Home / Universal-Commerce-Protocol / ucp
AI Slop Code RIsk Monitor

Universal-Commerce-Protocol/ucp

Specification and documentation for the Universal Commerce Protocol (UCP)

5.6 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for Universal-Commerce-Protocol/ucp, a Python project with 3,413 GitHub stars. SynthScan examined 62,512 lines of code across 272 source files, recording 191 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 5.6 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

5.6
Adjusted Signal
5.6
Raw Pattern Score
100%
Time Factor
2026-10-10
Last Push
3.4K
Stars
Python
Language
62.5K
Lines of Code
272
Files
191
Pattern Hits
2026-10-12
Scan Date
0.01
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 9.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 91 finding(s).

Hallucinated Dependency & Supply Chain Risk 2.9/100 · LOW

Are imports declared and package/API names verified? 37 finding(s).

Agent Over-Engineering Ratio 16.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 90 finding(s).

PR Review Velocity Impact 24.0/100 · LOW

Which changes need focused human review? 191 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 4MEDIUM 66LOW 121

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 191 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators53 hits · 168 pts
SeverityFileLineSnippetContext
MEDIUMmain.py1801 # ------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py120# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py122# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py144# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py146# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py189# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py191# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py294# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py296# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py435# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py437# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py508# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py510# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py533# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py535# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py642# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py644# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py710# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py712# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py815# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py817# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py846# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py848# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py1110# -----------------------------------------------------------COMMENT
MEDIUMscripts/validate_examples.py1112# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_check_links.py38# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_check_links.py40# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_check_links.py62# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_check_links.py64# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_check_links.py108# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_check_links.py110# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_check_links.py295# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_check_links.py297# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_validate_examples.py39# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_validate_examples.py41# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_validate_examples.py166# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_validate_examples.py168# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py67# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py69# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py235# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py237# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py316# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py318# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py446# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py448# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py695# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_validate_examples.py697# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_schema_tables.py25# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_schema_tables.py27# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_schema_tables.py79# -----------------------------------------------------------COMMENT
MEDIUM⚡scripts/test_schema_tables.py81# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_schema_tables.py168# -----------------------------------------------------------COMMENT
MEDIUMscripts/test_schema_tables.py170# -----------------------------------------------------------COMMENT
Fake / Example Data37 hits · 37 pts
SeverityFileLineSnippetContext
LOWsource/schemas/common/types/card_credential.json50 "Jane Doe"CODE
LOWsource/schemas/common/types/pan_credential.json40 "Jane Doe"CODE
LOW…rce/schemas/common/types/network_token_credential.json41 "Jane Doe"CODE
LOWsource/handlers/tokenization/openapi.json46 "name": "Jane Doe"CODE
LOWsource/handlers/tokenization/openapi.json66 "name": "Jane Doe"CODE
LOWsource/handlers/tokenization/openapi.json85 "name": "Jane Doe"CODE
LOWsource/handlers/tokenization/openapi.json201 "name": "Jane Doe"CODE
LOWsource/handlers/tokenization/openapi.json214 "name": "Jane Doe"CODE
LOWdocs/specification/shopping/playground.md573 "street_address": "123 Main Street",CODE
LOWdocs/specification/shopping/playground.md974 req.fulfillment.methods = [{ type: 'shipping', destinations: [{ id: "addr_1", street_address: "123 Main St",CODE
LOWdocs/specification/shopping/playground.md1001 destinations: [{ id: "addr_1", street_address: "123 Main St", address_locality: "Tech City", address_countryCODE
LOWdocs/specification/shopping/order/mcp.md172 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/order/index.md244 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/order/index.md258 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/order/rest.md145 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/mcp.md193 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/mcp.md283 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/mcp.md542 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/a2a.md388 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md407 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md517 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md613 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md716 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md806 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md918 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md1078 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/checkout/rest.md1236 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/extensions/fulfillment.md176 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/extensions/fulfillment.md283 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/extensions/fulfillment.md298 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/extensions/fulfillment.md336 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/extensions/fulfillment.md874 "street_address": "123 Main St",CODE
LOWdocs/specification/shopping/extensions/fulfillment.md946 "street_address": "123 Main St",CODE
LOWdocs/specification/payment/extensions/ap2-mandates.md386 "street_address": "123 Main St",CODE
LOWdocs/specification/overview/index.md1908 "street_address": "123 Main Street",CODE
LOWdocs/specification/lodging/booking/mcp.md670 "street_address": "123 Main St",CODE
LOWdocs/specification/lodging/booking/rest.md807 "street_address": "123 Main St",CODE
Hyper-Verbose Identifiers26 hits · 24 pts
SeverityFileLineSnippetContext
LOWhooks.py314def _root_pages_asset_link_rewrite(markdown, base_path):CODE
LOWmain.py69def _validate_common_namespace_exclusivity() -> None:CODE
LOWmain.py908 def _render_table_from_schema(CODE
LOWmain.py1520 def auto_generate_schema_reference(CODE
LOWscripts/validate_examples.py365def lower_ellipsis_to_sentinels(content: str) -> str:CODE
LOWscripts/validate_examples.py763def validate_payload_with_schema(CODE
LOWscripts/test_check_links.py152def test_off_site_links_are_skipped() -> None:CODE
LOWscripts/test_check_links.py166def test_on_site_links_resolve() -> None:CODE
LOWscripts/test_check_links.py180def test_on_site_failures_are_reported() -> None:CODE
LOWscripts/test_check_links.py194def test_raw_markdown_names_its_own_reason() -> None:CODE
LOWscripts/test_check_links.py211def test_exit_code_signals_failure() -> None:CODE
LOWscripts/test_check_links.py239def test_linkignore_suppresses_but_not_raw_markdown() -> None:CODE
LOWscripts/test_check_links.py269def test_docs_mode_spec_ignores_documentation_links() -> None:CODE
LOW⚡scripts/test_validate_examples.py171def test_parse_example_keeps_sentinels() -> None:CODE
LOWscripts/test_validate_examples.py185def test_strip_ellipsis_records_paths() -> None:CODE
LOWscripts/test_validate_examples.py201def test_string_ellipsis_in_array() -> None:CODE
LOWscripts/test_validate_examples.py212def test_array_ellipsis_paths_use_stripped_indices() -> None:CODE
LOWscripts/test_validate_examples.py425def test_missing_binary_says_how_to_install() -> None:CODE
LOWscripts/test_validate_examples.py531def test_process_block_integration() -> None:CODE
LOWscripts/test_validate_examples.py663def test_resolve_schema_cache_key() -> None:CODE
LOW⚡scripts/test_schema_tables.py84def test_ucp_ref_links_reference_section(macros: dict) -> None:CODE
LOWscripts/test_schema_tables.py97def test_bundled_ucp_def_links_reference_section(macros: dict) -> None:CODE
LOWscripts/test_schema_tables.py113def test_ucp_def_without_anchor_is_named(macros: dict) -> None:CODE
LOWscripts/test_schema_tables.py126def test_composed_field_links_referenced_type(macros: dict) -> None:CODE
LOWscripts/test_schema_tables.py139def test_bundled_composed_field_uses_shared_type(macros: dict) -> None:CODE
LOWscripts/test_schema_tables.py155def test_method_tables_name_ucp_field(macros: dict) -> None:CODE
Deep Nesting25 hits · 20 pts
SeverityFileLineSnippetContext
LOWhooks.py45CODE
LOWhooks.py146CODE
LOWhooks.py337CODE
LOWhooks.py175CODE
LOWmain.py69CODE
LOWmain.py124CODE
LOWmain.py215CODE
LOWmain.py271CODE
LOWmain.py400CODE
LOWmain.py491CODE
LOWmain.py682CODE
LOWmain.py836CODE
LOWmain.py908CODE
LOWmain.py1240CODE
LOWmain.py1520CODE
LOWmain.py1643CODE
LOWmain.py1701CODE
LOWmain.py1927CODE
LOWscripts/validate_examples.py194CODE
LOWscripts/validate_examples.py323CODE
LOWscripts/validate_examples.py395CODE
LOWscripts/validate_examples.py577CODE
LOWscripts/validate_examples.py1115CODE
LOWscripts/check_links.py72CODE
LOWscripts/super_linter_local.py34CODE
Structural Annotation Overuse11 hits · 19 pts
SeverityFileLineSnippetContext
LOW⚡hooks.py456 # Step 1: Resolve relative $ref to absolute URLsCOMMENT
LOW⚡hooks.py459 # Step 2: Inject versions for versioned entities and transport artifactsCOMMENT
LOW⚡hooks.py463 # Step 3: Rewrite URLs to include versionCOMMENT
LOWdocs/specification/payment/template.md245#### Step 1: Discover HandlerCOMMENT
LOWdocs/specification/payment/extensions/ap2-mandates.md275### Step 1: Checkout Creation & SigningCOMMENT
LOWdocs/specification/payment/extensions/ap2-mandates.md338### Step 2: User Consent & Mandate GenerationCOMMENT
LOWdocs/specification/payment/extensions/ap2-mandates.md365### Step 3: Submission (`complete_checkout`)COMMENT
LOW…ayment/examples/processor-tokenizer-payment-handler.md193#### Step 1: Discover HandlerCOMMENT
LOW…ayment/examples/processor-tokenizer-payment-handler.md221#### Step 2: Collect Sensitive DataCOMMENT
LOW…ayment/examples/processor-tokenizer-payment-handler.md227#### Step 3: Tokenize DataCOMMENT
LOW…ayment/examples/processor-tokenizer-payment-handler.md243### Step 4: Complete CheckoutCOMMENT
Modern AI Meta-Vocabulary8 hits · 18 pts
SeverityFileLineSnippetContext
MEDIUMdocs/specification/payment/extensions/ap2-mandates.md152> [AP2 #268](https://github.com/google-agentic-commerce/AP2/issues/268)CODE
MEDIUMdocs/specification/payment/extensions/ap2-mandates.md152> [AP2 #268](https://github.com/google-agentic-commerce/AP2/issues/268)CODE
MEDIUMscripts/validate_examples.py1032 # 8. Load scaffold and mergeCOMMENT
MEDIUMscripts/test_validate_examples.py505 # E2E: a fully-elided get_product response validates via the scaffoldCOMMENT
MEDIUMscripts/test_validate_examples.py596 # Complete examples validate without a scaffold. Scaffolds are only requiredCOMMENT
MEDIUMscripts/test_validate_examples.py613 # normal target/scaffold validation.COMMENT
MEDIUMscripts/scaffolds/shopping_order_response.json8 "permalink_url": "https://example.com/orders/scaffold",CODE
MEDIUMscripts/scaffolds/lodging_booking_response.json87 "continue_url": "https://example.com/booking-sessions/scaffold",CODE
AI Slop Vocabulary6 hits · 18 pts
SeverityFileLineSnippetContext
LOWmain.py475 # types directory, so we just pass the filenameCOMMENT
LOWmain.py1994 # If ref not resolved, just use nameCOMMENT
LOWmain.py596 else: # Internal ref like #/$defs/context: just use fragmentCODE
MEDIUM⚡scripts/test_check_links.py39# Test harness (minimal, no deps)COMMENT
MEDIUM⚡scripts/test_validate_examples.py40# Test harness (minimal, no deps)COMMENT
MEDIUM⚡scripts/test_schema_tables.py26# Test harness (minimal, no deps)COMMENT
Cross-File Repetition3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHscripts/test_check_links.py0run all tests and report. exit 0 on pass, 1 on failure.STRING
HIGHscripts/test_validate_examples.py0run all tests and report. exit 0 on pass, 1 on failure.STRING
HIGHscripts/test_schema_tables.py0run all tests and report. exit 0 on pass, 1 on failure.STRING
Over-Commented Block9 hits · 9 pts
SeverityFileLineSnippetContext
LOWhooks.py1# Copyright 2026 UCP AuthorsCOMMENT
LOWmkdocs.yml1---COMMENT
LOW.pre-commit-config.yaml21 # (.github/workflows/docs.yml).COMMENT
LOWmain.py1# Copyright 2026 UCP AuthorsCOMMENT
LOW.github/workflows/release-setup.yml1---COMMENT
LOW.github/workflows/linter.yaml1# Copyright 2026 Google LLCCOMMENT
LOW.github/workflows/docs.yml1---COMMENT
LOW.github/workflows/conventional-commits.yml1# Copyright 2026 Google LLCCOMMENT
LOW.github/workflows/spellcheck.yaml1# Copyright 2026 Google LLCCOMMENT
Excessive Try-Catch Wrapping6 hits · 8 pts
SeverityFileLineSnippetContext
LOWscripts/check_links.py92 except Exception as e:CODE
LOWscripts/check_links.py123 except Exception:CODE
LOWscripts/check_links.py140 except Exception:CODE
LOWscripts/check_links.py145 except Exception as e:CODE
MEDIUMscripts/super_linter_local.py60 print(f"Error: {workflow_path} not found.")CODE
MEDIUMscripts/super_linter_local.py78 print("Error: Could not find 'Lint Code Base' step in workflow.")CODE
Verbosity Indicators3 hits · 7 pts
SeverityFileLineSnippetContext
LOW⚡hooks.py456 # Step 1: Resolve relative $ref to absolute URLsCOMMENT
LOW⚡hooks.py459 # Step 2: Inject versions for versioned entities and transport artifactsCOMMENT
LOW⚡hooks.py463 # Step 3: Rewrite URLs to include versionCOMMENT
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHmain.py1099except (json.JSONDecodeError, OSError):CODE
Redundant / Tautological Comments2 hits · 3 pts
SeverityFileLineSnippetContext
LOWmain.py481 # Check if any property has ucp_request annotationCOMMENT
LOWmain.py549 # Check if this reference comes from the core UCP schemaCOMMENT
AI Structural Patterns1 hit · 1 pts
SeverityFileLineSnippetContext
LOWhooks.py326CODE