Multi-account API gateway for Grok Build, Grok Web, and Grok Console
This report summarizes scanner evidence for chenyme/grok2api, a Go project with 7,874 GitHub stars. SynthScan examined 209,349 lines of code across 614 source files, recording 152 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 0.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 107 finding(s).
Are imports declared and package/API names verified? 19 finding(s).
Are wrappers, guards, and repeated structures necessary? 115 finding(s).
Which changes need focused human review? 152 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 152 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 59 | def test_passive_speed_matches_panel_and_includes_reasoning_tokens(self): | CODE |
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 69 | def test_passive_late_first_token_uses_full_duration(self): | CODE |
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 79 | def test_passive_late_first_token_without_reasoning_remains_burst(self): | CODE |
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 89 | def test_passive_audit_does_not_infer_thinking_requirement(self): | CODE |
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 276 | def test_disabled_bootstrap_exits_cleanly(self): | CODE |
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 283 | def test_rejects_reversed_thresholds(self): | CODE |
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 287 | def test_runtime_config_overrides_only_strategy_fields(self): | CODE |
| LOW⚡ | tools/egress-quality-guard/quality_guard_test.py | 296 | def test_runtime_config_reloader_keeps_last_valid_config(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 40 | def test_healthy_soft_and_hard_thresholds(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 46 | def test_missing_marker_is_hard_and_quality_ok_is_not_a_healthy_shortcut(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 104 | def test_probe_missing_thinking_is_hard(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 150 | def test_passive_ignores_short_and_failed_requests(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 159 | def test_state_write_is_atomic_and_private(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 173 | def test_missing_profile_file_seeds_builtin_recovery_profiles(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 180 | def test_reserved_profile_ids_are_canonicalized(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 213 | def test_loads_private_bootstrap_without_admin_credentials(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 312 | def test_list_nodes_reads_every_page(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 328 | def test_list_nodes_rejects_incomplete_pagination(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 334 | def test_fixed_fallback_nodes_are_discovered_from_operations_policy(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 345 | def test_list_leases_uses_stable_cursor_until_complete(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 361 | def test_list_leases_rejects_non_advancing_cursor(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 442 | def test_hard_signal_quarantines_and_healthy_recovery_restores(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 467 | def test_auto_discovery_publishes_resolved_node_ids_for_status_consumers(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 478 | def test_fixed_fallback_node_is_excluded_without_aborting_other_nodes(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 492 | def test_fixed_fallback_releases_existing_account_lease_without_probe(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 509 | def test_account_bound_proxy_skips_scheduled_probe_and_stays_observable(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 528 | def test_account_bound_proxy_records_passive_anomaly_without_node_quarantine(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 564 | def test_repeated_account_anomaly_extends_one_lease_without_double_counting(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 581 | def test_due_lease_recovery_has_a_per_cycle_budget(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 601 | def test_failed_lease_recovery_is_backed_off(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 619 | def test_account_bound_proxy_releases_only_guard_owned_legacy_quarantine(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 646 | def test_account_bound_proxy_keeps_ownership_when_legacy_release_fails(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 668 | def test_enabled_node_promoted_to_fixed_fallback_releases_guard_ownership(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 688 | def test_quarantine_ownership_is_persisted_before_backend_disable(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 711 | def test_quarantine_state_rolls_back_when_backend_disable_fails(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 735 | def test_removed_or_unmanaged_node_state_is_pruned(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 751 | def test_quarantined_node_removed_from_config_is_recovered_before_release(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 771 | def test_minimum_healthy_nodes_suppresses_quarantine(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 786 | def test_fail_closed_rotates_soft_signal_and_restores_after_one_good_probe(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 815 | def test_fail_closed_requires_consecutive_probe_errors_then_rotates(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 854 | def test_probe_without_schedulable_account_is_deferred_without_rotation(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 890 | def test_fail_closed_buffered_burst_restores_same_ip_after_one_good_probe(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 918 | def test_fail_closed_keeps_node_isolated_when_rotated_ip_probe_is_ambiguous(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 943 | def test_fail_closed_manual_reenable_requires_probe(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 967 | def test_model_probe_can_restore_when_generic_connectivity_probe_is_unhealthy(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 982 | def test_passive_baseline_does_not_replay_historical_audits(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 993 | def test_passive_hard_signal_quarantines_immediately_and_ignores_guard_key(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1018 | def test_passive_soft_signal_quarantines_immediately_without_probe(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1032 | def test_passive_soft_signal_holds_until_quarantine_window(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1050 | def test_multiple_passive_hard_signals_only_quarantine_once(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1064 | def test_passive_hold_restores_only_after_healthy_probe(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1091 | def test_recovery_always_uses_builtin_quality_marker_profile(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1122 | def test_passive_hold_keeps_isolated_when_recovery_probe_is_unhealthy(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1151 | def test_repeat_passive_degrade_lengthens_hold(self): | CODE |
| LOW | tools/egress-quality-guard/quality_guard_test.py | 1188 | def test_passive_user_anomaly_quarantines_without_waiting_for_probe(self): | CODE |
| LOW | tools/egress-quality-guard/session_rotator_test.py | 17 | def test_replaces_only_selected_proxy_username(self): | CODE |
| LOW | tools/egress-quality-guard/session_rotator_test.py | 35 | def test_update_session_sets_new_sid_and_ten_minute_stickiness(self): | STRING |
| LOW | tools/egress-quality-guard/session_rotator_test.py | 69 | def test_rotation_compares_against_live_pre_rotation_ip(self): | STRING |
| LOW | tools/egress-quality-guard/session_rotator_test.py | 91 | def test_rotation_reports_live_old_ip_when_it_changes(self): | STRING |
| LOW | tools/egress-quality-guard/session_rotator.py | 97 | def replace_username_in_mihomo(value: str, proxy_index: int, username: str) -> str: | CODE |
| 29 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tools/egress-quality-guard/session_rotator.py | 299 | except KeyboardInterrupt: | CODE |
| HIGH | tools/egress-quality-guard/session_rotator.py | 234 | except Exception: | CODE |
| HIGH | tools/egress-quality-guard/quality_guard.py | 486 | except FileNotFoundError: | CODE |
| HIGH | tools/egress-quality-guard/quality_guard.py | 488 | except (OSError, ValueError): | CODE |
| HIGH | tools/egress-quality-guard/quality_guard.py | 655 | except FileNotFoundError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/egress-quality-guard/session_rotator.py | 166 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/session_rotator.py | 229 | except Exception: | CODE |
| LOW | tools/egress-quality-guard/session_rotator.py | 234 | except Exception: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 652 | except Exception: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 815 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 840 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 862 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 883 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 902 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 958 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1020 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1055 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1121 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1151 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1174 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1182 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1289 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1620 | except Exception as exc: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 1626 | except Exception as exc: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …d/internal/infra/provider/web/account_identity_test.go | 67 | identity, err := parseAccountIdentity([]byte(`{"status":"authenticated","session":{"userId":"user-1","email":"user@exam | CODE |
| LOW | …d/internal/infra/provider/web/account_identity_test.go | 71 | if identity.UserID != "user-1" || identity.Email != "user@example.com" || identity.TeamID != "org-1" { | CODE |
| LOW | …d/internal/infra/provider/web/account_identity_test.go | 85 | _, _ = writer.Write([]byte(`{"status":"authenticated","session":{"userId":"` + sessionUserID + `","email":"user@exampl | CODE |
| LOW | backend/internal/infra/provider/cli/adapter_test.go | 662 | if request.Header.Get("x-userid") != "user-123" || request.Header.Get("x-email") != "user@example.com" || request.Head | CODE |
| LOW | backend/internal/infra/provider/cli/adapter_test.go | 667 | models, err := adapter.ListModels(context.Background(), account.Credential{UserID: "user-123", Email: "user@example.com | CODE |
| LOW | backend/internal/infra/provider/cli/oauth_test.go | 26 | idToken := "header." + base64.RawURLEncoding.EncodeToString([]byte(`{"sub":"user-1","email":"user@example.com","team_id | CODE |
| LOW | backend/internal/infra/provider/cli/oauth_test.go | 46 | if prepared.AccessToken != "fresh-access" || prepared.RefreshToken != "rotated-rt" || prepared.UserID != "user-1" || pr | CODE |
| LOW | backend/internal/infra/provider/cli/normalize_test.go | 389 | data := []byte(`{"accounts":[{"provider":"grok_build","name":"primary","client_id":"client-1","access_token":"access-1" | CODE |
| LOW | backend/internal/infra/provider/cli/normalize_test.go | 448 | data := []byte(`[{"type":"xai","access_token":"access-1","refresh_token":"refresh-1","email":"user@example.com","user_i | CODE |
| LOW | backend/internal/infra/provider/cli/normalize_test.go | 454 | if len(values) != 2 || values[0].AccessToken != "access-1" || values[0].Email != "user@example.com" || values[0].UserID | CODE |
| LOW | backend/internal/infra/provider/cli/normalize_test.go | 494 | Name: "primary", Email: "user@example.com", UserID: "user-1", TeamID: "team-1", | CODE |
| LOW | backend/internal/infra/provider/cli/normalize_test.go | 521 | claims, _ := json.Marshal(map[string]any{"sub": "user-1", "email": "user@example.com", "team_id": "team-1", "exp": expi | CODE |
| LOW | backend/internal/infra/provider/cli/normalize_test.go | 529 | if len(values) != 1 || values[0].UserID != "user-1" || values[0].Email != "user@example.com" || values[0].TeamID != "te | CODE |
| LOW | …nd/internal/application/account/provider_links_test.go | 37 | adapter.identity = provider.AccountIdentity{UserID: "11111111-1111-4111-8111-111111111111", Email: "user@example.com"} | CODE |
| LOW | …nd/internal/application/account/provider_links_test.go | 49 | if web.UserID != "11111111-1111-4111-8111-111111111111" || web.Email != "user@example.com" || len(web.LinkedAccounts) ! | CODE |
| LOW | backend/internal/application/account/export_test.go | 44 | Provider: accountdomain.ProviderBuild, Name: "primary", Email: "user@example.com", UserID: "user-1", | CODE |
| LOW | backend/internal/application/account/export_test.go | 77 | if value.Name != "primary" || value.Email != "user@example.com" || value.UserID != "user-1" || value.OIDCClientID != "c | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config.example.yaml | 1 | # 配置标记: | COMMENT |
| LOW | config.example.yaml | 161 | # account-bound state or side-effecting tools. Context compaction stays exempt. | COMMENT |
| LOW | docker-compose.yml | 21 | security_opt: | COMMENT |
| LOW | docker-compose.yml | 41 | # 在管理端将 Clearance 模式设为 FlareSolverr 或按需刷新,并使用 http://flaresolverr:8191。 | COMMENT |
| LOW | backend/internal/infra/provider/provider.go | 1361 | result, ok := adapter.(VoiceWebSocketAdapter) | COMMENT |
| LOW | backend/internal/transport/http/swagger_annotations.go | 101 | // @Produce json | COMMENT |
| LOW | backend/internal/transport/http/swagger_annotations.go | 121 | // @Security BearerAuth | COMMENT |
| LOW | backend/internal/transport/http/swagger_annotations.go | 141 | COMMENT | |
| LOW | backend/internal/transport/http/swagger_annotations.go | 161 | // @Router /v1/responses/{response_id} [delete] | COMMENT |
| LOW | backend/internal/transport/http/swagger_annotations.go | 181 | // @Accept json | COMMENT |
| LOW | backend/internal/transport/http/swagger_annotations.go | 201 | COMMENT | |
| LOW | backend/internal/transport/http/swagger_annotations.go | 221 | // @Router /v1/media/images/{asset_id} [get] | COMMENT |
| LOW | backend/internal/transport/http/swagger_annotations.go | 241 | // @Produce json | COMMENT |
| LOW | backend/internal/transport/http/swagger_annotations.go | 261 | // @Summary 查询异步视频任务 | COMMENT |
| LOW | backend/internal/application/gateway/service.go | 121 | // auditOperation may classify a normal protocol request differently for | COMMENT |
| LOW | backend/internal/domain/account/account.go | 221 | // 它不参与路由;每个新请求仍先走 Build,只有当次严格 403 才可尝试 XAI。 | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/egress-quality-guard/session_rotator.py | 178 | def _update_session(self, proxy_index: int, session_id: str) -> None: | CODE |
| LOW | tools/egress-quality-guard/quality_guard.py | 689 | def _update_guard_metadata(self) -> None: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/egress-quality-guard/session_rotator.py | 8 | CODE | |
| LOW | tools/egress-quality-guard/quality_guard.py | 10 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/egress-quality-guard/session_rotator.py | 193 | CODE | |
| LOW | tools/egress-quality-guard/quality_guard.py | 1251 | CODE |