AI Slop Code Risk Monitor

carthage-software/mago

SlopCodeMonitor badge for carthage-software/mago Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Mago is a toolchain for PHP that aims to provide a set of tools to help developers write better code.

1.8 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for carthage-software/mago, a Rust project with 3,541 GitHub stars. SynthScan examined 706,854 lines of code across 6042 source files, recording 1214 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 1.8 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.8
Adjusted Signal
1.8
Raw Pattern Score
100%
Time Factor
2026-10-29
Last Push
3.5K
Stars
Rust
Language
706.9K
Lines of Code
6.0K
Files
1.2K
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1203 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 11 finding(s).

Agent Over-Engineering Ratio 3.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 460 finding(s).

PR Review Velocity Impact 8.3/100 · LOW

Which changes need focused human review? 1214 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 2LOW 1211

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1214 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block728 hits · 706 pts
SeverityFileLineSnippetContext
LOWcrates/database/src/error.rs21 /// An attempt was made to commit or consume a `ChangeLog` while otherCOMMENT
LOWcrates/database/src/matcher.rs1//! Path exclusion matching with mixed glob + prefix semantics.COMMENT
LOWcrates/database/src/matcher.rs121COMMENT
LOWcrates/database/src/lib.rs1#![allow(clippy::exhaustive_enums)]COMMENT
LOWcrates/database/src/lib.rs21//! - **Change Tracking**: Record and batch apply file modifications via [`ChangeLog`]COMMENT
LOWcrates/database/src/lib.rs41//!COMMENT
LOWcrates/database/src/lib.rs121#[derive(Debug, Clone, Copy)]COMMENT
LOWcrates/database/src/lib.rs341 /// # ArgumentsCOMMENT
LOWcrates/database/src/lib.rs421 files: Vec::new(),COMMENT
LOWcrates/database/src/lib.rs461 .filter_map(|(index, file)| file.path.as_ref().map(|path| (path.clone(), index)))COMMENT
LOWcrates/database/src/lib.rs481 fn get(&self, id: &FileId) -> Result<Arc<File>, DatabaseError>;COMMENT
LOWcrates/database/src/change.rs61 /// Records a request to update an existing file's content by its `FileId`.COMMENT
LOWcrates/database/src/change.rs101 }COMMENT
LOWcrates/database/src/watcher.rs241 self.patch_base_paths.clear();COMMENT
LOWcrates/database/src/watcher.rs361 if changed_files.is_empty() { None } else { Some(changed_files) }COMMENT
LOWcrates/database/src/loader.rs101 pub fn add_memory_source(&mut self, name: &'static str, contents: &'static str, file_type: FileType) {COMMENT
LOWcrates/database/src/exclusion.rs1//! File and directory exclusion patterns for database loading.COMMENT
LOWcrates/database/src/exclusion.rs21COMMENT
LOWcrates/database/src/exclusion.rs41///COMMENT
LOWcrates/database/src/exclusion.rs61#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]COMMENT
LOWcrates/database/src/utils.rs41#[inline]COMMENT
LOWcrates/database/src/file.rs21/// Distinguishes between the origins of source files.COMMENT
LOWcrates/database/src/file.rs41 /// PHPDoc flags for vendored or built-in code.COMMENT
LOWcrates/database/src/file.rs101 let id = FileId::new(&name);COMMENT
LOWcrates/database/src/file.rs121 ///COMMENT
LOWcrates/database/src/file.rs141 /// # ParametersCOMMENT
LOWcrates/database/src/file.rs161 ///COMMENT
LOWcrates/database/src/file.rs181 match self.lines.get(line as usize + 1) {COMMENT
LOWcrates/reporting/src/reporter.rs41 ///COMMENT
LOWcrates/reporting/src/reporter.rs101 pub fn new(database: ReadDatabase, config: ReporterConfig) -> Self {COMMENT
LOWcrates/reporting/src/reporter.rs201 /// # ErrorsCOMMENT
LOWcrates/reporting/src/error.rs1//! Error types for the reporting crate.COMMENT
LOWcrates/reporting/src/color.rs1/// Choice for colorizing output.COMMENT
LOWcrates/reporting/src/lib.rs1#![allow(clippy::pub_use, clippy::exhaustive_enums)]COMMENT
LOWcrates/reporting/src/lib.rs61/// `{ pattern = "Symfony", code = "mixed-assignment" }`.COMMENT
LOWcrates/reporting/src/lib.rs161}COMMENT
LOWcrates/reporting/src/lib.rs381 pub fn len(&self) -> usize {COMMENT
LOWcrates/reporting/src/lib.rs401 /// let annotation = Annotation::new(AnnotationKind::Primary, span);COMMENT
LOWcrates/reporting/src/lib.rs421 /// let span = Span::new(file, start, end);COMMENT
LOWcrates/reporting/src/lib.rs441 /// let end = Position::new(5);COMMENT
LOWcrates/reporting/src/lib.rs481 /// Downgrades the level to the next lower severity.COMMENT
LOWcrates/reporting/src/lib.rs541 ///COMMENT
LOWcrates/reporting/src/lib.rs561 /// ```COMMENT
LOWcrates/reporting/src/lib.rs581 /// # ExamplesCOMMENT
LOWcrates/reporting/src/lib.rs601 #[must_use]COMMENT
LOWcrates/reporting/src/lib.rs681 /// # ExamplesCOMMENT
LOWcrates/reporting/src/baseline.rs1//! Baseline functionality for filtering known issues.COMMENT
LOWcrates/reporting/src/baseline.rs41}COMMENT
LOWcrates/reporting/src/baseline.rs81/// File paths are stored in a normalized format (using forward slashes)COMMENT
LOWcrates/reporting/src/output.rs1use std::io;COMMENT
LOWcrates/reporting/src/formatter/mod.rs41 /// Example: `"phpstorm://open?file=%file%&line=%line%"`COMMENT
LOWcrates/reporting/src/formatter/mod.rs81 /// GitHub Actions format.COMMENT
LOWcrates/reporting/src/formatter/utils.rs201/// Returns a borrowing iterator over the issues that pass the formatter'sCOMMENT
LOWcrates/twig-syntax/tests/fixture_runner.rs1#![allow(clippy::unwrap_used, clippy::expect_used, clippy::else_if_without_else)]COMMENT
LOWcrates/twig-syntax/src/macros.rs1//! `T![...]` - ergonomic matching against [`TwigTokenKind`](crate::token::TwigTokenKind).COMMENT
LOWcrates/twig-syntax/src/settings.rs1/// Settings for the Twig lexer.COMMENT
LOWcrates/twig-syntax/src/cst/mod.rs1//! CST types for Twig templates.COMMENT
LOWcrates/twig-syntax/src/cst/trivia.rs1use strum::Display;COMMENT
LOWcrates/twig-syntax/src/cst/statement/mod.rs61/// level: raw template text, `{{ expr }}` prints, `{% verbatim %}` blocks,COMMENT
LOWcrates/twig-syntax/src/lexer/mod.rs1//! Stateful lexer for Twig templates.COMMENT
668 more matches not shown…
Hyper-Verbose Identifiers460 hits · 516 pts
SeverityFileLineSnippetContext
LOW…es/linter/src/rule/safety/no_service_state_mutation.rs832 public function getAndIncrement(): intCODE
LOW…es/linter/src/rule/safety/no_service_state_mutation.rs854 public function getOrSet(int $default): intCODE
LOW…ency_arrow_fn_returns_keyed_array_with_call/before.php5 protected function getOriginalWithoutRewindingModel($key = null, $default = null)CODE
LOW…tency_arrow_fn_returns_keyed_array_with_call/after.php5 protected function getOriginalWithoutRewindingModel($key = null, $default = null)CODE
LOW…ses/idempotent_chain_with_complex_arguments/before.php43 public function testChainWithExpandedArray()CODE
LOW…ases/idempotent_chain_with_complex_arguments/after.php42 public function testChainWithExpandedArray()CODE
LOW…mpotency_corpus_apiplatform_schema_property/before.php557 private function addNullabilityToTypeDefinition(array $jsonSchema, LegacyType $type): arrayCODE
LOW…empotency_corpus_apiplatform_schema_property/after.php643 private function addNullabilityToTypeDefinition(array $jsonSchema, LegacyType $type): arrayCODE
LOW…ates/formatter/tests/cases/issue_428_part_3/before.php6 private function initializeResponseFactory(): ResponseFactoryInterfaceCODE
LOWcrates/formatter/tests/cases/issue_428_part_3/after.php5 private function initializeResponseFactory(): ResponseFactoryInterfaceCODE
LOWcrates/formatter/tests/cases/match_breaking/before.php5 private function getStubFileFromConfigType(ConfigType $configType): StubFileCODE
LOWcrates/formatter/tests/cases/match_breaking/after.php5 private function getStubFileFromConfigType(ConfigType $configType): StubFileCODE
LOW…ests/cases/idempotency_corpus_carbon_period/before.php2508 protected function incrementCurrentDateUntilValid(): voidCODE
LOW…tests/cases/idempotency_corpus_carbon_period/after.php2526 protected function incrementCurrentDateUntilValid(): voidCODE
LOWcrates/formatter/tests/cases/issue_1806/before.php18 public function veryLongFunctionSignature(int $param1, int $param2, int $param3, int $param4): voidCODE
LOWcrates/formatter/tests/cases/issue_1806/after.php19 public function veryLongFunctionSignature(CODE
LOWcrates/formatter/tests/cases/psl_regressions/before.php27 public function testTypedThrowsWhenUnableToCoerce(): voidCODE
LOWcrates/formatter/tests/cases/psl_regressions/after.php30 public function testTypedThrowsWhenUnableToCoerce(): voidCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php36function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php44function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php48function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php53function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php67 function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php76 function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php83 function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/before.php90 function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php42function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php50function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php56function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php62function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameeeeeeeeeeeeCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php74 public function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php82 public function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php88 public function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameCODE
LOW⚡crates/formatter/tests/cases/break_fn_args/after.php94 public function superLoooooooooooooooooooooooooooooooooooooooooooooooooooooongFuuuuuuuuuuuuuuuctioooooooooooooonNameCODE
LOWcrates/formatter/tests/cases/issue_1153/before.php8 private function createSingleCursorPagination( // @phpstan-ignore-lineCODE
LOWcrates/formatter/tests/cases/issue_1153/after.php10 private function createSingleCursorPagination( // @phpstan-ignore-lineCODE
LOW…idempotency_corpus_apiplatform_type_factory/before.php185 private function addNullabilityToTypeDefinition(array $jsonSchema, LegacyType|NativeType $type): arrayCODE
LOW…/idempotency_corpus_apiplatform_type_factory/after.php188 private function addNullabilityToTypeDefinition(array $jsonSchema, LegacyType|NativeType $type): arrayCODE
LOW⚡crates/prelude/assets/extensions/zip.php327 public function setExternalAttributesName(string $name, int $opsys, int $attr, int $flags = null): bool {}CODE
LOW⚡crates/prelude/assets/extensions/zip.php329 public function getExternalAttributesName(string $name, int &$opsys, int &$attr, int $flags = null): bool {}CODE
LOW⚡crates/prelude/assets/extensions/zip.php331 public function setExternalAttributesIndex(int $index, int $opsys, int $attr, int $flags = null): bool {}CODE
LOW⚡crates/prelude/assets/extensions/zip.php333 public function getExternalAttributesIndex(int $index, int &$opsys, int &$attr, int $flags = null): bool {}CODE
LOW⚡crates/prelude/assets/extensions/zip.php335 public static function isEncryptionMethodSupported(int $method, bool $enc = true): bool {}CODE
LOW⚡crates/prelude/assets/extensions/zip.php337 public static function isCompressionMethodSupported(int $method, bool $enc = true): bool {}CODE
LOWcrates/prelude/assets/extensions/aerospike.php1003 public static function predicateGeoContainsGeoJSONPoint($bin, $point) {}CODE
LOWcrates/prelude/assets/extensions/aerospike.php1014 public static function predicateGeoContainsPoint($bin, $long, $lat) {}CODE
LOWcrates/prelude/assets/extensions/aerospike.php1024 public static function predicateGeoWithinGeoJSONRegion($bin, $region) {}CODE
LOWcrates/prelude/assets/extensions/rdkafka.php744 public function oauthbearerSetTokenFailure(string $error): void {}CODE
LOWcrates/prelude/assets/extensions/rdkafka.php821 public function setOauthbearerTokenRefreshCb(callable $callback): void {}CODE
LOWcrates/prelude/assets/extensions/rdkafka.php1066 public function oauthbearerSetTokenFailure(string $error): void {}CODE
LOWcrates/prelude/assets/extensions/oauth.php291 public function callTimestampNonceHandler() {}CODE
LOWcrates/prelude/assets/extensions/reflection.php638 public function setRawValueWithoutLazyInitialization(object $object, mixed $value): void {}CODE
LOWcrates/prelude/assets/extensions/reflection.php820 public function getDefaultValueConstantName(): ?string {}CODE
LOWcrates/prelude/assets/extensions/reflection.php947 public function getNumberOfRequiredParameters(): int {}CODE
LOWcrates/prelude/assets/extensions/reflection.php1439 public function newInstanceWithoutConstructor(): object {}CODE
LOWcrates/prelude/assets/extensions/reflection.php1567 public function isUninitializedLazyObject(object $object): bool {}CODE
LOWcrates/prelude/assets/extensions/reflection.php1573 public function markLazyObjectAsInitialized(object $object): object {}CODE
LOWcrates/prelude/assets/extensions/intl.php870 public static function getKeywordValuesForLocale(CODE
LOWcrates/prelude/assets/extensions/intl.php898 public function getMinimalDaysInFirstWeek(): int|false {}CODE
LOWcrates/prelude/assets/extensions/intl.php912 public function getRepeatedWallTimeOption(): int {}CODE
400 more matches not shown…
Fake / Example Data11 hits · 11 pts
SeverityFileLineSnippetContext
LOWcrates/fingerprint/src/argument.rs144 "placeholder".hash(hasher);CODE
LOW…ter/src/rule/correctness/no_missing_format_argument.rs149 if parsed.placeholder_count == 1 { "placeholder" } else { "placeholders" },CODE
LOW…/formatter/tests/cases/symfony_form_builder/before.php53 'placeholder' => 'No document',CODE
LOW…s/formatter/tests/cases/symfony_form_builder/after.php59 'placeholder' => 'No document',CODE
LOWcrates/formatter/tests/cases/issue_1149/before.php6 'placeholder',CODE
LOWcrates/formatter/tests/cases/issue_1149/after.php5 'placeholder',CODE
LOWcrates/analyzer/tests/cases/mutually_exclusive_null.php64 $corp = createPersonEntity(companyName: 'Acme Inc');CODE
LOW…s/analyzer/tests/cases/complex_template_constraint.php62 'name' => 'John Doe',CODE
LOWcrates/analyzer/src/utils/php_emulation.rs279 assert_eq!(str_increment("user@example.com"), None);CODE
LOWcrates/analyzer/src/expression/instantiation.rs701 $collection = new Collection(['name' => 'John Doe']);CODE
LOWcrates/analyzer/src/expression/assignment/mod.rs1490 'name' => 'John Doe',CODE
Verbosity Indicators6 hits · 10 pts
SeverityFileLineSnippetContext
LOWcrates/analyzer/src/invocation/post_process.rs1484 // Step 1: Ensure we have both the name and offset for the parameter.COMMENT
LOWcrates/analyzer/src/invocation/post_process.rs1504 // Step 2: Resolve the argument with the correct precedence.COMMENT
LOW…/src/reconciler/simple_negated_assertion_reconciler.rs1635 // Step 4: Convert remaining combinations to TList objectsCOMMENT
LOW⚡src/commands/init.rs621 // Step 1: Plugin detection/selectionCOMMENT
LOW⚡src/commands/init.rs624 // Step 2: Strictness preset selectionCOMMENT
LOWsrc/commands/init.rs645 // Step 3: Optional customizationCOMMENT
Structural Annotation Overuse6 hits · 10 pts
SeverityFileLineSnippetContext
LOWcrates/analyzer/src/invocation/post_process.rs1484 // Step 1: Ensure we have both the name and offset for the parameter.COMMENT
LOWcrates/analyzer/src/invocation/post_process.rs1504 // Step 2: Resolve the argument with the correct precedence.COMMENT
LOW…/src/reconciler/simple_negated_assertion_reconciler.rs1635 // Step 4: Convert remaining combinations to TList objectsCOMMENT
LOW⚡src/commands/init.rs621 // Step 1: Plugin detection/selectionCOMMENT
LOW⚡src/commands/init.rs624 // Step 2: Strictness preset selectionCOMMENT
LOWsrc/commands/init.rs645 // Step 3: Optional customizationCOMMENT
Synthetic Comment Markers1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHcrates/codex/src/ttype/atomic/reference/mod.rs80 /// Kept original name `type_params` as requested for fields.COMMENT
AI Slop Vocabulary2 hits · 5 pts
SeverityFileLineSnippetContext
MEDIUMcrates/analyzer/src/context/mod.rs151 /// accounting for PHP's nuanced resolution rules:COMMENT
MEDIUMcrates/analyzer/src/expression/call/function_call.rs603 main_list_can_be_empty([]); // Definitely emptyCODE