Home / capnproto / capnproto
AI Slop Code RIsk Monitor

capnproto/capnproto

Cap'n Proto serialization/RPC system - core tools and C++ library

6.8 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for capnproto/capnproto, a C++ project with 13,213 GitHub stars. SynthScan examined 88,662 lines of code across 212 source files, recording 613 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 6.8 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

6.8
Adjusted Signal
6.8
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
13.2K
Stars
C++
Language
88.7K
Lines of Code
212
Files
613
Pattern Hits
2026-10-12
Scan Date
0.00
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 27.2/100 · MEDIUM

Can maintainers explain intent, assumptions, and trade-offs? 596 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.5/100 · LOW

Are imports declared and package/API names verified? 7 finding(s).

Agent Over-Engineering Ratio 1.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 10 finding(s).

PR Review Velocity Impact 30.5/100 · MEDIUM

Which changes need focused human review? 613 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 16LOW 597

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 613 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block586 hits · 540 pts
SeverityFileLineSnippetContext
LOWmega-test.py1#! /usr/bin/env pythonCOMMENT
LOWsuper-test.sh421COMMENT
LOWc++/CMakeLists.txt141COMMENT
LOWc++/ekam-build.sh61# errors in the benchmarks directory. Note that it's tricky to link against an installed copyCOMMENT
LOWc++/samples/CMakeLists.txt1# A Cap'n Proto sample project.COMMENT
LOWc++/src/benchmark/capnproto-common.h1// Copyright (c) 2013-2014 Sandstorm Development Group, Inc. and contributorsCOMMENT
LOWc++/src/benchmark/capnproto-common.h21COMMENT
LOWc++/src/benchmark/null-common.h1// Copyright (c) 2013-2014 Sandstorm Development Group, Inc. and contributorsCOMMENT
LOWc++/src/benchmark/protobuf-common.h1// Copyright (c) 2013-2014 Sandstorm Development Group, Inc. and contributorsCOMMENT
LOWc++/src/benchmark/common.h1// Copyright (c) 2013-2014 Sandstorm Development Group, Inc. and contributorsCOMMENT
LOWc++/src/benchmark/common.h21COMMENT
LOWc++/src/kj/time.h1// Copyright (c) 2014 Google Inc. (contributed by Remy Blank <rblank@google.com>)COMMENT
LOWc++/src/kj/time.h81 // cannot be used to determine the current calendar date.COMMENT
LOWc++/src/kj/time.h101// a reasonable operating system the difference is usually negligible.COMMENT
LOWc++/src/kj/main.h1// Copyright (c) 2013-2014 Sandstorm Development Group, Inc. and contributorsCOMMENT
LOWc++/src/kj/main.h41 KJ_NORETURN(virtual void exit()) = 0;COMMENT
LOWc++/src/kj/main.h61 // easy for commands to explicitly ensure all output is flushed before exiting, and it isCOMMENT
LOWc++/src/kj/main.h81 // it could crash, the OS could decide to kill it off, or the machine it is running on couldCOMMENT
LOWc++/src/kj/main.h101 // has no state anyway.COMMENT
LOWc++/src/kj/main.h161 mutable std::atomic_bool hadErrors = false;COMMENT
LOWc++/src/kj/main.h181 MainClass mainObject(context); \COMMENT
LOWc++/src/kj/main.h201 // information you provide to the builder as you define each flag.COMMENT
LOWc++/src/kj/main.h221 // return "Output file must have extension .foo.";COMMENT
LOWc++/src/kj/main.h301 // builder.addOption({'a', "all"}, KJ_BIND_METHOD(*this, showAll), "Show all files.");COMMENT
LOWc++/src/kj/main.h321 // Like `addOption()`, but adds an option which accepts an argument. `argumentTitle` is used inCOMMENT
LOWc++/src/kj/main.h341 //COMMENT
LOWc++/src/kj/main.h361 MainBuilder& expectZeroOrMoreArgs(StringPtr title, Function<Validity(StringPtr)> callback);COMMENT
LOWc++/src/kj/main.h381 // builder.expectArg("<baz>", ...);COMMENT
LOWc++/src/kj/async-coroutine-alloc.h1// Copyright (c) 2026 Cloudflare, Inc. and contributorsCOMMENT
LOWc++/src/kj/filesystem.h1// Copyright (c) 2015 Sandstorm Development Group, Inc. and contributorsCOMMENT
LOWc++/src/kj/filesystem.h41COMMENT
LOWc++/src/kj/filesystem.h61 // and then would have interpreted ".." relative to that. In practice, the kernel's behavior isCOMMENT
LOWc++/src/kj/filesystem.h101 // is NOT accepted -- if that is a problem, you probably want `eval()`. Trailing '/'s areCOMMENT
LOWc++/src/kj/filesystem.h121COMMENT
LOWc++/src/kj/filesystem.h181 // - Backslashes can be used as path separators.COMMENT
LOWc++/src/kj/filesystem.h201 // This throws if the path would have unexpected special meaning or is otherwise invalid onCOMMENT
LOWc++/src/kj/filesystem.h301//COMMENT
LOWc++/src/kj/filesystem.h361 // Hint which can be used to determine if two FsNode instances point to the same underlyingCOMMENT
LOWc++/src/kj/filesystem.h381 // Not currently included:COMMENT
LOWc++/src/kj/filesystem.h421 virtual Array<const byte> mmap(uint64_t offset, uint64_t size) const = 0;COMMENT
LOWc++/src/kj/filesystem.h461 // Notifies the implementation that the given bytes have changed. For some implementations thisCOMMENT
LOWc++/src/kj/filesystem.h501 virtual Own<const WritableFileMapping> mmapWritable(uint64_t offset, uint64_t size) const = 0;COMMENT
LOWc++/src/kj/filesystem.h541 // filesystems, this is just as fast as listNames(), but on others it may require stat()ing eachCOMMENT
LOWc++/src/kj/filesystem.h561COMMENT
LOWc++/src/kj/filesystem.h581COMMENT
LOWc++/src/kj/filesystem.h601 // At least one of CREATE or MODIFY must be specified. Optionally, the two flags can be combinedCOMMENT
LOWc++/src/kj/filesystem.h621 // been specified at all. If the path refers to a broken symlink, the file at the target of theCOMMENT
LOWc++/src/kj/filesystem.h681 //COMMENT
LOWc++/src/kj/filesystem.h701 // all), so the KJ filesystem implementation is forced to remember the full path and needs toCOMMENT
LOWc++/src/kj/filesystem.h721 // is atomically moved to its final path when you call `commit()`. If you destroy the ReplacerCOMMENT
LOWc++/src/kj/filesystem.h741 // Commit the replacement.COMMENT
LOWc++/src/kj/filesystem.h761 // what it claims. Some examples of possible problems include:COMMENT
LOWc++/src/kj/filesystem.h801 // is there already. See `Replacer<T>` for details.COMMENT
LOWc++/src/kj/filesystem.h821COMMENT
LOWc++/src/kj/filesystem.h861 //COMMENT
LOWc++/src/kj/filesystem.h881 // everything at the destination. This race condition is not present in the UnixCOMMENT
LOWc++/src/kj/filesystem.h901};COMMENT
LOWc++/src/kj/filesystem.h941#if __linux__COMMENT
LOWc++/src/kj/filesystem.h961// - The backing store is not sparse and never gets smaller even if you truncate the file.COMMENT
LOWc++/src/kj/sticky-flag.h1// Copyright (c) 2026 Cloudflare, Inc. and contributorsCOMMENT
526 more matches not shown…
Decorative Section Separators10 hits · 30 pts
SeverityFileLineSnippetContext
MEDIUMrelease.sh166 # ======================================================================================COMMENT
MEDIUMrelease.sh202 # ======================================================================================COMMENT
MEDIUMrelease.sh244 # ======================================================================================COMMENT
MEDIUMrelease.sh280 # ======================================================================================COMMENT
MEDIUMrelease.sh313 # ======================================================================================COMMENT
MEDIUMrelease.sh341 # ======================================================================================COMMENT
MEDIUMrelease.sh347 # ======================================================================================COMMENT
MEDIUMc++/src/capnp/compiler/capnp-test.sh52# ========================================================================================COMMENT
MEDIUMc++/src/capnp/compiler/capnp-test.sh87# ========================================================================================COMMENT
MEDIUMc++/src/capnp/compiler/capnp-test.sh105# ========================================================================================COMMENT
AI Slop Vocabulary5 hits · 15 pts
SeverityFileLineSnippetContext
MEDIUMc++/src/kj/common.h855// that type. This is useful to use as e.g. a parameter to a function because it will be robustCOMMENT
MEDIUMc++/src/kj/common.h860// of that type. This is useful to use as e.g. a parameter to a function because it will be robustCOMMENT
MEDIUMc++/src/kj/async-inl.h158 // potentially other objects that commonly live on the end of a promise chain can also leverageCOMMENT
MEDIUMc++/src/kj/async-inl.h1645 // to a dangling pointer. Essentially, WeakFulfiller is reference counted, although theCOMMENT
MEDIUMc++/src/capnp/serialize-text.h38 // This format is useful for debugging or human input, but it is not a robust alternativeCOMMENT
Fake / Example Data6 hits · 8 pts
SeverityFileLineSnippetContext
LOW⚡doc/cxx.md69 alicePhones[0].setNumber("555-1212");CODE
LOW⚡doc/cxx.md78 bobPhones[0].setNumber("555-4567");CODE
LOW⚡doc/cxx.md80 bobPhones[1].setNumber("555-7654");CODE
LOWdoc/cxx.md523 phone0.set("number", "555-1212");CODE
LOWdoc/cxx.md537 bobPhones[0].setNumber("555-4567");CODE
LOWdoc/cxx.md539 bobPhones[1].setNumber("555-7654");CODE
Example Usage Blocks2 hits · 3 pts
SeverityFileLineSnippetContext
LOWc++/src/kj/main.h205 // Example usage:COMMENT
LOWc++/src/kj/async.h431// Example usage:COMMENT
Modern AI Meta-Vocabulary1 hit · 2 pts
SeverityFileLineSnippetContext
MEDIUMdoc/cxxrpc.md27Cap'n Proto's RPC is based on the [KJ library](cxx.html#kj-library)'s event-driven concurrencyCODE
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWc++/src/kj/array.h417 // TODO: implement for complex T types without creating `size` instances first.COMMENT
Slop Phrases1 hit · 1 pts
SeverityFileLineSnippetContext
LOWrelease.sh113 echo "Don't forget to push changes:"CODE
Unused Imports1 hit · 1 pts
SeverityFileLineSnippetContext
LOWdoc/_plugins/capnp_lexer.py4CODE