AI Slop Code Risk Monitor

PyO3/maturin

SlopCodeMonitor badge for PyO3/maturin Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Build and publish crates with pyo3, cffi and uniffi bindings as well as rust binaries as python packages

3.9 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for PyO3/maturin, a Rust project with 5,860 GitHub stars. SynthScan examined 80,651 lines of code across 560 source files, recording 195 pattern matches distributed across 15 syntactic categories. The legacy adjusted pattern signal is 3.9 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

3.9
Adjusted Signal
3.9
Raw Pattern Score
100%
Time Factor
2026-10-29
Last Push
5.9K
Stars
Rust
Language
80.7K
Lines of Code
560
Files
195
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 12.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 160 finding(s).

Hallucinated Dependency & Supply Chain Risk 4.9/100 · LOW

Are imports declared and package/API names verified? 26 finding(s).

Agent Over-Engineering Ratio 1.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 15 finding(s).

PR Review Velocity Impact 16.0/100 · LOW

Which changes need focused human review? 195 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 2MEDIUM 20LOW 169

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 195 distinct pattern matches across 15 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block122 hits · 122 pts
SeverityFileLineSnippetContext
LOWdeny.toml1# This template contains all of the possible sections and their default valuesCOMMENT
LOWdeny.toml21# `target_family = "unix"` configuration, that only having windows targets inCOMMENT
LOWdeny.toml41# from the view of cargo-deny. This is an extremely heavy hammer, as if a crateCOMMENT
LOWdeny.toml61# option can be used to specify the depth at which feature edges will be added.COMMENT
LOWdeny.toml81 # zip >=9 fixes these, but xwin 0.10.0 still requires zip ^8.COMMENT
LOWdeny.toml141# licensing informationCOMMENT
LOWdeny.toml161[licenses.private]COMMENT
LOWdeny.toml181wildcards = "allow"COMMENT
LOWdeny.toml201# List of crates to denyCOMMENT
LOWdeny.toml221# "__tls",COMMENT
LOWdeny.toml241# by default infinite.COMMENT
LOWguide/src/config.md21# Features can also be conditional on the target Python versionCOMMENT
LOWguide/src/config.md61# Bindings typeCOMMENT
LOWguide/src/config.md81sdist-generator = "cargo"COMMENT
LOWtests/common/mod.rs101pub fn case_target_dir(case_id: &str) -> PathBuf {COMMENT
LOWtests/common/integration.rs21///COMMENT
LOWsrc/cargo_options.rs81COMMENT
LOWsrc/cross_compile.rs101/// Finds the `_sysconfigdata*.py` file in the library path.COMMENT
LOWsrc/cross_compile.rs121///COMMENT
LOWsrc/build_options.rs21 /// Find interpreters from the host machineCOMMENT
LOWsrc/build_options.rs41 /// The `pypi` option applies on all platforms and ensure that only tags that can be uploaded toCOMMENT
LOWsrc/build_options.rs61 #[arg(long, conflicts_with = "skip_auditwheel")]COMMENT
LOWsrc/build_options.rs81#[derive(Debug, Default, Serialize, Deserialize, clap::Parser, Clone, Eq, PartialEq)]COMMENT
LOWsrc/build_options.rs101/// High level API for building wheels from a crate, also used for the CLI.COMMENT
LOWsrc/metadata.rs21/// The metadata required to generate the .dist-info directoryCOMMENT
LOWsrc/metadata.rs841 }COMMENT
LOWsrc/lib.rs1//! Builds wheels from a crate that exposes python bindings through pyo3COMMENT
LOWsrc/lib.rs21//! - auditwheel: Enables dependency auditing and wheel repair for macOS (install-name/rpathCOMMENT
LOWsrc/upload.rs21use std::time::Duration;COMMENT
LOWsrc/upload.rs41 ///COMMENT
LOWsrc/upload.rs81 }COMMENT
LOWsrc/project_layout.rs21 /// Contains the canonicalized (i.e. absolute) path to the python part of the projectCOMMENT
LOWsrc/project_layout.rs301 format!(COMMENT
LOWsrc/pyproject_toml.rs21 pub maturin: Option<ToolMaturin>,COMMENT
LOWsrc/pyproject_toml.rs61#[cfg_attr(feature = "schemars", derive(schemars::JsonSchema))]COMMENT
LOWsrc/pyproject_toml.rs141 }COMMENT
LOWsrc/pyproject_toml.rs161pub enum CargoCrateType {COMMENT
LOWsrc/pyproject_toml.rs201 #[serde(alias = "macosx-deployment-target")]COMMENT
LOWsrc/pyproject_toml.rs221pub struct SbomConfig {COMMENT
LOWsrc/pyproject_toml.rs241/// [tool.maturin]COMMENT
LOWsrc/pyproject_toml.rs341///COMMENT
LOWsrc/pyproject_toml.rs361 /// Include files matching the given glob pattern(s).COMMENT
LOWsrc/pyproject_toml.rs381 pub strip: bool,COMMENT
LOWsrc/pyproject_toml.rs401 /// List of features to activate.COMMENT
LOWsrc/pyproject_toml.rs421 /// Use base Python executable instead of venv Python executable in PEP 517 build.COMMENT
LOWsrc/pyproject_toml.rs441 pub generate_ci: Option<GenerateCIConfig>,COMMENT
LOWsrc/pyproject_toml.rs481 /// Android platform configurationCOMMENT
LOWsrc/pyproject_toml.rs501 /// Rustup components to installCOMMENT
LOWsrc/pyproject_toml.rs521}COMMENT
LOWsrc/pyproject_toml.rs541 /// Project metadataCOMMENT
LOWsrc/main.rs41struct Opt {COMMENT
LOWsrc/main.rs61 #[command(name = "build", alias = "b")]COMMENT
LOWsrc/main.rs81 /// Can also be enabled via the MATURIN_PGO environment variable.COMMENT
LOWsrc/main.rs101 ///COMMENT
LOWsrc/main.rs121 /// Build only a source distribution (sdist) without compiling.COMMENT
LOWsrc/main.rs141 path: Option<String>,COMMENT
LOWsrc/main.rs161 #[cfg(feature = "upload")]COMMENT
LOWsrc/main.rs181 cargo: CargoOptions,COMMENT
LOWsrc/compile.rs61 /// Library search paths for this architectureCOMMENT
LOWsrc/compile.rs81#[derive(Debug, Clone)]COMMENT
62 more matches not shown…
Modern AI Meta-Vocabulary18 hits · 68 pts
SeverityFileLineSnippetContext
MEDIUMCargo.toml113# project scaffolding, maturin new/init/generate-ciCOMMENT
MEDIUMCargo.toml214# project scaffoldingCOMMENT
MEDIUMtests/cli.rs18 #[cfg(not(feature = "scaffolding"))]COMMENT
MEDIUMtests/cli.rs25 #[cfg(not(all(feature = "upload", feature = "zig", feature = "scaffolding")))]COMMENT
MEDIUMsrc/lib.rs64#[cfg(feature = "scaffolding")]COMMENT
MEDIUMsrc/lib.rs84#[cfg(feature = "scaffolding")]COMMENT
MEDIUMsrc/lib.rs94#[cfg(feature = "scaffolding")]COMMENT
MEDIUMsrc/main.rs18#[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/main.rs137 #[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/main.rs146 #[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/main.rs154 #[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/main.rs266 #[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/main.rs268 #[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/main.rs270 #[cfg(feature = "scaffolding")]COMMENT
MEDIUMsrc/commands/mod.rs9#[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/commands/mod.rs66#[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/commands/mod.rs73#[cfg(feature = "scaffolding")]COMMENT
MEDIUM⚡src/commands/mod.rs80#[cfg(feature = "scaffolding")]COMMENT
Hallucination Indicators4 hits · 55 pts
SeverityFileLineSnippetContext
CRITICALsrc/build_orchestrator.rs472 self.context.project.project_layout.data.as_deref(),CODE
CRITICAL⚡src/build_orchestrator.rs776 if !self.context.project.metadata24.scripts.is_empty() {CODE
CRITICAL⚡src/build_orchestrator.rs782 if !self.context.project.metadata24.entry_points.is_empty() {CODE
CRITICAL⚡src/build_orchestrator.rs786 if self.context.project.project_layout.python_module.is_some() {CODE
Unused Imports21 hits · 21 pts
SeverityFileLineSnippetContext
LOWmaturin/bootstrap.py12CODE
LOWmaturin/bootstrap.py19CODE
LOWmaturin/__init__.py11CODE
LOWmaturin/__main__.py1CODE
LOW…licit/python/cffi_mixed_implicit/some_rust/__init__.py1CODE
LOW…licit/python/cffi_mixed_implicit/some_rust/__init__.py1CODE
LOW…ixed-py-subdir/python/cffi_mixed_py_subdir/__init__.py1CODE
LOW…ixed-py-subdir/python/cffi_mixed_py_subdir/__init__.py1CODE
LOWtest-crates/uniffi-mixed/uniffi_mixed/__init__.py1CODE
LOWtest-crates/cffi-mixed/cffi_mixed/__init__.py1CODE
LOWtest-crates/cffi-mixed/cffi_mixed/__init__.py1CODE
LOWtest-crates/cffi-mixed/cffi_mixed/__init__.py2CODE
LOW…xed-with-path-dep/cffi_mixed_with_path_dep/__init__.py1CODE
LOW…xed-with-path-dep/cffi_mixed_with_path_dep/__init__.py1CODE
LOW…t-crates/cffi-mixed-src/src/cffi_mixed_src/__init__.py1CODE
LOW…t-crates/cffi-mixed-src/src/cffi_mixed_src/__init__.py1CODE
LOWtest-crates/pyo3-mixed/pyo3_mixed/__init__.py1CODE
LOW…/cffi-mixed-submodule/cffi_mixed_submodule/__init__.py1CODE
LOW…submodule/cffi_mixed_submodule/rust_module/__init__.py1CODE
LOW…include-exclude/cffi_mixed_include_exclude/__init__.py1CODE
LOW…include-exclude/cffi_mixed_include_exclude/__init__.py1CODE
Modern Structural Boilerplate8 hits · 8 pts
SeverityFileLineSnippetContext
LOW…licit/python/cffi_mixed_implicit/some_rust/__init__.py3__all__ = ["ffi", "lib"]CODE
LOW…ixed-py-subdir/python/cffi_mixed_py_subdir/__init__.py3__all__ = ["ffi", "lib"]CODE
LOWtest-crates/cffi-mixed/cffi_mixed/__init__.py4__all__ = ["Line", "ffi", "lib"]CODE
LOW…xed-with-path-dep/cffi_mixed_with_path_dep/__init__.py3__all__ = ["ffi", "lib"]CODE
LOW…t-crates/cffi-mixed-src/src/cffi_mixed_src/__init__.py3__all__ = ["ffi", "lib"]CODE
LOW…/cffi-mixed-submodule/cffi_mixed_submodule/__init__.py3__all__ = ["rust"]CODE
LOW…submodule/cffi_mixed_submodule/rust_module/__init__.py3__all__ = ["rust"]CODE
LOW…include-exclude/cffi_mixed_include_exclude/__init__.py3__all__ = ["ffi", "lib"]CODE
Hyper-Verbose Identifiers6 hits · 6 pts
SeverityFileLineSnippetContext
LOWnoxfile.py93def _resolve_pyodide_platform_inputs(info: dict) -> dict:CODE
LOWmaturin/bootstrap.py22def get_requires_for_build_wheel(config_settings: dict[str, Any] | None = None) -> list[str]:CODE
LOWmaturin/bootstrap.py28def get_requires_for_build_sdist(config_settings: dict[str, Any] | None = None) -> list[str]:CODE
LOWmaturin/__init__.py165def get_requires_for_build_wheel(config_settings: Mapping[str, Any] | None = None) -> list[str]:CODE
LOWmaturin/__init__.py189def get_requires_for_build_sdist(config_settings: Mapping[str, Any] | None = None) -> list[str]:CODE
LOWmaturin/__init__.py197def prepare_metadata_for_build_wheel(metadata_directory: str, config_settings: Mapping[str, Any] | None = None) -> str:CODE
Verbosity Indicators4 hits · 6 pts
SeverityFileLineSnippetContext
LOWtests/common/other.rs877 // Step 1: Build the sdistCOMMENT
LOWtests/common/other.rs901 // Step 2: Unpack sdist and build wheels from itCOMMENT
LOWsrc/python_interpreter/resolver.rs254 // Step 1: PYO3_CONFIG_FILE is an explicit override that trumps everythingCOMMENT
LOWsrc/python_interpreter/resolver.rs269 // Step 2: Discover candidates (unified for native/cross)COMMENT
Structural Annotation Overuse4 hits · 6 pts
SeverityFileLineSnippetContext
LOWtests/common/other.rs877 // Step 1: Build the sdistCOMMENT
LOWtests/common/other.rs901 // Step 2: Unpack sdist and build wheels from itCOMMENT
LOWsrc/python_interpreter/resolver.rs254 // Step 1: PYO3_CONFIG_FILE is an explicit override that trumps everythingCOMMENT
LOWsrc/python_interpreter/resolver.rs269 // Step 2: Discover candidates (unified for native/cross)COMMENT
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHmaturin/__init__.py209except (FileNotFoundError, SubprocessError):CODE
Cross-Language Confusion1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHtest-crates/cffi-mixed/test_cffi_mixed.py24 assert line.length() == 5CODE
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/test.yml94 # minutes; the test harness falls back to micromamba when conda is absent.COMMENT
Overly Generic Function Names2 hits · 2 pts
SeverityFileLineSnippetContext
LOWtest-crates/pyo3-pure/tests/test_pyo3_pure.py15def test_function():CODE
LOWtest-crates/pyo3-abi3t/tests/test_pyo3_abi3t.py15def test_function():CODE
Self-Referential Comments1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMsrc/ci/github/render.rs147 "# This file is autogenerated by maturin v{version}CODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOW.github/workflows/test.yml581 # Check if all needs were successful or skipped.COMMENT
Deep Nesting1 hit · 1 pts
SeverityFileLineSnippetContext
LOWnoxfile.py39CODE