1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

3.2K

Stars

Language

503.3K

Lines of Code

1.6K

Files

501

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 430 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.0/100 · LOW

Are imports declared and package/API names verified? 46 finding(s).

Agent Over-Engineering Ratio 1.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 26 finding(s).

PR Review Velocity Impact 7.5/100 · LOW

Which changes need focused human review? 501 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 6HIGH 1MEDIUM 113LOW 381

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 501 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block301 hits · 292 pts

Severity	File	Line	Snippet	Context
LOW	.goreleaser.yml	161	# grade: stable	COMMENT
LOW	benchmark/query.sh	1	#!/bin/sh	COMMENT
LOW	benchmark/subs.sh	1	#!/bin/sh	COMMENT
LOW	cmd/eval_replay_test.go	201		COMMENT
LOW	cmd/eval_replay_test.go	281	// corrected route, nor that it carries it: this fixture's filter is legal	COMMENT
LOW	cmd/demo_catalog_evidence_test.go	21	// fixes turned out to depend on:	COMMENT
LOW	cmd/demo_catalog_evidence_test.go	141	// against real GraphJin, for zero provider tokens, because the unit tests around	COMMENT
LOW	cmd/demo_catalog_evidence_test.go	241	}	COMMENT
LOW	cmd/cmd_admin.go	1	package main	COMMENT
LOW	cmd/cmd_admin.go	21	// c := &cobra.Command{	COMMENT
LOW	cmd/cmd_admin.go	41	// c1 := &cobra.Command{	COMMENT
LOW	cmd/cmd_admin.go	61	// // cmdInit initializes the admin database	COMMENT
LOW	cmd/cmd_admin.go	81	// }	COMMENT
LOW	cmd/cmd_admin.go	101	// }	COMMENT
LOW	cmd/eval_reset_race_test.go	21		COMMENT
LOW	cmd/eval_sample.go	21	//	COMMENT
LOW	cmd/eval_suite_fingerprint_test.go	1	package main	COMMENT
LOW	cmd/clone_types.go	1	package main	COMMENT
LOW	cmd/cmd_eval_publish.go	581	//	COMMENT
LOW	cmd/eval_external.go	261	case action == "world" \|\| strings.HasPrefix(action, "world/"):	COMMENT
LOW	cmd/env_serve_config.go	141	return os.Chdir(absolute)	COMMENT
LOW	cmd/world_generate.go	1	package main	COMMENT
LOW	cmd/image_role.go	1	package main	COMMENT
LOW	cmd/image_role.go	21	// ordinary precedence order. A plain `go build` sets nothing and behaves	COMMENT
LOW	cmd/eval_auto_resume.go	21	// belong in the tool rather than in whatever shell script the operator	COMMENT
LOW	cmd/clone.go	21	// An organization that wants to tune a model on its own data has a problem: the	COMMENT
LOW	cmd/cmd_env.go	21	// The environment server turns a GraphJin project into something a training	COMMENT
LOW	cmd/cmd_env.go	81	// Two labs comparing numbers need to know they ran the same thing. Version and	COMMENT
LOW	cmd/generator_model.go	61	return firstNonEmptyValue(flags.Provider, flags.Model, flags.APIKeyEnv, flags.BaseURL,	COMMENT
LOW	cmd/generator_model.go	81	// the agent's configuration is deliberate: someone who has only set up one model	COMMENT
LOW	cmd/watch_oracle_contract_test.go	21	// Two managed-root bugs made that contract unsatisfiable for every model on	COMMENT
LOW	cmd/benchmark/model-pricing.yaml	1	# Provider list prices for published benchmark rows, in USD per million tokens.	COMMENT
LOW	cmd/tmpl/prod.yml	21	# When production mode is 'true' only queries from the queries	COMMENT
LOW	cmd/tmpl/prod.yml	41	# encrypting the cursor data	COMMENT
LOW	cmd/tmpl/prod.yml	61	# api_path: "/data"	COMMENT
LOW	cmd/tmpl/prod.yml	141	allow_workflow_execution: false	COMMENT
LOW	cmd/tmpl/prod.yml	181	# Max time after which database connections are not reused	COMMENT
LOW	cmd/tmpl/agentic.yml	41	# The agent is enabled automatically. REST and MCP use GraphJin-owned model	COMMENT
LOW	cmd/tmpl/dev.yml	41	enable_schema: false	COMMENT
LOW	cmd/tmpl/dev.yml	81	# Disables all aggregation functions like count, sum, etc	COMMENT
LOW	cmd/tmpl/dev.yml	101	# OpenCensus tracing and metrics: when debug is enabled you will get	COMMENT
LOW	cmd/tmpl/dev.yml	121	# bucket: 3	COMMENT
LOW	cmd/tmpl/dev.yml	141	# sign_salt: "signed encrypted cookie"	COMMENT
LOW	cmd/tmpl/dev.yml	201		COMMENT
LOW	cmd/tmpl/dev.yml	221	# need source entries.	COMMENT
LOW	cmd/tmpl/dev.yml	241	# port: 5432	COMMENT
LOW	cmd/tmpl/dev.yml	261	# schema: "public"	COMMENT
LOW	cmd/tmpl/dev.yml	281	# kind: database	COMMENT
LOW	cmd/tmpl/dev.yml	301		COMMENT
LOW	cmd/tmpl/dev.yml	321	# host: localhost	COMMENT
LOW	cmd/tmpl/dev.yml	341	# # key_passphrase: optional-if-key-is-encrypted	COMMENT
LOW	cmd/tmpl/dev.yml	361	#	COMMENT
LOW	cmd/tmpl/dev.yml	401	# column: stripe_id	COMMENT
LOW	cmd/tmpl/dev.yml	421	# - name: users	COMMENT
LOW	cmd/tmpl/dev.yml	441	# # added to the role like below.	COMMENT
LOW	cmd/tmpl/dev.yml	461	# # filters: ["{ user_id: { eq: $user_id } }"]	COMMENT
LOW	core/pretty_test.go	101	// Safety check: Is the semantic content (ignoring whitespace) the same?	COMMENT
LOW	core/config.go	1481	// without extension (e.g. "interaction_studio" matches	COMMENT
LOW	core/config.go	1881	//	COMMENT
LOW	core/cache.go	61	// SWRRefresher is an optional interface a ResponseCacheProvider can implement	COMMENT
241 more matches not shown…

Modern AI Meta-Vocabulary70 hits · 210 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	README.md	105	Answers come back as `{status, answer, data, evidence, actions, next}`, grounded by server-side protocol guards. You can	CODE
MEDIUM⚡	README.md	105	Answers come back as `{status, answer, data, evidence, actions, next}`, grounded by server-side protocol guards. You can	CODE
MEDIUM⚡	README.md	115	graphjin serve --demo --path examples/coffee-roastery # flagship agentic demo (Postgres + BigQuery-emu + CodeSQL)	CODE
MEDIUM	README.md	929	- [Agent Evaluation](https://graphjin.com/agentic/evaluation/) — gate a release	CODE
MEDIUM	CONFIG.md	2203	allowed_roles: [operator] # required in prod/agentic modes	CODE
MEDIUM	AGENTIC.md	42	# switches into agentic mode and enables the built-in agent automatically	COMMENT
MEDIUM	AGENTIC.md	185	disabled by default; see the [server agent configuration](https://graphjin.com/agentic/server-agent/).	CODE
MEDIUM	AGENTIC.md	1191	[Catalog Annotations](https://graphjin.com/agentic/annotations/).	CODE
MEDIUM	cmd/cmd_conf.go	271	// a scaffold mid-configuration (e.g. database source still commented out)	COMMENT
MEDIUM	cmd/cmd_demo_default.go	22	// seeded example instead of an empty scaffold.	COMMENT
MEDIUM	cmd/eval_external.go	20	// A lab with its own scaffold does not want GraphJin's agent loop; it wants its	COMMENT
MEDIUM	cmd/tmpl/agentic.yml	9	# Defaults on in agentic mode so operators can inspect catalog, runtime,	COMMENT
MEDIUM	cmd/tmpl/dev.yml	8	# Defaults on in dev and agentic modes. Set false to disable the console.	COMMENT
MEDIUM	core/config.go	70	// gj_* system root public and mounts the agentic surface; defaulting	COMMENT
MEDIUM	core/config.go	72	// dev/agentic selection (GO_ENV, dev.yml/agentic.yml, or `mode:`);	COMMENT
MEDIUM	core/config.go	835	// prod is the only pre-agentic compatibility mode: the agentic surface is	COMMENT
MEDIUM	core/validate_test.go	411	// prod is the only pre-agentic compatibility mode: the agentic surface is	COMMENT
MEDIUM	core/internal/catalog/build.go	856	`mode: prod # disables dev auto-enables, mounts nothing agentic, fails closed`,	CODE
MEDIUM	core/internal/jsn/README.md	19	## Validation guardrails	COMMENT
MEDIUM	website/content/_index.md	61	<div class="home-card-grid"><article class="home-card"><div class="stat-figure">$2.5T<sup><a href="#sources">1</a></sup>	CODE
MEDIUM	website/content/configure/environment-production.md	23	# config/agentic.yml	COMMENT
MEDIUM	website/content/agentic/server-agent.md	19	# switches into agentic mode and enables the built-in agent automatically	COMMENT
MEDIUM	website/content/agentic/server-agent.md	54	# agentic.yml (provider overrides are optional)	COMMENT
MEDIUM	website/layouts/shortcodes/watch-landing.html	64	<div class="home-actions"><a class="button-primary" href="/start/demos/">Run the demo</a><a class="button-secondary" h	CODE
MEDIUM	website/layouts/shortcodes/root-doc.html	4	{{- $content = replaceRE `$AGENTIC\.md#([^)]+)$` `(/story/agentic/#$1)` $content -}}	CODE
MEDIUM	docs/GRAPHJIN-EVAL.md	5	> <https://graphjin.com/agentic/evaluation/> for gating a release. This file is	CODE
MEDIUM	docs/DESIGN-SERVICE.md	311	web_ui: true # defaults on in dev/agentic, off in prod	CODE
MEDIUM	examples/embed.go	4	// seeded example instead of an empty scaffold.	COMMENT
MEDIUM	examples/embed.go	30	//go:embed saas-ops/agentic.yml	COMMENT
MEDIUM	examples/lib/smoke-common.sh	16	# and agentic-mode (JWT-verified) servers alike	COMMENT
MEDIUM	examples/lib/smoke-common.sh	161	# isolation tests run against dev header trust and agentic JWT verification.	COMMENT
MEDIUM	examples/lib/smoke-common.sh	1066	# gj_security in agentic mode) return a GraphQL error for normal users — a	COMMENT
MEDIUM	examples/coffee-roastery/README.md	83	# agentic mode: mint a demo JWT (requires jq + openssl)	COMMENT
MEDIUM	serv/catalog_column_values_test.go	15	// and the guardrails that keep it from publishing anything else.	COMMENT
MEDIUM	serv/config.go	112	// Enable the web UI. Defaults on in dev and agentic modes, off in prod.	COMMENT
MEDIUM	serv/config.go	323	// database-only prod/agentic configs, where it must be explicitly enabled.	COMMENT
MEDIUM	serv/config.go	342	// Dev and agentic configs expose both the agent and primitives by default.	COMMENT
MEDIUM	serv/config.go	571	// RuntimeEventsConfig configures bounded agentic runtime observability rows.	COMMENT
MEDIUM	serv/config.go	965	// applyRuntimeModeDefaults makes parsed dev and agentic configurations	COMMENT
MEDIUM	serv/config.go	1226	// Server-side agent defaults. Parsed dev and agentic configs enable the	COMMENT
MEDIUM	serv/mcp_recorder.go	17	// agent — a lab's own scaffold connecting over MCP — there is nobody to ask but	COMMENT
MEDIUM	serv/mcp_registration_test.go	438	// Sources mock runs in agentic mode, so the dev-only config tools stay	COMMENT
MEDIUM	serv/mcp_registration_test.go	1220	// Mode selects the surface: dev/agentic mount MCP, prod hard-gates it.	COMMENT
MEDIUM	serv/control_plane_graphql_test.go	890	// New security model: prod hard-gates the agentic surface, so the MCP server	COMMENT
MEDIUM	serv/control_plane_graphql_test.go	1067	// The capability is disabled by the agentic default, so the root is absent.	COMMENT
MEDIUM	serv/control_plane_graphql_test.go	1106	// agentic mode, so access policy cannot resurrect these roots.	COMMENT
MEDIUM	serv/control_plane_graphql_test.go	1163	// New security model: prod hard-gates the agentic surface, so the system	COMMENT
MEDIUM	serv/control_plane_graphql_test.go	1610	// New security model: prod hard-gates the agentic surface, so the workflows	COMMENT
MEDIUM	serv/mcp_instructions.go	140	- Watches (standing questions): create with a unique per-conversation name and a cursor-backed subscription scoped to th	CODE
MEDIUM	serv/security_roots_access_test.go	67	// a root that agentic mode otherwise reserves for admins.	COMMENT
MEDIUM⚡	serv/sources.go	12	// agenticSurfaceEnabled reports whether the agentic surface — catalog, artifacts	COMMENT
MEDIUM⚡	serv/sources.go	14	// the agent — may mount. prod is the only pre-agentic compatibility mode and never	COMMENT
MEDIUM⚡	serv/sources.go	15	// mounts the agentic surface, regardless of individual enabled flags. This is the	COMMENT
MEDIUM	serv/sources.go	48	// Source mode: prod hard-gates the agentic surface (security model); the	COMMENT
MEDIUM	serv/mcp_config_docs.go	26	//go:embed config_docs/agentic.yml	COMMENT
MEDIUM	serv/mcp_config_docs.go	30	// given variant ("dev", "prod", or "agentic"); any other value returns dev.	COMMENT
MEDIUM	serv/agent_handler_test.go	76	// TestValidateConfRefusesDevAuthInAgenticMode locks in audit finding F2: agentic	COMMENT
MEDIUM	serv/agent_handler_test.go	79	// authorization control in agentic mode.	COMMENT
MEDIUM	serv/agent_handler_test.go	96	// Not agentic, or verified auth: allowed.	COMMENT
MEDIUM	serv/metadata_test.go	29	// Catalog mirror + code db-reference linking are agentic-surface features.	COMMENT
10 more matches not shown…

Decorative Section Separators24 hits · 108 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	cmd/tmpl/prod.yml	104	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/prod.yml	106	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/prod.yml	109	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/prod.yml	143	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/prod.yml	145	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/prod.yml	153	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/dev.yml	176	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/dev.yml	178	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/dev.yml	186	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/dev.yml	216	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/dev.yml	218	# ============================================================================	COMMENT
MEDIUM⚡	cmd/tmpl/dev.yml	226	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/prod.yml	103	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/prod.yml	105	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/prod.yml	108	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/prod.yml	142	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/prod.yml	144	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/prod.yml	153	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/dev.yml	182	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/dev.yml	184	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/dev.yml	192	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/dev.yml	222	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/dev.yml	224	# ============================================================================	COMMENT
MEDIUM⚡	serv/config_docs/dev.yml	232	# ============================================================================	COMMENT

Hallucination Indicators6 hits · 60 pts

Severity	File	Line	Snippet	Context
CRITICAL	core/subs.go	452	params := s.s.cs.st.md.Params()	CODE
CRITICAL	core/subs.go	534	if len(sub.s.cs.st.md.Params()) != 0 && dialectSupportsSubscriptionBatching(targetCtx.schema.DBType()) {	CODE
CRITICAL	core/subs.go	803	hasParams := len(sub.s.cs.st.md.Params()) != 0	CODE
CRITICAL	core/subs.go	819	mdParams := sub.s.cs.st.md.Params()	CODE
CRITICAL	core/api.go	2526	Operation: s.cs.st.qc.Type.String(),	CODE
CRITICAL	core/api.go	2648	Operation: s.cs.st.qc.Type.String(),	CODE

Slop Phrases11 hits · 33 pts

Severity	File	Line	Snippet	Context
MEDIUM	cmd/tmpl/prod.yml	60	# Default API path prefix is /api you can change it if you like	COMMENT
MEDIUM	cmd/tmpl/dev.yml	66	# Default API path prefix is /api you can change it if you like	COMMENT
MEDIUM	cmd/tmpl/dev.yml	247	# # alternatively you can use a connection string	COMMENT
MEDIUM⚡	core/internal/jsn/test7.json	1	{"data":{"published":true,"body":"---\nsidebar: auto\n---\n# Guide to GraphJin\n\nGraphJin is a service that instantly a	CODE
MEDIUM	examples/webshop/prod.yml	57	# Default API path prefix is /api you can change it if you like	COMMENT
MEDIUM	examples/webshop/dev.yml	60	# Default API path prefix is /api you can change it if you like	COMMENT
MEDIUM	examples/webshop/dev.yml	179	# alternatively you can use a connection string	COMMENT
MEDIUM	serv/config_docs/prod.yml	59	# Default API path prefix is /api you can change it if you like	COMMENT
MEDIUM	serv/config_docs/prod.yml	168	# alternatively you can use a connection string	COMMENT
MEDIUM	serv/config_docs/dev.yml	72	# Default API path prefix is /api you can change it if you like	COMMENT
MEDIUM	serv/config_docs/dev.yml	253	# # alternatively you can use a connection string	COMMENT

Verbosity Indicators17 hits · 27 pts

Severity	File	Line	Snippet	Context
LOW⚡	cmd/cmd_validate.go	61	// Step 1: Load configuration	COMMENT
LOW⚡	cmd/cmd_validate.go	69	// Step 2: Initialize GraphJin service (tests primary DB, Redis, core)	COMMENT
LOW	cmd/cmd_validate.go	106	// Step 3: Test additional databases (multi-DB mode)	COMMENT
LOW	core/internal/introspection/tables.go	959	// Step 1: Build per-table column sets and PK sets	COMMENT
LOW	core/internal/introspection/tables.go	976	// Step 2: For each table with no PK, find the best matching base table	COMMENT
LOW	core/internal/dialect/mssql.go	637	// We need to check if any element in the column's array exists in the provided list	COMMENT
LOW	core/internal/dialect/mssql.go	2433	// We need to check if any element in the column's array exists in the provided list	COMMENT
LOW	core/internal/dialect/mssql.go	3219	// Step 1: Capture the IDs being disconnected into a variable	COMMENT
LOW	core/internal/dialect/mssql.go	3230	// Step 2: Perform the actual disconnect (UPDATE child SET fk = NULL)	COMMENT
LOW	core/internal/dialect/sqlite.go	984	// Step 1: SELECT to capture IDs matching the filter	COMMENT
LOW	core/internal/dialect/sqlite.go	1007	// Step 2: Determine relationship direction and perform appropriate UPDATE	COMMENT
LOW	core/internal/dialect/mongodb.go	4223	// Step 1: $unwind the embedded array	COMMENT
LOW	core/internal/dialect/mongodb.go	4258	// Step 4: $group back to reconstruct the document	COMMENT
LOW	core/internal/dialect/mongodb.go	4299	// Step 5: Final $project to select only requested fields from embedded elements	COMMENT
LOW	core/internal/dialect/oracle.go	391	// We need to check if any element in the column's array exists in the provided list	COMMENT
LOW	core/internal/dialect/oracle.go	1444	// Step 1: Capture the IDs being disconnected into a variable	COMMENT
LOW	core/internal/dialect/oracle.go	1464	// Step 2: Perform the actual disconnect (UPDATE child SET fk = NULL)	COMMENT

Fake / Example Data21 hits · 25 pts

Severity	File	Line	Snippet	Context
LOW	core/internal/psql/query_test.go	159	"email": json.RawMessage(`"test@test.com"`),	CODE
LOW	core/internal/psql/linear_test.go	42	full_name: "John Doe",	CODE
LOW	core/internal/psql/linear_test.go	121	full_name: "Jane Doe",	CODE
LOW	core/internal/psql/update_test.go	189	"connect": { "id": 5, "email": "test@test.com" }	CODE
LOW	core/internal/psql/redshift_dialect_test.go	74	sql := compileRedshiftSQL(t, `mutation { users(id: 1, update: {phone: "555-0100"}) { id phone } }`)	CODE
LOW	core/internal/psql/redshift_dialect_test.go	75	for _, want := range []string{`INSERT INTO _gj_ids`, `UPDATE "public"."users" SET "phone" = CAST('555-0100' AS VARCHAR)	CODE
LOW	core/internal/qcode/qcode_test.go	175	products(where: { users: { email: { eq: "test@test.com" } } }) {	CODE
LOW	auth/auth_test.go	24	// "name": "John Doe",	COMMENT
LOW	auth/auth_test.go	43	assert.Equal(t, "John Doe", auth.UserName(c))	CODE
LOW⚡	tests/schema_diff_test.go	358	_, _ = db.Exec(fmt.Sprintf(`INSERT INTO "%s" (email, name) VALUES ('test@test.com', 'Test')`, tableName))	CODE
LOW⚡	tests/schema_diff_test.go	359	_, err = db.Exec(fmt.Sprintf(`INSERT INTO "%s" (email, name) VALUES ('test@test.com', 'Test2')`, tableName))	CODE
LOW⚡	tests/schema_diff_test.go	362	_, _ = db.Exec(fmt.Sprintf("INSERT INTO `%s` (email, name) VALUES ('test@test.com', 'Test')", tableName))	CODE
LOW⚡	tests/schema_diff_test.go	363	_, err = db.Exec(fmt.Sprintf("INSERT INTO `%s` (email, name) VALUES ('test@test.com', 'Test2')", tableName))	CODE
LOW⚡	tests/schema_diff_test.go	366	_, _ = db.Exec(fmt.Sprintf(`INSERT INTO "%s" (email, name) VALUES ('test@test.com', 'Test')`, tableName))	CODE
LOW⚡	tests/schema_diff_test.go	367	_, err = db.Exec(fmt.Sprintf(`INSERT INTO "%s" (email, name) VALUES ('test@test.com', 'Test2')`, tableName))	CODE
LOW	tests/redshift_surface_test.go	286	users(id: 710002, update: { phone: "555-7102" }) {	CODE
LOW	tests/redshift_surface_test.go	294	if !bytes.Contains(res.Data, []byte(`"id":710002`)) \|\| !bytes.Contains(res.Data, []byte(`"phone":"555-7102"`)) {	CODE
LOW	tests/redshift_surface_test.go	315	users(insert: { id: 710003, org_id: 1, email: "delete-redshift@example.com", phone: "555-7103" }) {	CODE
LOW	agent/remote_join_path_test.go	427	if !strings.Contains(err.Error(), "placeholder") {	CODE
LOW	serv/semantic_index_test.go	168	// the dummy-value guidance CONFIG.md already gives for keyless endpoints.	COMMENT
LOW	serv/mcp_contract_test.go	311	"emial": map[string]any{"eq": "admin@example.com"},	CODE

Structural Annotation Overuse12 hits · 20 pts

Severity	File	Line	Snippet	Context
LOW⚡	cmd/cmd_validate.go	61	// Step 1: Load configuration	COMMENT
LOW⚡	cmd/cmd_validate.go	69	// Step 2: Initialize GraphJin service (tests primary DB, Redis, core)	COMMENT
LOW	cmd/cmd_validate.go	106	// Step 3: Test additional databases (multi-DB mode)	COMMENT
LOW	core/internal/introspection/tables.go	959	// Step 1: Build per-table column sets and PK sets	COMMENT
LOW	core/internal/introspection/tables.go	976	// Step 2: For each table with no PK, find the best matching base table	COMMENT
LOW	core/internal/dialect/mssql.go	3219	// Step 1: Capture the IDs being disconnected into a variable	COMMENT
LOW	core/internal/dialect/mssql.go	3230	// Step 2: Perform the actual disconnect (UPDATE child SET fk = NULL)	COMMENT
LOW	core/internal/dialect/sqlite.go	984	// Step 1: SELECT to capture IDs matching the filter	COMMENT
LOW	core/internal/dialect/sqlite.go	1007	// Step 2: Determine relationship direction and perform appropriate UPDATE	COMMENT
LOW	core/internal/dialect/mongodb.go	4299	// Step 5: Final $project to select only requested fields from embedded elements	COMMENT
LOW	core/internal/dialect/oracle.go	1444	// Step 1: Capture the IDs being disconnected into a variable	COMMENT
LOW	core/internal/dialect/oracle.go	1464	// Step 2: Perform the actual disconnect (UPDATE child SET fk = NULL)	COMMENT

Unused Imports19 hits · 19 pts

Severity	File	Line	Context
LOW	training/measure.py	14	CODE
LOW	training/sft_from_export.py	19	CODE
LOW	training/policy_server.py	13	CODE
LOW	training/rollout_smoke.py	8	CODE
LOW	training/grpo_smoke.py	17	CODE
LOW	training/graphjin_env/client.py	10	CODE
LOW	training/graphjin_env/__init__.py	8	CODE
LOW	training/graphjin_env/__init__.py	8	CODE
LOW	training/graphjin_env/__init__.py	8	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/__init__.py	9	CODE
LOW	training/graphjin_env/step.py	20	CODE

AI Slop Vocabulary6 hits · 16 pts

Severity	File	Line	Snippet	Context
MEDIUM	core/gstate.go	419	// without performing schema validation. Uses the graph parser for robust parsing.	COMMENT
MEDIUM⚡	core/internal/jsn/test7.json	1	{"data":{"published":true,"body":"---\nsidebar: auto\n---\n# Guide to GraphJin\n\nGraphJin is a service that instantly a	CODE
LOW⚡	core/internal/jsn/test7.json	1	{"data":{"published":true,"body":"---\nsidebar: auto\n---\n# Guide to GraphJin\n\nGraphJin is a service that instantly a	CODE
MEDIUM⚡	core/internal/jsn/test7.json	1	{"data":{"published":true,"body":"---\nsidebar: auto\n---\n# Guide to GraphJin\n\nGraphJin is a service that instantly a	CODE
MEDIUM	core/internal/dialect/mssql.go	248	// To be robust, we strip the prefix if present before parsing.	COMMENT
MEDIUM	agent/mutation_column_repair.go	26	// lands, so the offer arrives with leverage the join repair never had.	COMMENT

Redundant / Tautological Comments5 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	install.sh	122	# Check if directory is in PATH	COMMENT
LOW	website/public/install.sh	123	# Check if directory is in PATH	COMMENT
LOW	website/static/install.sh	122	# Check if directory is in PATH	COMMENT
LOW	serv/config_docs/agentic.yml	19	# Set GJ_SECRETS_KEYSTORE_KEY to a base64-encoded 32-byte key before using	COMMENT
LOW	scripts/test-parallel.sh	134	# Print output for failed suites	COMMENT

AI Response Leakage1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH⚡	core/internal/jsn/test7.json	1	{"data":{"published":true,"body":"---\nsidebar: auto\n---\n# Guide to GraphJin\n\nGraphJin is a service that instantly a	CODE

Self-Referential Comments3 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	install.sh	240	echo " graphjin serve new myapp # Create a new project"	CODE
MEDIUM	website/public/install.sh	241	echo " graphjin serve new myapp # Create a new project"	CODE
MEDIUM	website/static/install.sh	240	echo " graphjin serve new myapp # Create a new project"	CODE

Example Usage Blocks3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	auth/auth.go	4	// Example usage:	COMMENT
LOW	serv/api.go	4	// Example usage:	COMMENT
LOW	scripts/test-parallel.sh	6	# Usage:	COMMENT

Modern Structural Boilerplate1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	training/graphjin_env/__init__.py	21	__all__ = [	CODE

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	serv/web/src/pages/AgentChat.jsx	763	function extractClarificationQuestion(answer) {	CODE

dosco/graphjin

Open-Source Code Quality, Security and Technical Debt Review