Home / alibaba / arthas
AI Slop Code RIsk Monitor

alibaba/arthas

Alibaba Java Diagnostic Tool Arthas/Alibaba Java诊断利器Arthas

7.7 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for alibaba/arthas, a Java project with 37,576 GitHub stars. SynthScan examined 195,748 lines of code across 1439 source files, recording 141 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 7.7 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

7.7
Adjusted Signal
7.7
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
37.6K
Stars
Java
Language
195.7K
Lines of Code
1.4K
Files
141
Pattern Hits
2026-10-12
Scan Date
0.08
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 0.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 31 finding(s).

Hallucinated Dependency & Supply Chain Risk 31.1/100 · MEDIUM

Are imports declared and package/API names verified? 109 finding(s).

Agent Over-Engineering Ratio 0.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 15 finding(s).

PR Review Velocity Impact 24.8/100 · LOW

Which changes need focused human review? 141 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 108HIGH 1MEDIUM 0LOW 32

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 141 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators108 hits · 1460 pts
SeverityFileLineSnippetContext
CRITICALREADME.md114 at com.taobao.arthas.core.command.handler.AbstractCommandHandler.execute(AbstractCommandHandler.java:238)CODE
CRITICALREADME.md115 at com.taobao.arthas.core.command.handler.DefaultCommandHandler.handleCommand(DefaultCommandHandler.java:67)CODE
CRITICAL⚡README.md271 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)CODE
CRITICAL⚡README.md272 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)CODE
CRITICAL⚡README.md273 at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)CODE
CRITICAL⚡README.md274 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)CODE
CRITICAL⚡README.md275 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)CODE
CRITICAL⚡README.md276 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)CODE
CRITICAL⚡README.md277 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)CODE
CRITICAL⚡README.md278 at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)CODE
CRITICAL⚡README.md279 at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)CODE
CRITICAL⚡README.md281 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)CODE
CRITICAL⚡README.md282 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)CODE
CRITICAL⚡README.md283 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)CODE
CRITICAL⚡README.md284 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:451)CODE
CRITICAL⚡README.md285 at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1121)CODE
CRITICALREADME_CN.md103 at com.taobao.arthas.core.command.handler.AbstractCommandHandler.execute(AbstractCommandHandler.java:238)CODE
CRITICALREADME_CN.md104 at com.taobao.arthas.core.command.handler.DefaultCommandHandler.handleCommand(DefaultCommandHandler.java:67)CODE
CRITICAL⚡README_CN.md256 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)CODE
CRITICAL⚡README_CN.md257 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)CODE
CRITICAL⚡README_CN.md258 at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)CODE
CRITICAL⚡README_CN.md259 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)CODE
CRITICAL⚡README_CN.md260 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)CODE
CRITICAL⚡README_CN.md261 at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)CODE
CRITICAL⚡README_CN.md262 at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)CODE
CRITICAL⚡README_CN.md263 at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)CODE
CRITICAL⚡README_CN.md264 at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)CODE
CRITICAL⚡README_CN.md266 at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)CODE
CRITICAL⚡README_CN.md267 at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)CODE
CRITICAL⚡README_CN.md268 at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)CODE
CRITICAL⚡README_CN.md269 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:451)CODE
CRITICAL⚡README_CN.md270 at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1121)CODE
CRITICAL…n/resources/native-agent/static/js/console-35a3b78f.js58}`)),this.register((0,c.toDisposable)(()=>v.deleteProgram(this._program))),this._projectionLocation=(0,o.throwIfFalsy)(vCODE
CRITICAL…aobao/arthas/grpcweb/grpc/service/advisor/SpyImpl.java35 List<AdviceListener> listeners = com.taobao.arthas.grpcweb.grpc.service.advisor.AdviceListenerManager.queryAdvicCODE
CRITICAL…aobao/arthas/grpcweb/grpc/service/advisor/SpyImpl.java60 List<AdviceListener> listeners = com.taobao.arthas.grpcweb.grpc.service.advisor.AdviceListenerManager.queryAdvicCODE
CRITICAL…aobao/arthas/grpcweb/grpc/service/advisor/SpyImpl.java84 List<AdviceListener> listeners = com.taobao.arthas.grpcweb.grpc.service.advisor.AdviceListenerManager.queryAdvicCODE
CRITICAL…aobao/arthas/grpcweb/grpc/service/advisor/SpyImpl.java108 List<AdviceListener> listeners = com.taobao.arthas.grpcweb.grpc.service.advisor.AdviceListenerManager.queryTraceCODE
CRITICAL…aobao/arthas/grpcweb/grpc/service/advisor/SpyImpl.java133 List<AdviceListener> listeners = com.taobao.arthas.grpcweb.grpc.service.advisor.AdviceListenerManager.queryTraceCODE
CRITICAL…aobao/arthas/grpcweb/grpc/service/advisor/SpyImpl.java160 List<AdviceListener> listeners = com.taobao.arthas.grpcweb.grpc.service.advisor.AdviceListenerManager.queryTraceCODE
CRITICAL…bao/arthas/core/advisor/AdviceListenerManagerTest.java27 Assertions.assertThatCode(new org.assertj.core.api.ThrowableAssert.ThrowingCallable() {CODE
CRITICAL…bao/arthas/core/advisor/AdviceListenerManagerTest.java58 Assertions.assertThatCode(new org.assertj.core.api.ThrowableAssert.ThrowingCallable() {CODE
CRITICAL⚡…/main/java/com/taobao/arthas/core/util/ThreadUtil.java370 * com.taobao.arthas.core.util.ThreadUtil.getThreadStack(ThreadUtil.java:349),COMMENT
CRITICAL⚡…/main/java/com/taobao/arthas/core/util/ThreadUtil.java371 * com.taobao.arthas.core.command.monitor200.StackAdviceListener.before(StackAdviceListener.java:33),COMMENT
CRITICAL⚡…/main/java/com/taobao/arthas/core/util/ThreadUtil.java372 * com.taobao.arthas.core.advisor.AdviceListenerAdapter.before(AdviceListenerAdapter.java:49),COMMENT
CRITICAL⚡…/main/java/com/taobao/arthas/core/util/ThreadUtil.java373 * com.taobao.arthas.core.advisor.SpyImpl.atEnter(SpyImpl.java:42),COMMENT
CRITICAL…c/main/java/com/taobao/arthas/core/util/FileUtils.java212 com.taobao.arthas.common.IOUtils.close(in);CODE
CRITICAL…ain/java/com/taobao/arthas/core/util/ArthasBanner.java143 version[0] = com.taobao.arthas.common.IOUtils.toString(inputStream).trim();CODE
CRITICAL…/main/java/com/taobao/arthas/core/util/Decompiler.java76 * @see org.benf.cfr.reader.util.MiscConstants.Version.getVersion() Currently,COMMENT
CRITICAL⚡…bao/arthas/core/shell/term/impl/CompletionAdaptor.java58 completion.complete(io.termd.core.util.Helper.toCodePoints(strToComplete), false);CODE
CRITICAL⚡…bao/arthas/core/shell/term/impl/CompletionAdaptor.java67 suggestions.add(io.termd.core.util.Helper.toCodePoints(candidate));CODE
CRITICAL⚡…bao/arthas/core/shell/term/impl/CompletionAdaptor.java77 completion.complete(io.termd.core.util.Helper.toCodePoints(value), terminal);CODE
CRITICAL…a/com/taobao/arthas/core/shell/term/impl/TermImpl.java48 this(com.taobao.arthas.core.shell.term.impl.Helper.loadKeymap(), conn);CODE
CRITICAL…bao/arthas/core/shell/term/impl/CompletionHandler.java32 final String line = io.termd.core.util.Helper.fromCodePoints(completion.line());CODE
CRITICAL…/com/taobao/arthas/core/shell/cli/CompletionUtils.java37 return Helper.fromCodePoints(io.termd.core.readline.Completion.findLongestCommonPrefix(entries));CODE
CRITICAL…n/java/com/taobao/arthas/core/mcp/ArthasMcpServer.java108 com.taobao.arthas.core.mcp.util.McpObjectVOFilter.register();CODE
CRITICAL…core/command/klass100/ClassLoaderMetaspaceCommand.java47@com.taobao.middleware.cli.annotations.Name("classloader-metaspace")CODE
CRITICAL⚡site/docs/doc/thread.md48 at com.taobao.arthas.core.command.monitor200.ThreadCommand.processTopBusyThreads(ThreadCommand.java:199)CODE
CRITICAL⚡site/docs/doc/thread.md49 at com.taobao.arthas.core.command.monitor200.ThreadCommand.process(ThreadCommand.java:122)CODE
CRITICAL⚡site/docs/doc/thread.md50 at com.taobao.arthas.core.shell.command.impl.AnnotatedCommandImpl.process(AnnotatedCommandImpl.java:82)CODE
CRITICAL⚡site/docs/doc/thread.md111 at java.util.concurrent.locks.LockSupport.park(LockSupport.java:175)CODE
48 more matches not shown…
Hyper-Verbose Identifiers14 hits · 14 pts
SeverityFileLineSnippetContext
LOW…a/arthas/nat/agent/server/http/HttpRequestHandler.java16public class HttpRequestHandler extends SimpleChannelInboundHandler<FullHttpRequest> {CODE
LOW…ent/management/web/server/http/HttpRequestHandler.java18public class HttpRequestHandler extends SimpleChannelInboundHandler<FullHttpRequest> {CODE
LOW…has/nat/agent/proxy/server/handler/RequestHandler.java17public class RequestHandler extends SimpleChannelInboundHandler<Object> {CODE
LOW…gent/proxy/server/handler/http/HttpRequestHandler.java15public class HttpRequestHandler {CODE
LOW…at/agent/proxy/server/handler/ws/WsRequestHandler.java29public class WsRequestHandler {CODE
LOW…nat/agent/common/handler/HttpOptionRequestHandler.java12public class HttpOptionRequestHandler {CODE
LOW…taobao/arthas/grpcweb/proxy/GrpcWebRequestHandler.java38public class GrpcWebRequestHandler {CODE
LOW…thas/core/shell/term/impl/http/HttpRequestHandler.java32public class HttpRequestHandler extends SimpleChannelInboundHandler<FullHttpRequest> {CODE
LOW…ao/arthas/core/shell/handlers/term/RequestHandler.java10public class RequestHandler implements Consumer<String> {CODE
LOW…col/server/handler/McpStatelessHttpRequestHandler.java34public class McpStatelessHttpRequestHandler {CODE
LOW…ol/server/handler/McpStreamableHttpRequestHandler.java46public class McpStreamableHttpRequestHandler {CODE
LOW…ver/protocol/server/handler/McpHttpRequestHandler.java25public class McpHttpRequestHandler {CODE
LOW…ion-test/telnet-stop-leak/run_telnet_stop_leak_test.py81def parse_arthas_classloader_instances(jmap_histo_output: str) -> Tuple[int, Optional[str]]:CODE
LOW…ion-test/telnet-stop-leak/run_telnet_stop_leak_test.py111def wait_for_telnet_port_from_arthas_log(arthas_log: Path, start_offset: int, timeout_seconds: int) -> int:CODE
Over-Commented Block12 hits · 12 pts
SeverityFileLineSnippetContext
LOW…/taobao/arthas/grpc/server/handler/GrpcDispatcher.java81 MethodHandle requestToByteArray = lookup.findVirtual(requestClass, "toByteArray", MethodTypeCOMMENT
LOW…o/arthas/grpcweb/grpc/view/GrpcResultViewResolver.java41// registerView(CatView.class);COMMENT
LOW…o/arthas/grpcweb/grpc/view/GrpcResultViewResolver.java61// registerView(SearchClassView.class);COMMENT
LOW…va/com/taobao/arthas/core/util/reflect/FieldUtils.java301 public static Field getField(final Class<?> cls, final String fieldName, final boolean forceAccess) {COMMENT
LOW…ava/com/taobao/arthas/core/shell/term/impl/Helper.java61// URL resource = HttpTermServer.class.getResource(path);COMMENT
LOW…m/taobao/arthas/core/command/logger/AsmRenameUtil.java21 final String internalNewName = newName.replace('.', '/');COMMENT
LOWbin/as.sh1#!/usr/bin/env bashCOMMENT
LOWbin/as.sh21# is printed.COMMENT
LOW…rthasWebConsole/all/ui/ui/src/views/sync/ClassInfo.vue101 if (k === "classloader") res += JSON.stringify(v)COMMENT
LOWarthas-vmtool/src/main/native/src/heap_analyzer.c21#define HEAP_TAG_RUN_SHIFT 32COMMENT
LOW.github/workflows/codeql-analysis.yml1# For most projects, this workflow file will not need changing; you simply needCOMMENT
LOW.github/workflows/codeql-analysis.yml41 - name: Initialize CodeQLCOMMENT
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGH…ion-test/telnet-stop-leak/run_telnet_stop_leak_test.py269except PermissionError:CODE
Structural Annotation Overuse3 hits · 4 pts
SeverityFileLineSnippetContext
LOWsite/docs/en/doc/batch-support.md8### Step 1: Create the scriptCOMMENT
LOWsite/docs/en/doc/batch-support.md28### Step 2: Run the scriptCOMMENT
LOWsite/docs/en/doc/batch-support.md42### Step 3: Check the outputCOMMENT
AI Slop Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
LOWbin/as.sh964 # if ps do not support -p or -o , ${pid} will be error message, just returnCOMMENT
Fake / Example Data1 hit · 1 pts
SeverityFileLineSnippetContext
LOW…/taobao/arthas/core/util/matcher/RegexMatcherTest.java65 Assert.assertTrue(new RegexMatcher(emailAddressPattern).matching("foo@bar.com"));CODE
Deep Nesting1 hit · 1 pts
SeverityFileLineSnippetContext
LOW…ion-test/telnet-stop-leak/run_telnet_stop_leak_test.py139CODE