AI Slop Code Risk Monitor

dunglas/mercure

Name: dunglas/mercure — Go Code Quality & Security Review | AI Slop Code Risk Monitor
Creator: AI Slop Code Risk Monitor

Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

🪽 An open, easy, fast, reliable and battery-efficient solution for real-time communications

1.1 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for dunglas/mercure, a Go project with 5,356 GitHub stars. SynthScan examined 41,694 lines of code across 251 source files, recording 44 pattern matches distributed across 2 syntactic categories. The legacy adjusted pattern signal is 1.1 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.1

Adjusted Signal

1.1

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

5.4K

Stars

Language

41.7K

Lines of Code

251

Files

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 43 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 1 finding(s).

PR Review Velocity Impact 5.1/100 · LOW

Which changes need focused human review? 44 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 0LOW 44

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 44 distinct pattern matches across 2 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block43 hits · 43 pts

Severity	File	Line	Snippet	Context
LOW	subscription.go	81	Type string `json:"type"`	COMMENT
LOW	subscription.go	101	// against this hub, a mistake every other conforming hub would expose.	COMMENT
LOW	authorizationclaims_deprecated.go	1	//go:build deprecated_claim	COMMENT
LOW	authorizationdetails.go	41	// authorizationDetail is one entry of the RFC 9396 authorization_details	COMMENT
LOW	subscribe.go	461	// declaring a media type the hub cannot read.	COMMENT
LOW	hub.go	41	// ErrMissingIssuerIdentifier is returned when an issuer is configured in modern	COMMENT
LOW	hub.go	61		COMMENT
LOW	hub.go	121	}	COMMENT
LOW	bearererror.go	21	// with a 401 and a bare RFC 6750 Bearer challenge, advertising the protected	COMMENT
LOW	bearererror.go	81	}	COMMENT
LOW	matcher_deprecated.go	1	//go:build deprecated_topic	COMMENT
LOW	subscriber.go	21	// SubscribedMatchers are the topic matchers from the topic and	COMMENT
LOW	subscriber.go	141	// per RFC 3986 path rules — and (c) matches a URI Template `{var}`	COMMENT
LOW	claimrequirestopic_deprecated.go	1	//go:build deprecated_claim && !deprecated_topic	COMMENT
LOW	resourcemetadata.go	21	// separate publisher and subscriber key sets.	COMMENT
LOW	jwtkeyfunc.go	21	// resource metadata. Leave false for self-issued tokens (a key shared out	COMMENT
LOW	authorization.go	41	const (	COMMENT
LOW	topicmatcher.go	141	// field. It is a NUL byte, which the publish and subscribe handlers reject in	COMMENT
LOW	matcherclaim.go	61	// UnmarshalJSON handles both string and object formats in JWT claims.	COMMENT
LOW	publish.go	61	// Validate enforces the publish-side input rules that protect subscribers	COMMENT
LOW	subscribematchers.go	21	// selects that matcher type; bare "match" defaults to Exact, mirroring the	COMMENT
LOW	subscribematchers.go	41	errUnknownMatcherParam = errors.New("unknown topic matcher query parameter")	COMMENT
LOW	conformance-tests/playwright.config.ts	61	name: "webkit",	COMMENT
LOW	conformance-tests/playwright.config.ts	81	/* Test against branded browsers. */	COMMENT
LOW	charts/mercure/values.yaml	1	# Default values for mercure.	COMMENT
LOW	charts/mercure/values.yaml	21	# -- Origins the hub answers on (`public_urls`), others get `421 Misdirected Request`.	COMMENT
LOW	charts/mercure/values.yaml	41	# valueFrom:	COMMENT
LOW	charts/mercure/values.yaml	101	replicaCount: 1 # @schema minimum:1	COMMENT
LOW	charts/mercure/values.yaml	141	create: true	COMMENT
LOW	charts/mercure/values.yaml	221	# @default -- See [values.yaml](values.yaml).	COMMENT
LOW	charts/mercure/values.yaml	241	annotations: {}	COMMENT
LOW	charts/mercure/values.yaml	261	# filters:	COMMENT
LOW	charts/mercure/values.yaml	281	# # Supplying `rules` opts out of the auto-default. Use	COMMENT
LOW	charts/mercure/values.yaml	301	# - Ingress	COMMENT
LOW	charts/mercure/values.yaml	321	# kubernetes.io/metadata.name: kube-system	COMMENT
LOW	charts/mercure/values.yaml	341	# - matchLabels:	COMMENT
LOW	charts/mercure/values.yaml	361	# - port: "53"	COMMENT
LOW	charts/mercure/values.yaml	381	# cpu: 100m	COMMENT
LOW	charts/mercure/values.yaml	401	# name: mercure_subscribers_connected	COMMENT
LOW	charts/mercure/values.yaml	421	# -- [Affinity](https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity) con	COMMENT
LOW	charts/mercure/values.yaml	441	enabled: false	COMMENT
LOW	.github/linters/.markdown-lint.yml	1	---	COMMENT
LOW	caddy/mercure.go	201	CookieName string `json:"cookie_name,omitempty"`	COMMENT

Excessive Try-Catch Wrapping1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	docs/use-cases/async-jobs.md	145	except Exception:	CODE