Automation foundation model for tiny devices: 2-bit, 8-29 MB, tool calls, ASR, structured extraction and embeddings on phones, wearables, smart homes, robots, cars and microcontrollers.
This report summarizes scanner evidence for cactus-compute/needle, a Python project with 13,846 GitHub stars. SynthScan examined 12,901 lines of code across 60 source files, recording 254 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 23.7 (Elevated pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 210 finding(s).
Are imports declared and package/API names verified? 13 finding(s).
Are wrappers, guards, and repeated structures necessary? 222 finding(s).
Which changes need focused human review? 254 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 254 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | needle/agent/fetch.py | 163 | def unpublished_engine_wheels(): | CODE |
| LOW | needle/model/tokenizer.py | 94 | def _download_tokenizer_from_hf(prefix): | CODE |
| LOW | tests/test_release.py | 59 | def test_existing_release_tag_skips_unchanged_source(repo): | CODE |
| LOW | tests/test_release.py | 64 | def test_release_tag_contains_versioned_source_and_skips_unchanged_main(repo): | CODE |
| LOW | tests/test_release.py | 83 | def test_manual_bump_on_main_follows_the_published_version(repo): | CODE |
| LOW | tests/test_release.py | 100 | def test_tag_step_tolerates_already_versioned_files(repo): | CODE |
| LOW | tests/test_release.py | 111 | def test_declared_version_above_everything_published_is_released_as_is(repo): | CODE |
| LOW | tests/test_inference.py | 21 | def test_structured_extraction(): | CODE |
| LOW | tests/test_inference.py | 72 | def test_extract_keeps_agent_tools(): | CODE |
| LOW | tests/conftest.py | 65 | def tiny_checkpoint_safetensors(tiny_checkpoint): | CODE |
| LOW | tests/test_packaging.py | 10 | def test_training_dependencies_are_not_required_for_runtime() -> None: | CODE |
| LOW | tests/test_run.py | 34 | def test_read_checkpoint_rejects_pkl_without_executing(tmp_path): | CODE |
| LOW | tests/test_run.py | 50 | def test_read_adapter_rejects_pkl_without_executing(tmp_path): | CODE |
| LOW | tests/test_run.py | 66 | def test_read_checkpoint_rejects_pickle_disguised_as_safetensors(tmp_path): | CODE |
| LOW | tests/test_run.py | 95 | def test_read_adapter_rejects_pickle_disguised_as_safetensors(tmp_path): | CODE |
| LOW | tests/test_run.py | 110 | def test_build_prompt_passthrough_without_tools(): | CODE |
| LOW | tests/test_run.py | 118 | def test_build_prompt_matches_training_template(): | CODE |
| LOW | tests/test_run.py | 145 | def test_main_loads_tools_file_and_runs(tiny_checkpoint, tmp_path, capsys): | CODE |
| LOW | tests/test_run.py | 161 | def test_missing_checkpoint_is_looked_up_under_checkpoints_then_at_the_repo_root(monkeypatch, tmp_path): | CODE |
| LOW⚡ | tests/test_grounding.py | 95 | def test_complete_flags_call_dates_that_contradict_the_input(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 105 | def test_complete_leaves_grounded_dates_alone(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 115 | def test_input_without_a_year_is_not_checked(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 125 | def test_a_slash_date_does_not_mint_a_year_from_its_day_or_month(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 224 | def test_extract_clears_a_thousands_separated_number(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 234 | def test_extract_clears_a_thousands_separated_integer(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 243 | def test_extract_leaves_an_unseparated_number_working(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 252 | def test_extract_still_rejects_a_fabricated_number(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 262 | def test_extract_still_rejects_a_non_numeric_engine_flag(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 295 | def test_extract_does_not_clear_a_number_absent_from_the_source(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 303 | def test_extract_does_not_read_a_date_hyphen_as_a_minus_sign(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 313 | def test_extract_does_not_read_a_range_hyphen_as_a_minus_sign(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 322 | def test_extract_clears_a_written_negative(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 332 | def test_extract_clears_a_zero_against_its_source(stub): | CODE |
| LOW⚡ | tests/test_grounding.py | 341 | def test_run_executes_a_grounded_number_and_refuses_an_ungrounded_sibling(stub): | CODE |
| LOW | tests/test_grounding.py | 137 | def test_extract_accepts_a_date_written_with_slashes(stub): | CODE |
| LOW | tests/test_grounding.py | 146 | def test_extract_licenses_a_relative_date_against_its_date_fact(stub): | CODE |
| LOW | tests/test_grounding.py | 159 | def test_run_refuses_ungrounded_calls_unless_strict_is_off(stub): | CODE |
| LOW | tests/test_grounding.py | 173 | def test_system_facts_license_relative_dates(stub): | CODE |
| LOW | tests/test_grounding.py | 183 | def test_a_key_ending_in_date_does_not_suppress_the_date_fact(stub): | CODE |
| LOW | tests/test_grounding.py | 198 | def test_years_carry_across_turns_until_reset(stub): | CODE |
| LOW | tests/test_grounding.py | 211 | def test_engine_reported_fabrications_are_kept_and_block_execution(stub): | CODE |
| LOW | tests/test_grounding.py | 273 | def test_extract_clears_a_nested_separated_number(stub): | CODE |
| LOW | tests/test_grounding.py | 284 | def test_extract_does_not_clear_a_digit_run_inside_a_longer_number(stub): | CODE |
| LOW | tests/test_grounding.py | 358 | def test_run_executes_a_separated_number_grounded_in_the_query(stub): | CODE |
| LOW | tests/test_grounding.py | 369 | def test_run_refuses_a_number_absent_from_the_query(stub): | CODE |
| LOW | tests/test_grounding.py | 380 | def test_run_still_refuses_a_non_numeric_engine_flag(stub): | CODE |
| LOW | tests/test_grounding.py | 392 | def test_a_time_after_a_day_and_month_is_not_read_as_a_year(stub): | CODE |
| LOW | tests/test_grounding.py | 406 | def test_extract_accepts_a_date_followed_by_a_time(stub): | CODE |
| LOW | tests/test_generate.py | 7 | def test_parse_array_variants(): | CODE |
| LOW | tests/test_generate.py | 19 | def test_collect_tools_dedups_by_name(): | CODE |
| LOW | tests/test_generate.py | 27 | def test_generate_examples_attaches_tools(monkeypatch): | CODE |
| LOW | tests/test_generate.py | 39 | def test_generate_examples_requires_api_key(monkeypatch): | CODE |
| LOW | tests/test_generate.py | 47 | def test_openrouter_url_can_be_overridden_from_environment(monkeypatch): | CODE |
| LOW⚡ | tests/test_generate.py | 71 | def test_generate_dataset_hits_target_concurrently(monkeypatch): | CODE |
| LOW⚡ | tests/test_generate.py | 81 | def test_generate_dataset_dedups_and_terminates(monkeypatch): | CODE |
| LOW⚡ | tests/test_generate.py | 91 | def test_augment_jsonl_appends_generated(monkeypatch, tmp_path): | CODE |
| LOW | tests/test_environments.py | 23 | def test_registry_matches_modules(): | CODE |
| LOW | tests/test_environments.py | 38 | def test_cases_cover_all_categories(env): | CODE |
| LOW | tests/test_environments.py | 42 | def test_cases_match_declared_tools(env): | CODE |
| LOW⚡ | tests/test_environments.py | 159 | def test_one_critical_failure_fails_a_suite_that_clears_the_rate(stub): | CODE |
| 129 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | needle/_telemetry.py | 79 | except Exception: | CODE |
| HIGH | needle/__init__.py | 398 | except Exception: | CODE |
| HIGH | needle/cli.py | 87 | except Exception: | CODE |
| HIGH | needle/cli.py | 128 | except Exception: | CODE |
| HIGH | needle/_worker.py | 157 | except BaseException: | CODE |
| HIGH | needle/_worker.py | 267 | except BaseException: | CODE |
| HIGH | needle/_worker.py | 272 | except OSError: | CODE |
| HIGH | needle/agent/fetch.py | 91 | except OSError: | CODE |
| HIGH | needle/agent/fetch.py | 210 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | needle/_telemetry.py | 79 | except Exception: | CODE |
| LOW | needle/__init__.py | 158 | except Exception: | CODE |
| LOW | needle/__init__.py | 358 | except Exception as exc: | CODE |
| LOW | needle/__init__.py | 398 | except Exception: | CODE |
| MEDIUM | needle/__init__.py | 395 | def __del__(self): | CODE |
| LOW | needle/cli.py | 87 | except Exception: | CODE |
| LOW | needle/cli.py | 128 | except Exception: | CODE |
| LOW | needle/playground/server.py | 93 | except Exception as exc: | CODE |
| LOW | needle/playground/server.py | 168 | except Exception as exc: | CODE |
| MEDIUM | needle/playground/server.py | 132 | def do_POST(self): | CODE |
| LOW | needle/agent/fetch.py | 181 | except Exception: | CODE |
| LOW | needle/agent/fetch.py | 210 | except Exception: | CODE |
| MEDIUM | needle/agent/fetch.py | 190 | def engine_repo(generation=2): | CODE |
| LOW | needle/agent/tools.py | 142 | except Exception: | CODE |
| LOW | needle/model/tokenizer.py | 120 | except Exception as e: | CODE |
| LOW | needle/model/finetune.py | 138 | except Exception as exc: | CODE |
| LOW | tests/conftest.py | 32 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | needle/__init__.py | 529 | CODE | |
| LOW | needle/__init__.py | 248 | CODE | |
| LOW | needle/platform.py | 207 | CODE | |
| LOW | needle/cli.py | 62 | CODE | |
| LOW | needle/cli.py | 141 | CODE | |
| LOW | needle/cli.py | 98 | CODE | |
| LOW | needle/_worker.py | 70 | CODE | |
| LOW | needle/playground/server.py | 113 | CODE | |
| LOW | needle/playground/server.py | 132 | CODE | |
| LOW | needle/agent/whistle.py | 355 | CODE | |
| LOW | needle/agent/whistle.py | 446 | CODE | |
| LOW | needle/model/export.py | 341 | CODE | |
| LOW | needle/model/export.py | 457 | CODE | |
| LOW | needle/model/architecture.py | 199 | CODE | |
| LOW | needle/model/architecture.py | 266 | CODE | |
| LOW | needle/model/finetune.py | 106 | CODE | |
| LOW | tests/test_environments.py | 42 | CODE | |
| LOW | tests/test_platform.py | 31 | CODE | |
| LOW | tests/test_platform.py | 75 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | needle/_telemetry.py | 1 | CODE | |
| LOW | needle/__init__.py | 1 | CODE | |
| LOW | needle/__init__.py | 11 | CODE | |
| LOW | needle/__init__.py | 14 | CODE | |
| LOW | needle/__init__.py | 14 | CODE | |
| LOW | needle/__init__.py | 14 | CODE | |
| LOW | needle/platform.py | 1 | CODE | |
| LOW | needle/_worker.py | 1 | CODE | |
| LOW | needle/agent/whistle.py | 1 | CODE | |
| LOW | tests/test_packaging.py | 1 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_run.py | 7 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/test_run.py | 10 | # --------------------------------------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/test_worker.py | 36 | if (!data || size < 6 || data[4] == 0) return -1; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | needle/__init__.py | 17 | __all__ = ["Needle", "Whistle", "ExtractionValidationError", "tool", "Field", "extract", | CODE |
| LOW | needle/environments/__init__.py | 21 | __all__ = ["ENVIRONMENTS", "run_tests", *_NAMES] | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | needle/__init__.py | 189 | CODE | |
| LOW | needle/agent/tools.py | 19 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | needle/environments/data_capture.py | 87 | {'query': 'save Leo Park to contacts, phone 555-0134', 'calls': [{'name': 'create_contact', 'arguments': {'name': 'L | CODE |
| LOW | tests/test_grounding.py | 72 | return {"vendor": "Acme Corp", "total": total, "due_date": due_date} | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/test_whistle.py | 416 | CODE |