2.8

Adjusted Signal

2.8

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

4.6K

Stars

Language

746.1K

Lines of Code

3.4K

Files

1.6K

Pattern Hits

2026-10-31

Scan Date

0.01

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1512 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.0/100 · LOW

Are imports declared and package/API names verified? 42 finding(s).

Agent Over-Engineering Ratio 1.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 80 finding(s).

PR Review Velocity Impact 13.8/100 · LOW

Which changes need focused human review? 1634 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 29MEDIUM 221LOW 1384

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1634 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block1332 hits · 1216 pts

Severity	File	Line	Snippet	Context
LOW	.golangci.yml	141	# Hardcoded-credentials matches constant names like ToolNameLSPWorkspace*	COMMENT
LOW	cmd/wasm/cloud.go	21	)	COMMENT
LOW	cmd/wasm/runtime.go	41	OAuthRedirectURI string	COMMENT
LOW	cmd/wasm/main.go	1	//go:build js && wasm	COMMENT
LOW	cmd/wasm/main.go	21	// -tags docker_agent_wasm_rag.	COMMENT
LOW	cmd/wasm/main.go	41	// A session handle offers:	COMMENT
LOW	cmd/wasm/main.go	61	// {type: "tool_confirmation", id, name, args} // answer with confirm()	COMMENT
LOW	cmd/wasm/web/auth.js	1	// OpenRouter PKCE OAuth helpers for the docker-agent wasm browser demo.	COMMENT
LOW	cmd/wasm/web/auth.js	21	// scoped, revocable from https://openrouter.ai/settings/keys, and lives only	COMMENT
LOW	cmd/wasm/browser/smoke_test.js	1	#!/usr/bin/env node	COMMENT
LOW	cmd/wasm/examples/cloud-bedrock.yaml	1	# Amazon Bedrock from the browser build (cmd/wasm, -tags docker_agent_wasm_cloud).	COMMENT
LOW	cmd/wasm/examples/cloud-vertex.yaml	1	# Google Vertex AI from the browser build (cmd/wasm, -tags docker_agent_wasm_cloud).	COMMENT
LOW	cmd/wasm/examples/handbook-rag.yaml	1	# A keyword-search (BM25) assistant over documents the host hands to the	COMMENT
LOW	cmd/root/backend.go	21		COMMENT
LOW	cmd/root/run_listen.go	21	// recallCoordinatorOpt wires the session manager's recall handler to this	COMMENT
LOW	cmd/root/run.go	61	autoApprove bool	COMMENT
LOW	cmd/root/run.go	521	// the working directory by then for every tool — the shell included — to	COMMENT
LOW	cmd/root/run.go	621	// On a TUI error we deliberately leave the worktree in place rather	COMMENT
LOW	cmd/root/run.go	1001	if req.ResumeSessionID != "" {	COMMENT
LOW	cmd/root/agent_picker.go	581		COMMENT
LOW	cmd/root/plans.go	321	// is "-" so scripts can pipe content in. Both sources are bounded by the plan	COMMENT
LOW	cmd/root/setup.go	41	// declined or cancelled: the full failure was already printed just above the	COMMENT
LOW	cmd/root/setup.go	61	// ProviderName and Provider are set when the custom path registered an	COMMENT
LOW	cmd/root/sandbox.go	261		COMMENT
LOW	cmd/root/sandbox.go	401	//	COMMENT
LOW	cmd/root/sandbox.go	621	fmt.Fprintf(w, "Models catalog: allowlisting %s in the sandbox proxy\n", modelsdev.APIHost)	COMMENT
LOW	cmd/root/otel.go	81	// Single source of truth for "is OTel enabled?" — flip the	COMMENT
LOW	cmd/root/otel.go	181	}	COMMENT
LOW	lint/hook_config_sync.go	1	package main	COMMENT
LOW	lint/hook_config_sync.go	21	// Drift in either direction is silently broken at runtime:	COMMENT
LOW	lint/http_client_transport.go	1	package main	COMMENT
LOW	lint/config_version_constant.go	1	package main	COMMENT
LOW	lint/runtime_session_scoped.go	1	package main	COMMENT
LOW	lint/tui_view_purity.go	1	package main	COMMENT
LOW	lint/tui_view_purity.go	21	// recv.field = nil	COMMENT
LOW	lint/atomic_state_write.go	1	package main	COMMENT
LOW	lint/runtime_event_registry.go	21	// …	COMMENT
LOW	lint/hook_builtins_registered.go	1	package main	COMMENT
LOW	lint/hook_builtins_registered.go	21	// implementations:	COMMENT
LOW	lint/config_latest_tag_consistency.go	1	package main	COMMENT
LOW	lint/config_latest_tag_consistency.go	21	// an intentional design choice.	COMMENT
LOW	lint/config_package_name.go	1	package main	COMMENT
LOW	docs/hugo.yaml	1	# Hugo configuration for https://docker.github.io/docker-agent/	COMMENT
LOW	docs/js/app.js	41	document.documentElement.removeAttribute('data-theme');	COMMENT
LOW	examples/github-copilot.yaml	1	# GitHub Copilot requires a `Copilot-Integration-Id` header on every request	COMMENT
LOW	examples/capability-overrides.yaml	1	# Demonstrates the `capabilities` override for models the models.dev catalogue	COMMENT
LOW	examples/remote_mcp_oauth_callback_redirect.yaml	1	# Example: Remote MCP server with a custom OAuth callback redirect URL.	COMMENT
LOW	examples/hook_routing.yaml	1	# Requires OPENAI_API_KEY and TYPESAFE_API_KEY. The user's request (and recent visible	COMMENT
LOW	examples/filesystem_allow_deny.yaml	1	# Demonstrates allow_list / deny_list for the filesystem tool.	COMMENT
LOW	examples/redact_secrets.yaml	1	# Demonstrates the redact_secrets feature.	COMMENT
LOW	examples/redact_secrets.yaml	21	# persisted session file, the post_tool_use hook input, or the	COMMENT
LOW	examples/code.yaml	21	# 3. Code Modification:	COMMENT
LOW	examples/reasoning_replay.yaml	1	# Example: Replaying reasoning to an OpenAI-compatible model	COMMENT
LOW	examples/compaction_threshold.yaml	1	# Compaction Threshold Example	COMMENT
LOW	examples/custom-pricing.yaml	1	# Demonstrates the `cost` override that declares a model's token pricing	COMMENT
LOW	examples/readonly.yaml	1	# Demonstrates the `readonly` attribute on toolsets and agents.	COMMENT
LOW	examples/flavors.yaml	1	#!/usr/bin/env docker agent run	COMMENT
LOW	examples/cached_responses.yaml	1	# Demonstrates the response cache.	COMMENT
LOW	examples/websocket_transport.yaml	1	# Example: WebSocket Transport for OpenAI Responses API	COMMENT
LOW	examples/handoff.yaml	1	# Handoff Graph Diagram:	COMMENT
1272 more matches not shown…

Modern AI Meta-Vocabulary107 hits · 288 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	CHANGELOG.md	5209	- [#2322](https://github.com/docker/docker-agent/pull/2322) - fix: resolve duplicate RAG tool names and nil pointer pani	CODE
MEDIUM⚡	CHANGELOG.md	5211	- [#2324](https://github.com/docker/docker-agent/pull/2324) - fix: pass Models map to RAG ManagersBuildConfig for model	CODE
MEDIUM⚡	CHANGELOG.md	5219	- [#2344](https://github.com/docker/docker-agent/pull/2344) - feat: support custom providers in RAG embedding and rerank	CODE
MEDIUM	CHANGELOG.md	126	- [#4748](https://github.com/docker/docker-agent/pull/4748) - feat(wasm): make RAG opt-in	CODE
MEDIUM	CHANGELOG.md	183	- [#4650](https://github.com/docker/docker-agent/pull/4650) - fix(rag): share one index across agents referencing the sa	CODE
MEDIUM	CHANGELOG.md	713	- [#4418](https://github.com/docker/docker-agent/pull/4418) - fix(acp): separate root context from multi-agent cost	CODE
MEDIUM	CHANGELOG.md	1352	- [#4097](https://github.com/docker/docker-agent/pull/4097) - fix(#4097): propagate sustained RAG 5xx/408 indexing failu	CODE
MEDIUM	CHANGELOG.md	1367	- [#4151](https://github.com/docker/docker-agent/pull/4151) - fix(#4097): propagate sustained RAG 5xx/408 indexing failu	CODE
MEDIUM	CHANGELOG.md	2704	- [#3451](https://github.com/docker/docker-agent/pull/3451) - feat: add docker agent board, a Kanban TUI for orchestrati	CODE
MEDIUM	CHANGELOG.md	2955	- [#3393](https://github.com/docker/docker-agent/pull/3393) - fix: clamp max_tokens to the context window for OpenAI-com	CODE
MEDIUM	CHANGELOG.md	3037	- [#3326](https://github.com/docker/docker-agent/pull/3326) - refactor: replace test-mutated globals with dependency inj	CODE
MEDIUM	CHANGELOG.md	3245	- [#3227](https://github.com/docker/docker-agent/pull/3227) - feat: add plan builtin toolset for shared multi-agent coll	CODE
MEDIUM	CHANGELOG.md	3337	- [#3227](https://github.com/docker/docker-agent/pull/3227) - feat: add plan builtin toolset for shared multi-agent coll	CODE
MEDIUM	CHANGELOG.md	4081	- [#2876](https://github.com/docker/docker-agent/pull/2876) - docs: document mcp_catalog toolset and reorganize RAG refe	CODE
MEDIUM	CHANGELOG.md	4419	- [#2723](https://github.com/docker/docker-agent/pull/2723) - remote-runtime: close silent gaps, consolidate Runtime, sc	CODE
MEDIUM	CHANGELOG.md	4419	- [#2723](https://github.com/docker/docker-agent/pull/2723) - remote-runtime: close silent gaps, consolidate Runtime, sc	CODE
MEDIUM	CHANGELOG.md	4618	- [#2672](https://github.com/docker/docker-agent/pull/2672) - add js/wasm browser build with OpenRouter PKCE, agentic lo	CODE
MEDIUM	CHANGELOG.md	4618	- [#2672](https://github.com/docker/docker-agent/pull/2672) - add js/wasm browser build with OpenRouter PKCE, agentic lo	CODE
MEDIUM	CHANGELOG.md	4742	- [#2523](https://github.com/docker/docker-agent/pull/2523) - refactor(runtime): consolidate hook orchestration and cach	CODE
MEDIUM	CHANGELOG.md	4754	- [#2535](https://github.com/docker/docker-agent/pull/2535) - refactor(runtime): extract sub-session orchestration	CODE
MEDIUM	CHANGELOG.md	5412	- [#2210](https://github.com/docker/docker-agent/pull/2210) - Refactor RAG from agent-level config to standard toolset t	CODE
MEDIUM	CHANGELOG.md	5458	- [#2205](https://github.com/docker/docker-agent/pull/2205) - Simplify the runtime related RAG code a bit	CODE
MEDIUM	CHANGELOG.md	6011	- [#1973](https://github.com/docker/docker-agent/pull/1973) - Fix context window overflow: auto-recovery and proactive c	CODE
MEDIUM	CHANGELOG.md	6099	- [#1899](https://github.com/docker/docker-agent/pull/1899) - fix: Esc key not interrupting sub-agents in multi-agent se	CODE
MEDIUM	cmd/wasm/README.md	28	### Optional RAG	COMMENT
MEDIUM	cmd/wasm/README.md	83	# Go runtime bridge tests, including default, RAG-enabled and cloud builds.	COMMENT
MEDIUM	cmd/wasm/README.md	92	# Build and test both default and RAG-enabled JavaScript APIs.	COMMENT
MEDIUM	cmd/wasm/README.md	464	# JS surface against both default and RAG-enabled binaries.	COMMENT
MEDIUM	cmd/wasm/main.go	9	// - Long-lived sessions with the full agentic loop: streaming, tool	COMMENT
MEDIUM	cmd/wasm/examples/handbook-rag.yaml	16	# to this file. BM25 needs no embedding model, so no extra key is required;	COMMENT
MEDIUM	docs/configuration/agents/index.md	25	toolsets: [list] # Optional: tool configurations (use `type: rag` for RAG sources)	CODE
MEDIUM	docs/configuration/agents/index.md	36	code_mode_tools: boolean # Optional: let the agent write JavaScript to orchestrate tool calls (see Code Mode)	CODE
MEDIUM	docs/configuration/hooks/index.md	981	### Agent-Switch and Session-Resume: observability for multi-agent and long runs	COMMENT
MEDIUM	docs/configuration/overview/index.md	46	# 5. RAG — define retrieval-augmented generation sources (optional)	COMMENT
MEDIUM	docs/tools/a2a/index.md	51	Starting the toolset fetches the remote agent's card (`/.well-known/agent-card.json`). When that request fails with one	CODE
MEDIUM	docs/tools/mcp/index.md	212	Startup failure behaviour: local MCP failures (missing binary, connection refused, bad auth) fail fast — each turn r	CODE
MEDIUM	docs/tools/rag/index.md	363	## Debugging RAG	COMMENT
MEDIUM	docs/tools/rag/index.md	385	### Top-Level RAG Fields	COMMENT
MEDIUM	docs/providers/dmr/index.md	118	context_size: 32768 # total context window (sent via _configure)	CODE
MEDIUM	docs/features/acp/index.md	31	# With a multi-agent team config	COMMENT
MEDIUM	docs/features/chat-server/index.md	28	# Pick a specific agent from a multi-agent config	COMMENT
MEDIUM	docs/guides/compaction/index.md	11	## Why long sessions fill the context window	COMMENT
MEDIUM	docs/guides/go-sdk/index.md	306	## RAG Toolset (opt-out)	COMMENT
MEDIUM	docs/guides/go-sdk/index.md	329	### RAG over in-memory documents	COMMENT
MEDIUM	docs/guides/headless/index.md	35	\| Instructions/context every agent turn should see \| `add_prompt_files` in the agent config, or `--prompt-file` on the C	CODE
MEDIUM	docs/guides/headless/index.md	47	3. Model/provider context and media limits — even content that clears the first two layers still has to fit the mode	CODE
MEDIUM	docs/concepts/distribution/index.md	184	# Run with a specific agent from a multi-agent config	COMMENT
MEDIUM	docs/concepts/distribution/index.md	207	See [Pin external sub-agents to a digest](../multi-agent/index.md#pin-external-sub-agents-to-a-digest) and [External Sub	CODE
MEDIUM	examples/session_context.yaml	10	# messages, so a big history cannot overflow the context window.	COMMENT
MEDIUM	examples/compaction_threshold.yaml	7	# token usage crosses 90% of the model's context window. Lowering the	COMMENT
MEDIUM	examples/websocket_transport.yaml	8	# for agentic workflows with many tool calls.	COMMENT
MEDIUM	examples/README.md	113	### RAG (Retrieval-Augmented Generation)	COMMENT
MEDIUM⚡	examples/hooks.yaml	325	# / cost guardrails / auditing without contributing system messages	COMMENT
MEDIUM	examples/hooks.yaml	26	# before_llm_call - just before each model call (observability, guardrails)	COMMENT
MEDIUM	examples/compaction_model.yaml	21	# Note: if the compaction model has a SMALLER context window than the primary,	COMMENT
MEDIUM	examples/compaction_model.yaml	24	# with a compaction model whose context window is at least as large to keep the	COMMENT
MEDIUM	examples/task_budget.yaml	2	# multi-step agentic task (thinking + tool calls + final output). docker-agent	COMMENT
MEDIUM	examples/chat/main.go	20	// # or, to pin a specific agent in a multi-agent team:	COMMENT
MEDIUM	examples/rag/semantic_embeddings.yaml	1	# This example demonstrates the semantic-embeddings RAG strategy.	COMMENT
MEDIUM	examples/rag/semantic_embeddings.yaml	38	# Required: embedding model for vector similarity	COMMENT
47 more matches not shown…

Decorative Section Separators80 hits · 242 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	examples/handoff.yaml	3	# ─────> Root Agent <────────<─<─<──────┐	COMMENT
MEDIUM⚡	examples/handoff.yaml	5	# ┌───────┼────────┐ \|	COMMENT
MEDIUM⚡	examples/handoff.yaml	10	# \| ┌───────┴───────┐ \|	COMMENT
MEDIUM⚡	examples/handoff.yaml	16	# \| └───────┬───────┘ \|	COMMENT
MEDIUM⚡	examples/handoff.yaml	20	# └────────┼───────┘ \|	COMMENT
MEDIUM⚡	examples/handoff.yaml	22	# Summarizer ──────>─>─>─────────┘	COMMENT
MEDIUM	examples/worktree_create_hook.yaml	3	# ==========================================================================	COMMENT
MEDIUM	examples/anthropic_wif.yaml	22	# ---------------------------------------------------------------------	COMMENT
MEDIUM	examples/anthropic_wif.yaml	28	# ---------------------------------------------------------------------	COMMENT
MEDIUM	examples/anthropic_wif.yaml	41	# ---------------------------------------------------------------------	COMMENT
MEDIUM	examples/anthropic_wif.yaml	46	# ---------------------------------------------------------------------	COMMENT
MEDIUM	examples/anthropic_wif.yaml	57	# ---------------------------------------------------------------------	COMMENT
MEDIUM	examples/anthropic_wif.yaml	62	# ---------------------------------------------------------------------	COMMENT
MEDIUM	examples/anthropic_wif.yaml	77	# ---------------------------------------------------------------------	COMMENT
MEDIUM	examples/anthropic_wif.yaml	88	# ---------------------------------------------------------------------	COMMENT
MEDIUM⚡	examples/hooks.yaml	253	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	263	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	273	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	278	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	322	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	327	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	336	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	365	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	367	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	377	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	384	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	412	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	415	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	422	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	425	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	435	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	439	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	449	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	455	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	464	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	469	# ====================================================================	COMMENT
MEDIUM⚡	examples/hooks.yaml	478	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	3	# ==========================================================================	COMMENT
MEDIUM	examples/hooks.yaml	104	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	108	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	141	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	145	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	163	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	169	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	183	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	187	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	208	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	214	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	228	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	238	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	293	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	311	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	349	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	395	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	400	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	499	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	514	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	521	# ====================================================================	COMMENT
MEDIUM	examples/hooks.yaml	534	# ====================================================================	COMMENT
MEDIUM	examples/budget.yaml	4	# ==========================================================================	COMMENT
20 more matches not shown…

Magic Placeholder Names26 hits · 135 pts

Severity	File	Line	Snippet	Context
HIGH	docs/configuration/opentelemetry/index.md	76	export OTEL_EXPORTER_OTLP_HEADERS="x-api-key=<your-api-key>,Langsmith-Project=<project>"	CODE
HIGH	docs/providers/opencode-go/index.md	24	export OPENCODE_API_KEY=your-api-key	CODE
HIGH	docs/providers/moonshot/index.md	26	export MOONSHOT_API_KEY=your-api-key	CODE
HIGH	docs/providers/baseten/index.md	21	export BASETEN_API_KEY=your-api-key	CODE
HIGH	docs/providers/together/index.md	26	export TOGETHER_API_KEY=your-api-key	CODE
HIGH	docs/providers/vercel/index.md	25	export AI_GATEWAY_API_KEY=your-api-key	CODE
HIGH	docs/providers/openrouter/index.md	21	export OPENROUTER_API_KEY=your-api-key	CODE
HIGH	docs/providers/daoxe/index.md	23	export DAOXE_API_KEY=your-api-key	CODE
HIGH	docs/providers/fireworks/index.md	26	export FIREWORKS_API_KEY=your-api-key	CODE
HIGH	docs/providers/opper/index.md	23	export OPPER_API_KEY=your-api-key	CODE
HIGH	docs/providers/groq/index.md	23	export GROQ_API_KEY=your-api-key	CODE
HIGH	docs/providers/minimax/index.md	21	export MINIMAX_API_KEY=your-api-key	CODE
HIGH	docs/providers/cloudgpu/index.md	24	export CLOUDGPU_API_KEY=your-api-key	CODE
HIGH	docs/providers/deepseek/index.md	24	export DEEPSEEK_API_KEY=your-api-key	CODE
HIGH	docs/providers/xai/index.md	21	export XAI_API_KEY=your-api-key	CODE
HIGH	docs/providers/runcrate/index.md	30	export RUNCRATE_API_KEY=your-api-key	CODE
HIGH	docs/providers/nvidia/index.md	25	export NVIDIA_API_KEY=your-api-key	CODE
HIGH	docs/providers/atlascloud/index.md	21	export ATLASCLOUD_API_KEY=your-api-key	CODE
HIGH	docs/providers/orcarouter/index.md	21	$ export ORCAROUTER_API_KEY=your-api-key	CODE
HIGH	docs/providers/api-route/index.md	23	export API_ROUTE_API_KEY=your-api-key	CODE
HIGH	docs/providers/nebius/index.md	21	export NEBIUS_API_KEY=your-api-key	CODE
HIGH	docs/providers/opencode-zen/index.md	29	export OPENCODE_API_KEY=your-api-key	CODE
HIGH	docs/providers/cerebras/index.md	25	export CEREBRAS_API_KEY=your-api-key	CODE
HIGH	docs/providers/mistral/index.md	21	export MISTRAL_API_KEY=your-api-key	CODE
HIGH	examples/opencode-zen.yaml	6	# export OPENCODE_API_KEY="your-api-key"	COMMENT
HIGH	examples/opencode-go-practical.yaml	6	# export OPENCODE_API_KEY="your-api-key"	COMMENT

AI Slop Vocabulary22 hits · 62 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/code.yaml	23	# - Ensure changes follow best practices	COMMENT
LOW	examples/toolset_instructions.yaml	11	# If you want to keep the original guidance and just add your own rules	COMMENT
MEDIUM	examples/multi-code.yaml	81	# - Ensure changes follow best practices	COMMENT
MEDIUM	examples/multi-code.yaml	138	# - Ensure changes follow best practices	COMMENT
MEDIUM	e2e/testdata/cassettes/TestExec_DefaultAgent.yaml	11	body: "{\"messages\":[{\"content\":[{\"text\":\"Which model are you running? Be super brief.\",\"type\":\"text\"}],\	CODE
MEDIUM	e2e/testdata/cassettes/TestExec_DefaultAgent.yaml	31	body: "{\"max_tokens\":64000,\"messages\":[{\"content\":[{\"text\":\"Which model are you running? Be super brief.\",	CODE
MEDIUM	pkg/config/references.go	20	// query as volatile — rather than an enumerated denylist — keeps this robust as	COMMENT
MEDIUM	pkg/tui/components/markdown/incremental.go	298	// the function robust against future refactors of the helpers.	COMMENT
MEDIUM	pkg/js/expand.go	129	// then expand only the text fields. This keeps the expansion robust if	COMMENT
MEDIUM	pkg/selfupdate/exec_unix.go	32	// descriptors and terminal, so the user sees a seamless restart.	COMMENT
MEDIUM	pkg/runtime/turn_end_test.go	167	// is what makes this contract robust: explicit dispatch calls would	COMMENT
MEDIUM	pkg/runtime/generated_media_markers.go	68	// from streamed assistant text, robust to chunks split at any byte boundary.	COMMENT
MEDIUM	pkg/runtime/transforms_test.go	758	// review's "robust multi-artifact placeholder" regression for a media-only	COMMENT
MEDIUM	pkg/hooks/builtins/add_directory_listing_test.go	19	// format — the test is robust to header tweaks.	COMMENT
MEDIUM	…el/provider/gemini/generated_media_placeholder_test.go	22	// order — the review's "robust multi-artifact" regression exercises	COMMENT
MEDIUM	…el/provider/gemini/generated_media_placeholder_test.go	89	// is the review's "robust multi-artifact placeholder" regression: a	COMMENT
MEDIUM	…provider/oaistream/generated_media_placeholder_test.go	22	// order — the review's "robust multi-artifact" regression exercises	COMMENT
MEDIUM	…provider/oaistream/generated_media_placeholder_test.go	100	// is the review's "robust multi-artifact placeholder" regression: a	COMMENT
MEDIUM	…provider/anthropic/generated_media_placeholder_test.go	22	// source order — the review's "robust multi-artifact" regression exercises	COMMENT
MEDIUM	…provider/anthropic/generated_media_placeholder_test.go	186	// is the review's "robust multi-artifact placeholder" regression for the	COMMENT
MEDIUM	pkg/modelinfo/resolve_caps_test.go	98	// by a unique model id to stay robust regardless.	COMMENT
MEDIUM	pkg/skills/frontmatter.go	8	// first ": ". This is more robust for the simple frontmatter format used by	COMMENT

Self-Referential Comments11 hits · 41 pts

Severity	File	Line	Snippet	Context
MEDIUM	cmd/root/alias.go	27	Example: ` # Create an alias for a registry agent	CODE
MEDIUM	cmd/root/alias.go	30	# Create an alias for a local agent file	COMMENT
MEDIUM⚡	cmd/root/alias.go	75	Example: ` # Create a simple alias	CODE
MEDIUM⚡	cmd/root/alias.go	78	# Create an alias that always runs in yolo mode	COMMENT
MEDIUM⚡	cmd/root/alias.go	81	# Create an alias that defaults to the balanced safety mode	COMMENT
MEDIUM⚡	cmd/root/alias.go	84	# Create an alias with a specific model	COMMENT
MEDIUM⚡	cmd/root/alias.go	87	# Create an alias with hidden tool results	COMMENT
MEDIUM⚡	cmd/root/alias.go	90	# Create an alias that always runs in a sandbox	COMMENT
MEDIUM⚡	cmd/root/alias.go	93	# Create an alias with multiple options	COMMENT
MEDIUM	examples/dhi/dhi_mcp_server/server.py	6	# Define the get_migration_info tool	COMMENT
MEDIUM	examples/elicitation/server.py	18	# Create the MCP server	COMMENT

Verbosity Indicators14 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW⚡	pkg/tools/startable_backoff_test.go	433	// Step 1: retryable failure arms the gate.	COMMENT
LOW⚡	pkg/tools/startable_backoff_test.go	440	// Step 2: advance past the window, then produce a partial start.	COMMENT
LOW⚡	pkg/tools/startable_backoff_test.go	450	// Step 3: gate must now be cleared — a non-retryable error must	COMMENT
LOW	pkg/tools/startable_backoff_test.go	586	// Step 1: arm the gate — TryStart fails, window = base (15 s with identity jitter).	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1363	// Step 1: validate the path while the file is legitimate. This is	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1368	// Step 2: attacker (or hostile post-edit hook running between T0 and	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1373	// Step 3: at T1 the tool issues the actual write. The rooted writer	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1379	// Step 4: the secret must be untouched on disk.	COMMENT
LOW⚡	pkg/tui/components/messages/messages_test.go	1263	// Step 1: Add a reasoning block and a tool call inside it (simulates PartialToolCallEvent)	COMMENT
LOW⚡	pkg/tui/components/messages/messages_test.go	1273	// Step 2: Append an assistant message so the reasoning block is no longer the last message	COMMENT
LOW⚡	pkg/tui/components/messages/messages_test.go	1278	// Step 3: Update the tool call to Running (simulates ToolCallEvent)	COMMENT
LOW	pkg/tui/components/messages/messages.go	1939	// Step 1: Handle reasoning content - only create/extend a reasoning block if there's actual reasoning	COMMENT
LOW	pkg/tui/components/messages/messages.go	1951	// Step 2: Handle assistant content — this breaks the reasoning	COMMENT
LOW	pkg/tui/components/messages/messages.go	1963	// Step 3: Handle tool calls	COMMENT

Structural Annotation Overuse14 hits · 28 pts

Severity	File	Line	Snippet	Context
LOW⚡	pkg/tools/startable_backoff_test.go	433	// Step 1: retryable failure arms the gate.	COMMENT
LOW⚡	pkg/tools/startable_backoff_test.go	440	// Step 2: advance past the window, then produce a partial start.	COMMENT
LOW⚡	pkg/tools/startable_backoff_test.go	450	// Step 3: gate must now be cleared — a non-retryable error must	COMMENT
LOW	pkg/tools/startable_backoff_test.go	586	// Step 1: arm the gate — TryStart fails, window = base (15 s with identity jitter).	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1363	// Step 1: validate the path while the file is legitimate. This is	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1368	// Step 2: attacker (or hostile post-edit hook running between T0 and	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1373	// Step 3: at T1 the tool issues the actual write. The rooted writer	COMMENT
LOW⚡	pkg/tools/builtin/filesystem/filesystem_test.go	1379	// Step 4: the secret must be untouched on disk.	COMMENT
LOW⚡	pkg/tui/components/messages/messages_test.go	1263	// Step 1: Add a reasoning block and a tool call inside it (simulates PartialToolCallEvent)	COMMENT
LOW⚡	pkg/tui/components/messages/messages_test.go	1273	// Step 2: Append an assistant message so the reasoning block is no longer the last message	COMMENT
LOW⚡	pkg/tui/components/messages/messages_test.go	1278	// Step 3: Update the tool call to Running (simulates ToolCallEvent)	COMMENT
LOW	pkg/tui/components/messages/messages.go	1939	// Step 1: Handle reasoning content - only create/extend a reasoning block if there's actual reasoning	COMMENT
LOW	pkg/tui/components/messages/messages.go	1951	// Step 2: Handle assistant content — this breaks the reasoning	COMMENT
LOW	pkg/tui/components/messages/messages.go	1963	// Step 3: Handle tool calls	COMMENT

Synthetic Comment Markers3 hits · 20 pts

Severity	File	Line	Snippet	Context
HIGH	pkg/workspacemedia/writer.go	345	// are kept as requested instead of being noisily "corrected".	COMMENT
HIGH	pkg/tui/components/sidebar/sidebar.go	373	titleRegenerating bool // true when title is being regenerated by AI	CODE
HIGH	pkg/rag/rerank/rerank_test.go	54	// Return as many scores as requested documents, falling back to zeros if needed.	COMMENT

Fake / Example Data16 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	cmd/root/setup_test.go	191	return &chatgpt.LoginResult{Email: "user@example.com", Plan: "plus"}, nil	CODE
LOW	pkg/creator/agent_test.go	116	"OPENAI_API_KEY=dummy-key-for-testing",	CODE
LOW	pkg/tools/builtin/api/client/client_test.go	98	Arguments: `{"name":"John Doe","age":30}`,	CODE
LOW	pkg/tools/builtin/api/client/client_test.go	110	assert.Equal(t, "John Doe", receivedData["name"])	CODE
LOW	pkg/tui/dialog/elicitation_test.go	216	"default": "user@example.com",	CODE
LOW	pkg/tui/dialog/elicitation_test.go	225	Default: "user@example.com",	CODE
LOW	pkg/tui/components/messages/generated_media_test.go	173	m.AppendAssistantMedia("root", []types.AssistantMedia{{ID: 5, Fallback: "placeholder"}})	CODE
LOW	pkg/tui/components/messages/generated_media_test.go	178	assert.Equal(t, "placeholder", m.messages[0].AssistantMedia[0].Fallback)	CODE
LOW	pkg/runtime/commands_test.go	359	input: `name="John Doe" age=30`,	CODE
LOW	pkg/runtime/commands_test.go	360	expected: map[string]any{"name": "John Doe", "age": int64(30)},	CODE
LOW	pkg/chatgpt/login_test.go	88	idClaims["email"] = "user@example.com"	CODE
LOW	pkg/chatgpt/login_test.go	105	assert.Equal(t, "user@example.com", result.Email)	CODE
LOW	pkg/chatgpt/login_test.go	119	assert.Equal(t, "user@example.com", creds.Email)	CODE
LOW	pkg/chatgpt/chatgpt_test.go	54	claims["email"] = "user@example.com"	CODE
LOW	pkg/chatgpt/chatgpt_test.go	62	assert.Equal(t, "user@example.com", parsed.Email)	CODE
LOW	pkg/chatgpt/chatgpt_test.go	86	Email: "user@example.com",	CODE

Example Usage Blocks5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	examples/openapi-petstore.yaml	8	# Usage:	COMMENT
LOW	examples/env_placeholders.yaml	12	# Usage:	COMMENT
LOW	examples/model_env_substitution.yaml	9	# Usage:	COMMENT
LOW	scripts/docs-a11y-urls.sh	33	# Usage:	COMMENT
LOW	scripts/models-delta.sh	4	# Usage:	COMMENT

Slop Phrases2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/budget.yaml	19	# you can try it with an OpenRouter key instead of a first-party provider:	COMMENT
MEDIUM	examples/rag/custom_provider.yaml	2	# For instance, you can use a local Ollama instance or any OpenAI-compatible	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	examples/hook_routing_completion.yaml	6	# Set LOCAL_JEV_API_KEY to any non-empty value; the server is unauthenticated	COMMENT
LOW	examples/hook_routing_local.yaml	12	# Set LOCAL_JEV_API_KEY to any non-empty value; the server is unauthenticated	COMMENT

docker/docker-agent

Open-Source Code Quality, Security and Technical Debt Review