OPENWEBUI.md # Open WebUI agentic demo guideCODE
MEDIUMTOOLS.md60The built-in UI (http://localhost:8080) has an MCP client with an agentic loop.CODE
MEDIUMscripts/start_openwebui.sh333# generous-but-finite 30: enough for the agentic DB-analyst scenarioCOMMENT
MEDIUMscripts/start_agent_server.sh2# Start llama-server with the "agent profile": the settings the Bonsai 2 agentic demo (AGENT-DEMO.md)COMMENT
MEDIUMscripts/start_llama_server.sh132 # by default and lives on this standalone server, not the agentic Open WebUICOMMENT
MEDIUMscripts/openwebui/seed_openwebui.py225 # RAG citation template after fetch_url calls. That conflicts withCOMMENT
MEDIUMscripts/openwebui/seed_openwebui.py398 # Hide backend helper models (e.g. mlx-vlm's embedding model) from the picker.COMMENT
MEDIUMscripts/agent/run_agent_demo.sh2# Run one round of the Bonsai 2 agentic demo (AGENT-DEMO.md) against a running llama-server.COMMENT
Over-Commented Block14 hits · 14 pts
SeverityFileLineSnippetContext
LOWscripts/common.sh1#!/bin/shCOMMENT
LOWscripts/common.sh121COMMENT
LOWscripts/common.sh181 bonsai_mlx_presentCOMMENT
LOWscripts/common.sh241# We deliberately do NOT use llama.cpp's -c 0: that means "use the model's fullCOMMENT
LOWscripts/fetch_gguf.sh1#!/bin/shCOMMENT
LOWscripts/start_openwebui.sh321export ENABLE_RAG_WEB_SEARCH=falseCOMMENT
LOWscripts/start_agent_server.sh1#!/bin/shCOMMENT
LOWscripts/make_kv_bias.sh1#!/bin/shCOMMENT
LOWscripts/download_models.sh1#!/bin/shCOMMENT
LOWscripts/build_cuda_linux.sh1#!/bin/bashCOMMENT
LOWscripts/openwebui/seed_openwebui.py221 "vision": vision,COMMENT
LOWscripts/agent/run_agent_demo.sh1#!/usr/bin/env bashCOMMENT
LOWscripts/agent/run_agent_demo.sh21# AGENT_WORKSPACE_ROOT absolute workspace root (default: bonsai-agent under the system temp directory)COMMENT
LOWdemos/skateboard/skate-rush/pages/round1.html21#combo.show{opacity:1}COMMENT
Example Usage Blocks5 hits · 7 pts
SeverityFileLineSnippetContext
LOWsetup.sh5# Usage:COMMENT
LOWscripts/fetch_gguf.sh5# Usage:COMMENT
LOWscripts/make_kv_bias.sh7# Usage:COMMENT
LOWscripts/download_models.sh4# Usage:COMMENT
LOWscripts/build_cuda_linux.sh6# Usage:COMMENT
Redundant / Tautological Comments2 hits · 3 pts
SeverityFileLineSnippetContext
LOWscripts/common.sh6# Set BONSAI_MODEL to choose size: 27B (default), 8B, 4B, 1.7B, or allCOMMENT
LOWscripts/common.sh7# Set BONSAI_FAMILY to choose family: bonsai2 (default), ternary, bonsai (1-bit), or allCOMMENT
Deep Nesting3 hits · 3 pts
SeverityFileLineSnippetContext
LOWscripts/openwebui/tool_web_fetch.py257CODE
LOWscripts/openwebui/tool_web_fetch.py279CODE
LOWscripts/agent/logproxy.py83CODE
Overly Generic Function Names1 hit · 1 pts
SeverityFileLineSnippetContext
LOW⚡scripts/agent/test_runner_safety.py51 def run_task(self, task=None, mode_args=None):STRING