Enterprise AI Platform with guardrails, MCP registry, gateway & orchestrator
This report presents the forensic synthetic code analysis of archestra-ai/archestra, a TypeScript project with 3,968 GitHub stars. SynthScan v2.0 examined 1,046,780 lines of code across 3741 source files, recording 2234 pattern matches distributed across 21 syntactic categories. The overall adjusted score of 2.5 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 2234 distinct pattern matches across 21 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | migration-kit/tests/test_contracts.py | 39 | def test_parse_item_rejects_unknown_kind() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 44 | def test_parse_item_rejects_missing_required_field() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 49 | def test_parse_bundled_file_rejects_bad_encoding() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 54 | def test_parse_plan_roundtrips_and_validates() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 64 | def test_parse_plan_rejects_bad_enums() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 74 | def test_parse_bundled_file_allows_empty_content() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 88 | def test_parse_bundled_file_still_requires_string_content() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 93 | def test_non_migrate_decision_may_omit_target_kind() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 102 | def test_migrate_decision_requires_target_kind() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 107 | def test_user_answer_validators_reject_bad_values() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 116 | def test_user_answer_validators_accept_good_values() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 123 | def test_archestra_hook_event_maps_supported_events_only() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 131 | def test_archestra_file_name_validates_basename_and_extension() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 139 | def test_validate_requirements_trims_and_bounds() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 152 | def test_require_requirements_is_none_when_absent() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 157 | def test_optional_agent_id_requires_uuid_shape() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 165 | def test_optional_file_name_validates_when_present() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 172 | def test_require_hook_content_enforces_length() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 180 | def test_require_dict_and_list_raise_on_wrong_shape() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_contracts.py | 187 | def test_secret_key_regex_matches_real_keys_not_innocent_words() -> None: | CODE |
| LOW | migration-kit/tests/test_contracts.py | 13 | def test_inventory_roundtrips_through_json() -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 59 | def test_finds_claude_md_as_primary(inv: Inventory) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 65 | def test_subagent_carries_tool_allowlist(inv: Inventory) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 71 | def test_skill_bundles_sibling_files(inv: Inventory) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 130 | def test_inline_hook_has_no_bundled_script(inv: Inventory) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 138 | def test_env_prefix_hook_is_flagged_in_summary(inv: Inventory) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 146 | def test_unsupported_event_hook_noted_for_manual(inv: Inventory) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 152 | def test_unresolved_hook_when_script_missing(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 228 | def test_script_position_only_matches_executable_or_interpreter_arg(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 235 | def test_script_path_in_echo_argument_is_inline_not_bundled(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 240 | def test_interpreter_flags_before_script_count_as_extra_args(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 353 | def test_dangling_refs_flags_only_existing_unbundled_files(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 361 | def test_dangling_refs_skips_bundled_files(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_discover.py | 369 | def test_dangling_refs_resolves_against_multiple_bases(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 32 | def test_redact_value_catches_embedded_token() -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 39 | def test_redact_catches_embedded_token_under_innocuous_key() -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 83 | def test_local_tool_bundles_script(inv: Inventory) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 91 | def test_mcp_stdio_and_remote(inv: Inventory) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 102 | def test_mcp_secret_env_is_redacted(inv: Inventory) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 167 | def test_same_hook_slot_in_two_config_files_gets_distinct_ids(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 178 | def test_empty_or_env_only_command_is_unresolved(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 193 | def test_bundled_hook_resolves_with_relative_root(monkeypatch: pytest.MonkeyPatch) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 251 | def test_bundled_script_through_symlinked_root_alias_does_not_crash(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 272 | def test_inline_env_prefix_is_not_flagged(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 286 | def test_hook_command_inline_secret_redacted(inv: Inventory) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 293 | def test_body_secret_warned_but_left_intact(inv: Inventory) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 308 | def test_no_structured_secret_leaks_in_serialized_inventory(inv: Inventory) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 315 | def test_symlink_escaping_source_is_not_bundled(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 332 | def test_symlinked_skill_dir_is_skipped(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 382 | def test_dangling_refs_ignores_root_escaping_ref(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 387 | def test_discover_warns_on_dangling_command_reference(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 399 | def test_discover_flags_ref_captured_as_separate_item(tmp_path: Path) -> None: | CODE |
| LOW | migration-kit/tests/test_discover.py | 413 | def test_fixture_skill_flags_repo_root_tool_reference(inv: Inventory) -> None: | CODE |
| LOW | migration-kit/tests/test_installer.py | 18 | def test_writes_allowlist_as_siblings(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_installer.py | 37 | def test_unsafe_paths_are_rejected(tmp_path: Path, rel: str) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_installer.py | 42 | def test_path_outside_allowlist_is_rejected(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_installer.py | 47 | def test_destination_symlink_is_rejected(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_installer.py | 56 | def test_file_destination_is_rejected(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_installer.py | 63 | def test_nonempty_destination_requires_force(tmp_path: Path) -> None: | CODE |
| LOW⚡ | migration-kit/tests/test_installer.py | 73 | def test_force_removes_stale_managed_files(tmp_path: Path) -> None: | CODE |
| 1526 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | platform/pnpm-workspace.yaml | 101 | # Security: Delay installation of newly published packages. | COMMENT |
| LOW | platform/docker/scripts/docker-entrypoint.sh | 1 | #!/bin/sh | COMMENT |
| LOW | platform/frontend/playwright.config.ts | 61 | projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }], | COMMENT |
| LOW | platform/frontend/next.config.ts | 21 | distDir: process.env.NEXT_DIST_DIR || ".next", | COMMENT |
| LOW | platform/frontend/next.config.ts | 61 | // at runtime doesn't also have to rebuild the FE image. (next.config.ts is | COMMENT |
| LOW | platform/frontend/src/app/chat/page.tsx | 1041 | const stop = chatSession?.stop; | COMMENT |
| LOW | platform/frontend/src/app/chat/page.tsx | 2061 | // We need to fetch them first to apply our pending actions on top | COMMENT |
| LOW | platform/frontend/src/app/chat/page.tsx | 2301 | // set the org default model — which built-in background subagents inherit — | COMMENT |
| LOW | …/frontend/src/app/connection/connect-command-panel.tsx | 241 | const hasAnything = Boolean(gateway || proxyActive || includeSkills); | COMMENT |
| LOW | …ntend/src/app/mcp/registry/_parts/mcp-catalog-form.tsx | 501 | const { isDirty: isFormDirty, dirtyFields } = form.formState; | COMMENT |
| LOW | …ontend/src/app/mcp/registry/_parts/cascade-decision.ts | 341 | ): boolean { | COMMENT |
| LOW | …m/frontend/src/app/internal-test/msw-handlers/route.ts | 1 | // Control endpoint for per-test MSW handler overrides used by Playwright | COMMENT |
| LOW | platform/frontend/src/app/apps/_parts/app-card.tsx | 261 | onOpenChange={setSettingsOpen} | COMMENT |
| LOW | …tform/frontend/src/components/ui/secret-input.utils.ts | 1 | // Attributes that keep browser and extension password managers away from | COMMENT |
| LOW | …tform/frontend/src/components/mcp-app/mcp-app-view.tsx | 201 | // Shared cancel ref so the prop-update useEffect can cancel an in-flight fallback fetch. | COMMENT |
| LOW | …ntend/src/components/chat/conversation-files-panel.tsx | 61 | // A project chat's files belong to the project, so dropping onto this panel | COMMENT |
| LOW | platform/frontend/src/lib/chat/chat-submit-action.ts | 1 | // Decides what a chat composer submit should do, given the current send state. | COMMENT |
| LOW | platform/frontend/src/lib/chat/chat-session-utils.ts | 61 | // back a fresh array each time. That churns the caller's stableMessages | COMMENT |
| LOW | platform/frontend/src/lib/chat/global-chat.context.tsx | 501 | // promise resolving — the "run already finished" case, where the reconnect | COMMENT |
| LOW | platform/frontend/src/lib/chat/global-chat.context.tsx | 621 | } | COMMENT |
| LOW | platform/frontend/src/lib/chat/global-chat.context.tsx | 761 | } | COMMENT |
| LOW | platform/frontend/src/lib/chat/global-chat.context.tsx | 781 | if (previousMessagesRef.current.length > 0) { | COMMENT |
| LOW | platform/frontend/src/lib/chat/global-chat.context.tsx | 1101 | COMMENT | |
| LOW | platform/frontend/src/lib/chat/global-chat.context.tsx | 1181 | // are now stale — the backend never clears them on its own, and left behind | COMMENT |
| LOW | platform/frontend/src/lib/chat/global-chat.context.tsx | 1221 | const canonical = data?.messages as UIMessage[] | undefined; | COMMENT |
| LOW | platform/backend/scripts/start-production.sh | 1 | #!/bin/sh | COMMENT |
| LOW | platform/backend/src/config.ts | 1801 | // it ngrok assigns an ephemeral domain that rotates on each restart. | COMMENT |
| LOW | platform/backend/src/server.ts | 1221 | /** | COMMENT |
| LOW | platform/backend/src/clients/mcp-client.ts | 761 | // session). The aborted call is intentionally not audited from here: | COMMENT |
| LOW | platform/backend/src/clients/mcp-client.ts | 3401 | ): Promise<ResourceContents> { | COMMENT |
| LOW | platform/backend/src/clients/chat-tool-builder.ts | 901 | COMMENT | |
| LOW | platform/backend/src/database/seed.ts | 381 | // Explicit command overrides the image ENTRYPOINT to avoid breakage from upstream image changes. | COMMENT |
| LOW | platform/backend/src/types/app.ts | 81 | // Teams the app is shared with (via its backing catalog), for the card's | COMMENT |
| LOW | …rm/backend/src/types/llm-providers/bedrock/messages.ts | 201 | COMMENT | |
| LOW | platform/backend/src/test/setup.ts | 41 | // Vertex AI mode must not leak in from a developer's .env (config.ts loads it | COMMENT |
| LOW | platform/backend/src/auth/better-auth.ts | 301 | }, | COMMENT |
| LOW | platform/backend/src/auth/fastify-plugin/middleware.ts | 161 | url.startsWith("/oauth/") || | COMMENT |
| LOW | platform/backend/src/k8s/mcp-server-runtime/manager.ts | 1001 | COMMENT | |
| LOW | …m/backend/src/k8s/mcp-server-runtime/network-policy.ts | 261 | egress: [ | COMMENT |
| LOW | …orm/backend/src/k8s/mcp-server-runtime/manager.test.ts | 1381 | describe("startServer - success auto redeploy", () => { | COMMENT |
| LOW | platform/backend/src/agents/agent-run-stream.ts | 1 | // The shared agent-run streamText primitive for every agent execution surface | COMMENT |
| LOW | platform/backend/src/agents/agent-run-stream.ts | 301 | // call started; if the stream ends before a committing `tool-call`, it was | COMMENT |
| LOW | platform/backend/src/agents/a2a-executor.ts | 401 | // Execute via the shared agent-run primitive: it owns the streamText call | COMMENT |
| LOW | platform/backend/src/models/tool-invocation-policy.ts | 721 | } | COMMENT |
| LOW | platform/backend/src/models/project.ts | 101 | .set({ projectId: project.id }) | COMMENT |
| LOW | platform/backend/src/models/organization-role.ts | 101 | */ | COMMENT |
| LOW | platform/backend/src/models/tool.ts | 821 | return []; | COMMENT |
| LOW | platform/backend/src/models/tool.ts | 2501 | // Create a map of existing tools by their RAW name (part after `__`) | COMMENT |
| LOW | …c/skills-sandbox/skill-sandbox-runtime-service.test.ts | 741 | COMMENT | |
| LOW | …end/src/archestra-mcp-server/app-authoring-guidance.ts | 1 | import { APP_PLATFORM_CSP_RESOURCE_DOMAINS } from "@/services/apps/app-ui-policy"; | COMMENT |
| LOW | platform/backend/src/archestra-mcp-server/apps.ts | 681 | "Render an existing app by id, if the caller may view it. Use this when the user asks to open, show, or get back t | COMMENT |
| LOW | …form/backend/src/archestra-mcp-server/dynamic-tools.ts | 21 | import type { Tool } from "@/types"; | COMMENT |
| LOW | …form/backend/src/archestra-mcp-server/dynamic-tools.ts | 341 | // tools are never enabled by this predicate. | COMMENT |
| LOW | platform/backend/src/archestra-mcp-server/run-tool.ts | 361 | } | COMMENT |
| LOW | platform/backend/src/knowledge-base/connector-sync.ts | 81 | const epoch = run.leaseEpoch; | COMMENT |
| LOW | …edge-base/connectors/outline/outline-connector.test.ts | 561 | ); | COMMENT |
| LOW | platform/backend/src/static/archestra-app-sdk.js | 161 | console.error("Archestra Apps SDK: connect failed", err); | COMMENT |
| LOW | platform/backend/src/static/archestra-app-sdk.js | 201 | offenders.join(", "), | COMMENT |
| LOW | platform/backend/src/static/mcp-sandbox-proxy.html | 41 | // below) to connect to the host. location.origin is this proxy's real origin | COMMENT |
| LOW | platform/backend/src/standalone-scripts/hydrate-from.ts | 101 | ), | COMMENT |
| 177 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | migration-kit/references/install.md | 51 | c.sign_in("admin@example.com", "password") | CODE |
| LOW | platform/frontend/tests-integration/mcp-install.spec.ts | 178 | .fill("fake-token"); | CODE |
| LOW | …pp/settings/account/_components/sessions-card.test.tsx | 41 | user: { id: "user-1", email: "user@example.com" }, | CODE |
| LOW | …/settings/account/_components/two-factor-card.test.tsx | 33 | user: { id: "user-1", email: "user@example.com", twoFactorEnabled }, | CODE |
| LOW | …dentity-providers/_parts/role-mapping-form.ee.test.tsx | 45 | email: "admin@example.com", | CODE |
| LOW | …nowledge-bases/_parts/create-connector-dialog.test.tsx | 300 | await user.type(screen.getByLabelText(/^Email$/), "user@example.com"); | CODE |
| LOW | …nowledge-bases/_parts/create-connector-dialog.test.tsx | 324 | target: { value: "user@example.com" }, | CODE |
| LOW | …nowledge-bases/_parts/create-connector-dialog.test.tsx | 341 | email: "user@example.com", | CODE |
| LOW | …nowledge-bases/_parts/create-connector-dialog.test.tsx | 594 | target: { value: "admin@example.com" }, | CODE |
| LOW | …nowledge-bases/_parts/create-connector-dialog.test.tsx | 621 | email: "admin@example.com", | CODE |
| LOW | …dge/knowledge-bases/_parts/connector-dialog-config.tsx | 619 | ? "user@example.com" | CODE |
| LOW | …dge/knowledge-bases/_parts/connector-dialog-config.tsx | 692 | ? "user@example.com" | CODE |
| LOW | …dge/knowledge-bases/_parts/connector-dialog-config.tsx | 960 | ? "user@example.com" | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 119 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 144 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 187 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 210 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 231 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 249 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 284 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 312 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 341 | email: "user@example.com", | CODE |
| LOW⚡ | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 357 | email: "user@example.com", | CODE |
| LOW⚡ | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 358 | name: "user@example.com", | CODE |
| LOW⚡ | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 367 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 416 | email: "user@example.com", | CODE |
| LOW | …form/frontend/src/app/_parts/posthog-provider.test.tsx | 453 | email: "user@example.com", | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 8 | { userId: "user-1", name: "John Doe", email: "john@example.com" }, | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 41 | expect(screen.getByText("John Doe")).toBeInTheDocument(); | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 124 | expect(screen.getByText("John Doe")).toBeInTheDocument(); | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 165 | expect(screen.queryByText("John Doe")).not.toBeInTheDocument(); | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 187 | expect(screen.queryByText("John Doe")).not.toBeInTheDocument(); | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 284 | expect(screen.getByText("John Doe")).toBeInTheDocument(); | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 301 | expect(screen.queryByText("John Doe")).not.toBeInTheDocument(); | CODE |
| LOW | …d/src/components/user-searchable-multi-select.test.tsx | 397 | b.textContent?.includes("John Doe"), | CODE |
| LOW | …atform/frontend/src/components/invite-by-link-card.tsx | 84 | placeholder="user@example.com" | CODE |
| LOW | …rontend/src/components/user-searchable-select.test.tsx | 18 | name: "John Doe", | CODE |
| LOW | …rontend/src/components/user-searchable-select.test.tsx | 101 | name: "John Doe", | CODE |
| LOW | …rontend/src/components/user-searchable-select.test.tsx | 121 | { userId: "user-1", name: "John Doe", email: "john@example.com" }, | CODE |
| LOW | …rontend/src/components/user-searchable-select.test.tsx | 133 | expect(screen.queryByText("John Doe")).not.toBeInTheDocument(); | CODE |
| LOW | …rontend/src/components/user-searchable-select.test.tsx | 145 | { userId: "user-1", name: "John Doe", email: "john@example.com" }, | CODE |
| LOW | …rontend/src/components/user-searchable-select.test.tsx | 157 | expect(screen.getByText("John Doe")).toBeInTheDocument(); | CODE |
| LOW | platform/frontend/src/components/token-select.test.tsx | 93 | ownerEmail: "admin@example.com", | CODE |
| LOW | …src/components/settings/role-permissions-card.test.tsx | 43 | email: "admin@example.com", | CODE |
| LOW | platform/frontend/src/lib/auth/account.query.test.ts | 38 | email: "user@example.com", | CODE |
| LOW | platform/frontend/src/lib/auth/account.query.test.ts | 60 | email: "user@example.com", | CODE |
| LOW | platform/frontend/src/lib/auth/account.query.test.ts | 78 | email: "user@example.com", | CODE |
| LOW | platform/backend/src/templating.test.ts | 81 | const context = { email: "user@example.com" }; | CODE |
| LOW | platform/backend/src/templating.test.ts | 421 | email: "test@test.com", | CODE |
| LOW | …ackend/src/clients/anthropic-workload-identity.test.ts | 248 | "x-api-key": "placeholder", | CODE |
| LOW | platform/backend/src/guardrails/trusted-data.test.ts | 1157 | content: { from: "user@example.com" }, | CODE |
| LOW | platform/backend/src/auth/idp.ee.test.ts | 38 | const user = await makeUser({ email: "admin@example.com" }); | CODE |
| LOW | platform/backend/src/auth/cimd.test.ts | 121 | contacts: ["admin@example.com"], | CODE |
| LOW | platform/backend/src/auth/cimd.test.ts | 142 | expect(result.contacts).toEqual(["admin@example.com"]); | CODE |
| LOW | platform/backend/src/auth/better-auth.test.ts | 176 | body: { email: "user@example.com", callbackURL: "http://example.com" }, | CODE |
| LOW | platform/backend/src/auth/better-auth.test.ts | 196 | email: "user@example.com", | CODE |
| LOW | platform/backend/src/auth/better-auth.test.ts | 215 | email: "user@example.com", | CODE |
| LOW | platform/backend/src/auth/better-auth.test.ts | 223 | email: "user@example.com", | CODE |
| LOW | platform/backend/src/auth/better-auth.test.ts | 245 | email: "user@example.com", | CODE |
| LOW | platform/backend/src/auth/better-auth.test.ts | 254 | email: "user@example.com", | CODE |
| 128 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ontend/src/app/mcp/registry/_parts/mcp-server-card.tsx | 228 | // ── Shareable edit deep-link (`?edit=<catalogId>`) ────────────────────── | COMMENT |
| MEDIUM⚡ | …ontend/src/app/mcp/registry/_parts/cascade-decision.ts | 88 | // ── Manual ─────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …ontend/src/app/mcp/registry/_parts/cascade-decision.ts | 95 | // ── Skip via forward-compat ────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …ontend/src/app/mcp/registry/_parts/cascade-decision.ts | 102 | // ── Auto ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …tform/frontend/src/components/mcp-app/mcp-app-view.tsx | 1255 | // ── Host-theme bridging helpers ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rontend/src/components/chat/mcp-app-container.test.tsx | 6 | // ── Mock heavy dependencies before module import ───────────────────────────── | COMMENT |
| MEDIUM | …rontend/src/components/chat/mcp-app-container.test.tsx | 83 | // ── Import component under test after mocks ─────────────────────────────────── | COMMENT |
| MEDIUM | …rontend/src/components/chat/mcp-app-container.test.tsx | 98 | // ── Helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …rontend/src/components/chat/mcp-app-container.test.tsx | 112 | // ── Tests ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/frontend/src/lib/auth/oauth-session.ts | 15 | // ─── Key constants ─────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/frontend/src/lib/auth/oauth-session.ts | 34 | // ─── Helpers ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/frontend/src/lib/auth/oauth-session.ts | 160 | // ─── Processing guard (prevents duplicate callback processing) ─────── | COMMENT |
| MEDIUM | platform/frontend/src/lib/auth/oauth-session.ts | 178 | // ─── Getters ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/frontend/src/lib/auth/oauth-session.ts | 293 | // ─── Cleanup ───────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/backend/src/routes/mcp-proxy.test.ts | 15 | // ── Helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/backend/src/routes/mcp-proxy.test.ts | 58 | // ── Tests ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/shared/cascade-scenarios.ts | 109 | // ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/shared/cascade-scenarios.ts | 111 | // ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | platform/shared/cascade-scenarios.ts | 254 | // ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | platform/shared/cascade-scenarios.ts | 256 | // ───────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | platform/shared/cascade-scenarios.ts | 259 | // ── description-only across all shapes (the headline path) ───────── | COMMENT |
| MEDIUM | platform/shared/cascade-scenarios.ts | 363 | // ── runtime field changes (cascade SHOULD fire) ──────────────────── | COMMENT |
| MEDIUM | platform/shared/cascade-scenarios.ts | 565 | // ── identity / nothing-changed sanity ───────────────────────────── | COMMENT |
| MEDIUM | platform/dev/vault-k8s-manual-test.yaml | 1 | # ============================================================ | COMMENT |
| MEDIUM⚡ | platform/dev/vault-k8s-manual-test.yaml | 73 | # ============================================================ | COMMENT |
| MEDIUM⚡ | platform/dev/vault-k8s-manual-test.yaml | 75 | # ============================================================ | COMMENT |
| MEDIUM⚡ | platform/dev/vault-k8s-manual-test.yaml | 77 | # ============================================================ | COMMENT |
| MEDIUM | platform/dev/vault-k8s-manual-test.yaml | 95 | # ============================================================ | COMMENT |
| MEDIUM | platform/dev/vault-k8s-manual-test.yaml | 97 | # ============================================================ | COMMENT |
| MEDIUM | platform/dev/grafana/generate-pg-dashboard-variants.py | 24 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | platform/dev/grafana/generate-pg-dashboard-variants.py | 26 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | platform/dev/grafana/generate-pg-dashboard-variants.py | 39 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 7 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 9 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 58 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 60 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 123 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 125 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | platform/dev/grafana/install-dashboards.sh | 141 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | platform/dev/grafana/install-dashboards.sh | 143 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 169 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 171 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 192 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | platform/dev/grafana/install-dashboards.sh | 194 | # ────────────────────────────────────────────── | COMMENT |
| MEDIUM | ai-labs/baton/baton-core/src/lib.rs | 90 | // ── Core ──────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | ai-labs/baton/baton-core/src/lib.rs | 104 | // ── Feature ───────────────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 64 | - 🛡️ **Deterministic guardrails** for [tool calls](https://archestra.ai/docs/platform-ai-tool-guardrails), | CODE |
| MEDIUM | README.md | 66 | [Lethal Trifecta](https://archestra.ai/docs/platform-ai-tool-guardrails#the-lethal-trifecta) protections. | CODE |
| MEDIUM | migration-kit/SKILL.md | 7 | # Migrate an agentic PoC to Archestra | COMMENT |
| MEDIUM | platform/frontend/src/app/mcp/registry/new/page.tsx | 65 | // review tools, configure guardrails. | COMMENT |
| MEDIUM | …d/src/app/mcp/registry/_parts/catalog-setup-wizard.tsx | 459 | // "Configure with Subagent" action from the full guardrails table. | COMMENT |
| MEDIUM | …orm/frontend/src/app/mcp/registry/[id]/page.client.tsx | 113 | // How many tools to preview on the Overview before linking out to guardrails. | COMMENT |
| MEDIUM | …rontend/src/app/mcp/registry/[id]/edit/page.client.tsx | 79 | : // "guardrails" merged into "tools"; keep old deep links working. | CODE |
| MEDIUM | …orm/frontend/src/app/apps/_parts/app-create-dialog.tsx | 15 | // Seeded as the new app's description so the blank scaffold has a get-started | COMMENT |
| MEDIUM | …rm/frontend/src/components/chat/edit-policy-dialog.tsx | 18 | // name-based fallback lookup below, so it is optional: the tool-guardrails | COMMENT |
| MEDIUM | …rm/frontend/src/components/chat/chat-messages.utils.ts | 392 | // Owned-app management result (scaffold/edit/render_app): mount the | COMMENT |
| MEDIUM | …rm/frontend/src/components/chat/chat-messages.utils.ts | 741 | // scaffold/edit/render_app is covered too (its raw name is run_tool, which | COMMENT |
| MEDIUM | …orm/frontend/src/components/chat/compact-tool-call.tsx | 331 | // still-streaming scaffold/edit call) degrades to a plain tool circle. | COMMENT |
| MEDIUM | platform/frontend/src/lib/chat/global-chat.context.tsx | 883 | // The backend's stopWhen: hasToolCall(...) stops the agentic loop | COMMENT |
| MEDIUM | platform/backend/src/tokenizers/base.ts | 40 | // The same conversation history is re-sent on every agentic turn, so counting | COMMENT |
| MEDIUM | platform/backend/src/types/app.ts | 249 | // template (no html), so the staged authoring flow is scaffold → edit_app. | COMMENT |
| MEDIUM | platform/backend/src/types/app.ts | 266 | // Input for the `refine_app` MCP tool: the step between scaffold and edit. It | COMMENT |
| MEDIUM | platform/backend/src/guardrails/tool-invocation.test.ts | 229 | // rather than the LLM proxy's "monitors agentic traffic". | COMMENT |
| MEDIUM | …s/browser-stream/websocket/browser-stream.websocket.ts | 195 | // as the chat agentic loop. Closing it here would kill in-flight tool calls | COMMENT |
| MEDIUM | …s/browser-stream/websocket/browser-stream.websocket.ts | 196 | // from the agentic loop, causing AI_MissingToolResultsError. | COMMENT |
| MEDIUM | platform/backend/src/models/tool.ts | 1425 | // explicit default rows so the /mcp/guardrails UI shows the same | COMMENT |
| MEDIUM | platform/backend/src/models/tool.ts | 3151 | // Can be explicitly included for guardrails configuration. | COMMENT |
| MEDIUM | platform/backend/src/models/internal-mcp-catalog.ts | 78 | // A clone copies the source's tools + guardrails as provisional rows, and | COMMENT |
| MEDIUM | platform/backend/src/models/interaction.test.ts | 2163 | // Gemini request with function response (common in agentic workflows) | COMMENT |
| MEDIUM | …end/src/archestra-mcp-server/app-authoring-guidance.ts | 38 | // archestra.storage.get). Delivered once at scaffold time rather than repeated | COMMENT |
| MEDIUM | platform/backend/src/archestra-mcp-server/apps.test.ts | 211 | // Member may scaffold a personal app... | COMMENT |
| MEDIUM | platform/backend/src/archestra-mcp-server/apps.test.ts | 1080 | // scaffold produced — proving the default resolves the live head, not 1. | COMMENT |
| MEDIUM | platform/backend/src/archestra-mcp-server/run-tool.ts | 458 | // edit guardrails also gets a deep link to this tool's policy editor. | COMMENT |
| MEDIUM | …atform/backend/src/skills/skill-catalog.generated.json | 512 | [17,"plugins/dotnet-ai/skills/mcp-csharp-create","mcp-csharp-create","Create MCP servers using the C# SDK and .NET proje | CODE |
| MEDIUM | …atform/backend/src/skills/skill-catalog.generated.json | 544 | [17,"plugins/dotnet-maui/skills/maui-data-binding","maui-data-binding","Guidance for .NET MAUI XAML and C# data bindings | CODE |
| MEDIUM | platform/backend/src/routes/mcp-gateway.utils.ts | 578 | // can edit guardrails, both gain a deep link to this tool's policy | COMMENT |
| MEDIUM | platform/backend/src/routes/mcp-gateway.utils.test.ts | 2891 | // (scaffold/read/edit/validate) works from external clients and stays. | COMMENT |
| MEDIUM | platform/backend/src/routes/proxy/llm-proxy-handler.ts | 647 | // discovered-tool guardrails to any tools persisted below. | COMMENT |
| MEDIUM | …orm/backend/src/services/scheduled-run-conversation.ts | 325 | // agentic loop); its request holds the full history and its response the final | COMMENT |
| MEDIUM | platform/backend/src/services/apps/app-run-link.ts | 3 | // Kept in one place so scaffold/edit/render/publish surface an identical, | COMMENT |
| MEDIUM | platform/backend/src/services/apps/app-mcp-backing.ts | 66 | // (APP_LAUNCH_TOOL_NAME) so it shows up in the guardrails UI and is | COMMENT |
| MEDIUM | platform/backend/src/services/apps/app-mcp-backing.ts | 158 | // non-model readers (the guardrails UI) current too. | COMMENT |
| MEDIUM | platform/shared/tool-refusal.test.ts | 78 | // not the LLM proxy's "monitors agentic traffic". | COMMENT |
| MEDIUM | …tform/archestra-rs/sandbox-core/src/backends/dagger.rs | 597 | /// warm-base user-setup command: scaffold the uv project, create the venv at | COMMENT |
| MEDIUM | docs/pages/platform-knowledge.md | 54 | The output of `query_knowledge_sources` is treated as sensitive by default, which can impact the ability to use subseque | CODE |
| MEDIUM | docs/pages/platform-agents.md | 73 | The output of `query_knowledge_sources` is treated as sensitive by default, which can impact the ability to use subseque | CODE |
| MEDIUM | docs/pages/platform-observability.md | 43 | ### RAG & Knowledge Base Metrics | COMMENT |
| MEDIUM⚡ | docs/pages/platform-supported-llm-providers.md | 194 | [Cohere](https://www.cohere.ai/) provides LLMs through an API with safety guardrails, function calling, and both synchro | CODE |
| MEDIUM | docs/pages/platform-archestra-mcp-server.md | 22 | [`query_knowledge_sources`](#query_knowledge_sources) is an exception: its output is treated as sensitive by default and | CODE |
| MEDIUM | ai-labs/runner/src/chat_stream.rs | 22 | /// agentic step). Sourced from the rows rather than the chat SSE `data-token-usage` event, whose | COMMENT |
| MEDIUM | ai-labs/runner/src/run.rs | 1517 | // every conversation it drove -- one row per agentic step, so the total covers all steps rather | COMMENT |
| MEDIUM | ai-labs/runner/src/run.rs | 1898 | // the persisted interaction rows (see grade_rollout), which capture every agentic step. | COMMENT |
| MEDIUM | ai-labs/runner/src/interactions.rs | 89 | /// agentic step, so summing the rows recovers the full spend of a multi-step turn — unlike the chat | COMMENT |
| MEDIUM | ai-labs/analyzer/src/lib.rs | 6 | //! surfaces we own, led by Tier 1 — the Archestra agentic loop and `archestra__*` tools — over | COMMENT |
| MEDIUM | ai-labs/analyzer/src/analyze.rs | 60 | r#"You are TRIAGING one trajectory from the Archestra agentic benchmark. Your job is to grade the rollout on fou | CODE |
| MEDIUM | ai-labs/analyzer/src/analyze.rs | 439 | // The primary (agentic-loop) section must come before the demoted fixture-polish section. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | platform/backend/src/services/mcp-reinstall.test.ts | 968 | default: "your-api-key", | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 58 | - **Authentication**: Pass your OpenAI API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH⚡ | docs/pages/platform-supported-llm-providers.md | 190 | - **Authentication**: Pass your Cerebras API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH⚡ | docs/pages/platform-supported-llm-providers.md | 204 | - **Authentication**: Pass your Cohere API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 228 | - **Authentication**: Pass your Groq API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 264 | - **Authentication**: Pass your OpenRouter API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 308 | - **Authentication**: Pass your Mistral API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 325 | - **Authentication**: Pass your Perplexity API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 356 | - **Authentication**: API key is **optional**. Pass in `Authorization` header as `Bearer <your-api-key>` if your vLLM de | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 391 | - **Authentication**: API key is **optional**. Pass in `Authorization` header as `Bearer <your-api-key>` if your Ollama | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 427 | - **Authentication**: Pass your Zhipu AI API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 462 | - **Authentication**: Pass your xAI API key in `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 499 | - **Authentication**: Pass your MiniMax API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| HIGH | docs/pages/platform-supported-llm-providers.md | 791 | - **API key authentication**: Pass your Azure API key in the `Authorization` header as `Bearer <your-api-key>` | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …atform/backend/src/skills/skill-catalog.generated.json | 544 | [17,"plugins/dotnet-maui/skills/maui-data-binding","maui-data-binding","Guidance for .NET MAUI XAML and C# data bindings | CODE |
| MEDIUM | …atform/backend/src/skills/skill-catalog.generated.json | 805 | [25,"skills/csharp-docs","csharp-docs","Ensure that C# types are documented with XML comments and follow best practices | CODE |
| MEDIUM | …atform/backend/src/skills/skill-catalog.generated.json | 823 | [25,"skills/dotnet-best-practices","dotnet-best-practices","Ensure .NET/C# code meets best practices for the solution/pr | CODE |
| MEDIUM | …form/backend/src/routes/chat/model-fetchers/bedrock.ts | 181 | // Authoritative underlying model for pricing — more robust than parsing | COMMENT |
| MEDIUM | …rm/backend/src/services/apps/app-sdk-injection.test.ts | 21 | // brace-matched depth scan over the comment-stripped body (robust to reformatting, | COMMENT |
| MEDIUM | platform/e2e-tests/tests/mcp-install.spec.ts | 330 | // instead — match either to keep the test robust. | COMMENT |
| MEDIUM | .github/bench/runner-entrypoint.sh | 5 | # exit code encodes harness health (zero passes ⇒ broken), so the pod's terminal phase is the signal CI | COMMENT |
| MEDIUM | .github/bench/runner-entrypoint.sh | 57 | # Final step: uploads to GCS, posts Slack, and exits non-zero on a broken harness so the pod's terminal | COMMENT |
| MEDIUM | .github/workflows/claude-coreteam-review.yml | 1 | # This workflow provides comprehensive PR reviews using Claude. | COMMENT |
| MEDIUM | .github/workflows/claude-coreteam-review.yml | 5 | # https://github.com/anthropics/claude-code-action/blob/main/examples/pr-review-comprehensive.yml | COMMENT |
| MEDIUM⚡ | ai-labs/tasks/aec-material-json-takeoff/verifier.py | 167 | # The harness saves the artifact without an .xlsx extension; load from bytes so openpyxl judges it | COMMENT |
| MEDIUM | ai-labs/tasks/xlsx-live-formulas/verifier.py | 37 | # The harness saves the artifact as `artifact.bin`; load from bytes so openpyxl does not reject it | COMMENT |
| MEDIUM | ai-labs/baton/baton-check/Cargo.toml | 8 | # Standalone on purpose, like baton-core: a harness sidecar for the | COMMENT |
| MEDIUM | ai-labs/baton/baton-check/Cargo.toml | 9 | # agentdojo-harness prototype, not part of the archestra-bench workspace. | COMMENT |
| MEDIUM | ai-labs/scripts/publish_run.py | 86 | # One loud line is the right shape for a broken harness — there is no leaderboard to scan. | COMMENT |
| MEDIUM | ai-labs/envs/basic.toml | 5 | # Starts the harness-owned `acme_it` synthetic MCP (fixed, controlled content) and registers it to every | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ntend/src/components/microsoft-365-copilot-sign-in.tsx | 91 | // Step 1: fetch the device code and show it. We deliberately do NOT open the | COMMENT |
| LOW | …ntend/src/components/microsoft-365-copilot-sign-in.tsx | 113 | // Step 2: copy the code WHILE the page is still focused, then open the | COMMENT |
| LOW | …orm/frontend/src/components/github-copilot-sign-in.tsx | 89 | // Step 1: fetch the device code and show it. We deliberately do NOT open the | COMMENT |
| LOW | …orm/frontend/src/components/github-copilot-sign-in.tsx | 110 | // Step 2: copy the code WHILE the page is still focused, then open GitHub. | COMMENT |
| LOW⚡ | …rontend/src/components/chat/mcp-app-container.test.tsx | 894 | // Step 1: the user collapses the app, reopens it, and pins it to the panel | COMMENT |
| LOW⚡ | …rontend/src/components/chat/mcp-app-container.test.tsx | 903 | // Step 2: the model renders a second, different app. | COMMENT |
| LOW | …rontend/src/components/chat/mcp-app-container.test.tsx | 955 | // Step 2: the model renders a second app — both stay expanded inline. | COMMENT |
| LOW | platform/backend/src/database/utils/pagination.md | 80 | ### Step 1: Add Pagination to Your Model | COMMENT |
| LOW | platform/backend/src/database/utils/pagination.md | 110 | ### Step 2: Add Pagination to Your Route | COMMENT |
| LOW | platform/backend/src/database/utils/pagination.md | 142 | ### Step 3: Test Your Endpoint | COMMENT |
| LOW | …rails/query-knowledge-sources-invocation-chain.test.ts | 37 | // Step 1: evaluate context trust after KB query tool result | COMMENT |
| LOW | …rails/query-knowledge-sources-invocation-chain.test.ts | 71 | // Step 2: simulate the model attempting a subsequent tool invocation | COMMENT |
| LOW | platform/backend/src/models/agent.ts | 1071 | // Step 1: Get paginated agent IDs with proper sorting | COMMENT |
| LOW | platform/backend/src/models/agent.ts | 1195 | // Step 2: Get full agent data with tools for the paginated agent IDs | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 33 | // Step 0: Clean existing mock data (in correct order due to foreign keys) | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 40 | // Step 1: Create users | COMMENT |
| LOW | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 67 | // Step 2: Create teams and add members | COMMENT |
| LOW | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 129 | // Step 3: Create agents, MCP gateways, and LLM proxies with ownership patterns | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 305 | // Step 4: Create tools linked to agents | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 315 | // Step 5: Create agent-tool relationships | COMMENT |
| LOW | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 330 | // Step 6: Create 200 mock interactions | COMMENT |
| LOW⚡ | platform/e2e-tests/tests/oauth-self-hosted.spec.ts | 71 | // Step 1: Fetch the authorization page to get the mock IdP link | COMMENT |
| LOW | platform/e2e-tests/tests/oauth-self-hosted.spec.ts | 84 | // Step 2: Call the mock IdP callback directly (simulates user clicking "Authorize") | COMMENT |
| LOW | platform/e2e-tests/tests/oauth-self-hosted.spec.ts | 97 | // Step 3: Extract code and state from the redirect URL | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ntend/src/components/microsoft-365-copilot-sign-in.tsx | 91 | // Step 1: fetch the device code and show it. We deliberately do NOT open the | COMMENT |
| LOW | …ntend/src/components/microsoft-365-copilot-sign-in.tsx | 113 | // Step 2: copy the code WHILE the page is still focused, then open the | COMMENT |
| LOW | …orm/frontend/src/components/github-copilot-sign-in.tsx | 89 | // Step 1: fetch the device code and show it. We deliberately do NOT open the | COMMENT |
| LOW | …orm/frontend/src/components/github-copilot-sign-in.tsx | 110 | // Step 2: copy the code WHILE the page is still focused, then open GitHub. | COMMENT |
| LOW⚡ | …rontend/src/components/chat/mcp-app-container.test.tsx | 894 | // Step 1: the user collapses the app, reopens it, and pins it to the panel | COMMENT |
| LOW⚡ | …rontend/src/components/chat/mcp-app-container.test.tsx | 903 | // Step 2: the model renders a second, different app. | COMMENT |
| LOW | …rontend/src/components/chat/mcp-app-container.test.tsx | 955 | // Step 2: the model renders a second app — both stay expanded inline. | COMMENT |
| LOW | …rails/query-knowledge-sources-invocation-chain.test.ts | 37 | // Step 1: evaluate context trust after KB query tool result | COMMENT |
| LOW | …rails/query-knowledge-sources-invocation-chain.test.ts | 71 | // Step 2: simulate the model attempting a subsequent tool invocation | COMMENT |
| LOW | platform/backend/src/models/agent.ts | 1071 | // Step 1: Get paginated agent IDs with proper sorting | COMMENT |
| LOW | platform/backend/src/models/agent.ts | 1195 | // Step 2: Get full agent data with tools for the paginated agent IDs | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 33 | // Step 0: Clean existing mock data (in correct order due to foreign keys) | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 40 | // Step 1: Create users | COMMENT |
| LOW | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 67 | // Step 2: Create teams and add members | COMMENT |
| LOW | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 129 | // Step 3: Create agents, MCP gateways, and LLM proxies with ownership patterns | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 305 | // Step 4: Create tools linked to agents | COMMENT |
| LOW⚡ | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 315 | // Step 5: Create agent-tool relationships | COMMENT |
| LOW | …tform/backend/src/standalone-scripts/seed-mock-data.ts | 330 | // Step 6: Create 200 mock interactions | COMMENT |
| LOW⚡ | platform/e2e-tests/tests/oauth-self-hosted.spec.ts | 71 | // Step 1: Fetch the authorization page to get the mock IdP link | COMMENT |
| LOW | platform/e2e-tests/tests/oauth-self-hosted.spec.ts | 84 | // Step 2: Call the mock IdP callback directly (simulates user clicking "Authorize") | COMMENT |
| LOW | platform/e2e-tests/tests/oauth-self-hosted.spec.ts | 97 | // Step 3: Extract code and state from the redirect URL | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | migration-kit/install.py | 12 | CODE | |
| LOW | migration-kit/scripts/frontmatter.py | 26 | CODE | |
| LOW | migration-kit/scripts/discover.py | 18 | CODE | |
| LOW | migration-kit/scripts/contracts.py | 18 | CODE | |
| LOW | migration-kit/scripts/archestra_client.py | 20 | CODE | |
| LOW | migration-kit/scripts/apply.py | 22 | CODE | |
| LOW | .github/scripts/check-supply-chain-policy.py | 3 | CODE | |
| LOW | .github/scripts/check-docs-links.py | 13 | CODE | |
| LOW | .github/scripts/check-docs-image-policy.py | 3 | CODE | |
| LOW | .github/scripts/test_check_supply_chain_policy.py | 3 | CODE | |
| LOW | ai-labs/tasks/median-salary/expected/generate.py | 19 | CODE | |
| LOW | …labs/tasks/ai-sre-cache-treadmill/expected/generate.py | 41 | CODE | |
| LOW | ai-labs/tasks/pcap-soc-triage/generate.py | 30 | CODE | |
| LOW | ai-labs/tasks/renewal-churn-risk/generate.py | 17 | CODE | |
| LOW | ai-labs/tasks/sqlite-orders/expected/generate.py | 25 | CODE | |
| LOW | ai-labs/tasks/ai-sre-fk-drain/expected/generate.py | 32 | CODE | |
| LOW | ai-labs/baton/agentdojo-harness/src/baton_dojo/bench.py | 65 | CODE | |
| LOW | ai-labs/scripts/build_review_snapshot.py | 19 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …atform/backend/src/services/connection-setup-script.ts | 506 | print(f"Updated {path}")`; | CODE |
| HIGH | …atform/backend/src/services/connection-setup-script.ts | 767 | print("\\n".join(seen)) | CODE |
| HIGH | …atform/backend/src/services/connection-setup-script.ts | 864 | print(f"Updated {path}")`; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | platform/docker/scripts/docker-entrypoint.sh | 128 | # Check if cluster already exists | COMMENT |
| LOW | platform/docker/scripts/docker-entrypoint.sh | 237 | # Check if already connected to kind network | COMMENT |
| LOW | platform/docker/scripts/docker-entrypoint.sh | 303 | # Check if using external database (ARCHESTRA_DATABASE_URL or DATABASE_URL is set) | COMMENT |
| LOW | platform/benchmarks/setup-gcp-benchmark.sh | 54 | # Check if gcloud is installed | COMMENT |
| LOW⚡ | platform/dev/grafana/install-dashboards.sh | 146 | # Check if folder already exists | COMMENT |
| LOW | platform/helm/archestra/values.yaml | 441 | # Set useInClusterConfig to false and configure the secret below | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | migration-kit/scripts/discover.py | 559 | CODE | |
| LOW | migration-kit/scripts/apply.py | 768 | CODE | |
| LOW | platform/dev/grafana/generate-pg-dashboard-variants.py | 489 | CODE | |
| LOW | ai-labs/tasks/expense-report-continue/verifier.py | 74 | CODE | |
| LOW | ai-labs/tasks/aec-material-json-takeoff/verifier.py | 139 | CODE | |
| LOW | …labs/tasks/ai-sre-cache-treadmill/expected/generate.py | 102 | CODE | |
| LOW | ai-labs/tasks/xlsx-live-formulas/verifier.py | 70 | CODE | |
| LOW | ai-labs/tasks/ai-sre-fk-drain/expected/generate.py | 85 | CODE | |
| LOW | …abs/baton/agentdojo-harness/src/baton_dojo/pipeline.py | 24 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | platform/scripts/e2e-local.sh | 60 | # Create a patched kind config with our cluster name | COMMENT |
| MEDIUM | .github/values-ci.yaml | 2 | # This file is used for the shared non-quickstart E2E environment in GitHub Actions. | COMMENT |
| MEDIUM | .github/workflows/platform-e2e-tests.yml | 564 | # Create a shared Docker network so the quickstart container can reach WireMock by name | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | platform/backend/src/routes/proxy/adapters/gemini.ts | 657 | // Handle inline data (images generated by Gemini) | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …atform/backend/src/services/connection-setup-script.ts | 758 | except Exception: | CODE |
| LOW⚡ | ai-labs/tasks/aec-material-json-takeoff/verifier.py | 171 | except Exception as exc: # noqa: BLE001 -- any load failure means it is not a real workbook | CODE |
| LOW | ai-labs/scripts/publish_run.py | 158 | except Exception: | CODE |
| LOW | ai-labs/scripts/publish_run.py | 201 | except Exception: | CODE |
| LOW | ai-labs/scripts/publish_run.py | 229 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | ai-labs/tasks/invoice-approval/verifier.py | 72 | errors.append(f"{inv_id}: flagged invoice must have amount_cents=null, got {got_amount!r}") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tform/frontend/src/components/mcp-app/mcp-app-view.tsx | 569 | // TODO: implement ui/update-model-context | COMMENT |
| LOW | platform/backend/src/routes/proxy/llm-proxy-handler.ts | 1905 | // TODO: Add test for metrics reported by the LLM proxy. It's not obvious since | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | ai-labs/scripts/publish_run.py | 26 | logger = logging.getLogger(__name__) | CODE |
| LOW | ai-labs/scripts/export_tensorboard.py | 24 | logger = logging.getLogger(__name__) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | platform/scripts/dev-stack.sh | 16 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | platform/frontend/public/mockServiceWorker.js | 124 | async function handleRequest(event, requestId, requestInterceptedAt) { | CODE |