Minimal Coding Agent Harness on MCP for ChatGPT, Claude, Hermes, Grok Bot, OpenClaw
This report summarizes scanner evidence for Waishnav/devspace, a TypeScript project with 5,339 GitHub stars. SynthScan examined 82,075 lines of code across 304 source files, recording 165 pattern matches distributed across 3 syntactic categories. The legacy adjusted pattern signal is 2.0 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 165 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 163 finding(s).
Which changes need focused human review? 165 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 165 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/oxlint/anti-slop/shared/function-parameters.ts | 13 | export function functionParameterTypeAnnotation( | CODE |
| LOW | tools/oxlint/anti-slop/shared/function-parameters.ts | 29 | export function functionParameterBindingName( | CODE |
| LOW | tools/oxlint/anti-slop/shared/reflect-method.ts | 13 | export function isGlobalReflectMethodCall( | CODE |
| LOW | tools/oxlint/anti-slop/shared/dictionary-types.ts | 128 | function isEffectivelyEmptyTypeLiteral(type: ESTree.TSTypeLiteral): boolean { | CODE |
| LOW | tools/oxlint/anti-slop/shared/dictionary-types.ts | 132 | function isEffectivelyEmptyInterface( | CODE |
| LOW | tools/oxlint/anti-slop/shared/dictionary-types.ts | 144 | function resolvedSubstitutionArgument( | CODE |
| LOW | tools/oxlint/anti-slop/shared/dictionary-types.ts | 296 | export function classifyUnsafeDictionaryValue( | CODE |
| LOW | tools/oxlint/anti-slop/shared/dictionary-types.ts | 480 | export function isPopulatedObjectExpression(expression: ESTree.Expression): boolean { | CODE |
| LOW | tools/oxlint/anti-slop/shared/dictionary-types.ts | 493 | export function isKnownEvidenceExpression(expression: ESTree.Expression): boolean { | CODE |
| LOW | tools/oxlint/anti-slop/shared/type-alias-resolution.ts | 117 | export function createTypeAliasEnvironment( | CODE |
| LOW | …ols/oxlint/anti-slop/shared/lexical-type-parameters.ts | 14 | function collectInferTypeParameterNames( | CODE |
| LOW | …ols/oxlint/anti-slop/shared/lexical-type-parameters.ts | 35 | export function lexicalTypeParameterNames( | CODE |
| LOW | tools/oxlint/anti-slop/rules/no-widen-then-assert.ts | 18 | function unwrapExpressionParentheses(expression: ESTree.Expression): ESTree.Expression { | CODE |
| LOW | tools/oxlint/anti-slop/rules/no-widen-then-assert.ts | 143 | function isDefinitelyNarrowerRecordType(type: ESTree.TSType): boolean { | CODE |
| LOW | tools/oxlint/anti-slop/rules/no-widen-then-assert.ts | 171 | function resolvedVariableForIdentifier( | CODE |
| LOW | …s/oxlint/anti-slop/rules/no-chained-type-assertions.ts | 6 | function isTypeAssertionExpression(node: ESTree.Node): node is TypeAssertionExpression { | CODE |
| LOW | …s/oxlint/anti-slop/rules/no-chained-type-assertions.ts | 10 | function unwrapParenthesizedExpression(expression: ESTree.Expression): ESTree.Expression { | CODE |
| LOW | …s/oxlint/anti-slop/rules/no-chained-type-assertions.ts | 27 | function isOutermostAssertionInChain(node: TypeAssertionExpression): boolean { | CODE |
| LOW | …s/oxlint/anti-slop/rules/no-chained-type-assertions.ts | 39 | function isForbiddenAssertionChain(node: TypeAssertionExpression): boolean { | CODE |
| LOW | tools/oxlint/anti-slop/rules/no-known-value-widening.ts | 138 | function hasKnownCallArgumentEvidence( | CODE |
| LOW | tools/oxlint/anti-slop/rules/no-known-value-widening.ts | 192 | function typePredicateSubjectIndex( | CODE |
| LOW | tools/oxlint/anti-slop/rules/no-known-value-widening.ts | 253 | function isDictionaryAccumulatorTarget(destination: WideningTarget): boolean { | CODE |
| LOW | …/anti-slop/rules/no-conditional-empty-object-spread.ts | 16 | function isConditionalEmptyObjectSpread(node: ESTree.Expression): boolean { | CODE |
| LOW | …ls/oxlint/anti-slop/rules/no-unsafe-dictionary-type.ts | 61 | function isInsideTypeAliasDeclaration(node: ESTree.Node): boolean { | CODE |
| LOW | …ls/oxlint/anti-slop/rules/no-unsafe-dictionary-type.ts | 80 | function isInsideTypeParameterConstraint(node: ESTree.TSType): boolean { | CODE |
| LOW | …lop/rules/require-safety-comment-for-type-assertion.ts | 47 | function hasSafetyJustificationBefore( | CODE |
| LOW | …ols/oxlint/anti-slop/rules/no-shape-in-symbol-names.ts | 6 | function containsForbiddenSymbolName(name: string): boolean { | CODE |
| LOW | test/package-install-smoke.test.ts | 16 | function testPackedPackageLaunchers(): void { | CODE |
| LOW | src/workspaces.ts | 739 | function unavailableWorkspaceError(workspaceId: string): Error { | CODE |
| LOW | src/workspaces.ts | 745 | export async function ensureCheckoutWorkspaceRoot( | CODE |
| LOW | src/local-agent-pi-sandbox.ts | 73 | export function createUserNamespaceDenialDetector() { | CODE |
| LOW | src/local-agent-pi-sandbox.ts | 349 | function createSandboxedBashOperations(workspace: string): BashOperations { | CODE |
| LOW | src/local-agent-pi-sandbox.ts | 545 | function createPiSandboxFilesystem(workspace: string): FilesystemConfig { | CODE |
| LOW | src/local-agent-grok.ts | 140 | export function parseGrokPromptCompletion(input: WireInput): GrokPromptCompletion | undefined { | CODE |
| LOW | src/roots.ts | 55 | export async function resolveCanonicalAllowedPath( | CODE |
| LOW | src/roots.ts | 79 | export async function resolvePathInsideCanonicalRoot( | CODE |
| LOW | src/local-agent-presentation.ts | 85 | export function presentAgentTargetCatalog(catalog: LocalAgentCatalog): AgentTargetCatalogOutput { | CODE |
| LOW | src/incoming-artifacts.ts | 21 | function hasAsciiControlCharacters(value: string): boolean { | CODE |
| LOW | src/incoming-artifacts.ts | 156 | export function createOpenAIIncomingArtifactAdapter( | CODE |
| LOW | src/incoming-artifacts.ts | 256 | export function describeIncomingArtifactValue( | CODE |
| LOW | src/incoming-artifacts.ts | 341 | function validateIncomingArtifactSource(source: IncomingArtifactSource): void { | CODE |
| LOW | src/incoming-artifacts.ts | 384 | function isOpenAIFileReferenceCandidate(value: WireInput): value is JsonObject { | CODE |
| LOW | src/incoming-artifacts.ts | 394 | function normalizeOpenAIFileReference(value: WireInput): OpenAIFileReference { | CODE |
| LOW | src/incoming-artifacts.ts | 490 | function normalizeSuppliedOpenAIFileName(value: string | undefined): string | undefined { | CODE |
| LOW | src/review-checkpoints.ts | 62 | export function createReviewCheckpointManager(): ReviewCheckpointManager { | CODE |
| LOW | src/review-checkpoints.ts | 320 | async function createWorkingTreeSnapshot(gitRoot: string, parent?: string): Promise<string> { | CODE |
| LOW | src/review-checkpoints.ts | 387 | async function resolveReviewCommitOrUndefined( | CODE |
| LOW | src/worktree-prune.ts | 14 | export async function pruneStaleManagedWorktrees( | CODE |
| LOW | src/local-agent-opencode.ts | 327 | function isOpenCodeTransportFailure(error: WireInput): boolean { | CODE |
| LOW | src/local-agent-opencode.ts | 404 | function assertOpenCodePromptSucceeded(value: WireInput): void { | CODE |
| LOW | src/local-agent-opencode.ts | 430 | export function extractOpenCodeFinalResponse(value: WireInput): string { | CODE |
| LOW | src/local-agent-opencode.ts | 439 | function extractLastOpenCodeAssistantMessageText(messages: WireInput[]): string { | CODE |
| LOW | src/local-agent-opencode.ts | 457 | function extractOpenCodeAssistantMessageText(value: WireInput): string { | CODE |
| LOW | src/local-agent-opencode.ts | 484 | function stringifyStructuredMessage(value: WireInput): string { | CODE |
| LOW | src/user-config.ts | 67 | export function devspaceLegacyConfigBackupPath(env: NodeJS.ProcessEnv = process.env): string { | CODE |
| LOW | src/local-agent-opencode-v2.ts | 409 | function isOpenCodeTransportFailure(error: WireInput): boolean { | CODE |
| LOW | src/local-agent-availability.ts | 25 | export function getLocalAgentProviderAvailabilitySnapshot( | CODE |
| LOW | src/local-agent-availability.ts | 45 | function checkLocalAgentProviderAvailability( | CODE |
| LOW | src/local-agent-availability.ts | 99 | export function localAgentProviderAvailability( | CODE |
| LOW | src/artifact-destination-windows.ts | 13 | export async function prepareWindowsArtifactDestinationDirectory( | CODE |
| 103 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | website/package-lock.json | 10075 | "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.3.tgz", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | install/install.sh | 1 | #!/bin/sh | COMMENT |