AI Slop Code Risk Monitor

getsentry/XcodeBuildMCP

SlopCodeMonitor badge for getsentry/XcodeBuildMCP Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.

3.5 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for getsentry/XcodeBuildMCP, a TypeScript project with 6,531 GitHub stars. SynthScan examined 242,484 lines of code across 1778 source files, recording 778 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 3.5 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

3.5
Adjusted Signal
3.5
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
6.5K
Stars
TypeScript
Language
242.5K
Lines of Code
1.8K
Files
778
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 15.3/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 748 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.4/100 · LOW

Are imports declared and package/API names verified? 16 finding(s).

Agent Over-Engineering Ratio 14.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 717 finding(s).

PR Review Velocity Impact 15.4/100 · LOW

Which changes need focused human review? 778 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 11LOW 765

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 778 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers703 hits · 720 pts
SeverityFileLineSnippetContext
LOW.agents/skills/warden-sweep/scripts/organize.py66def identify_security_findings(CODE
LOW.agents/skills/warden-sweep/scripts/organize.py157def _has_sweep_complete_comment(issue_url: str) -> bool:CODE
LOW.agents/skills/warden-sweep/scripts/organize.py266def update_findings_with_pr_links(sweep_dir: str) -> None:CODE
LOWscripts/repro-mcp-lifecycle-leak.ts165async function runGracefulStdinIteration(closeDelayMs: number): Promise<IterationResult> {CODE
LOWscripts/repro-mcp-lifecycle-leak.ts201async function runParentHardExitIteration(closeDelayMs: number): Promise<IterationResult> {CODE
LOWsrc/doctor-cli.ts15function shouldUseNonRedactedOutput(argv: string[]): boolean {CODE
LOWsrc/test-utils/mock-executors.ts34export function createMockCommandResponse(CODE
LOWsrc/test-utils/mock-executors.ts147export function createCommandMatchingMockExecutor(CODE
LOWsrc/test-utils/mock-executors.ts215export function createMockInteractiveSpawner(CODE
LOWsrc/test-utils/mock-executors.ts297export function createMockFileSystemExecutor(CODE
LOWsrc/test-utils/mock-executors.ts337export function createNoopFileSystemExecutor(): FileSystemExecutor {CODE
LOWsrc/test-utils/mock-executors.ts427export function createNoopInteractiveSpawner(): InteractiveSpawner {CODE
LOWsrc/test-utils/mock-executors.ts443export function createMockEnvironmentDetector(CODE
LOWsrc/test-utils/test-helpers.ts42export function createMockToolHandlerContext(): {CODE
LOWsrc/test-utils/test-helpers.ts187export function expectPendingBuildResponse(CODE
LOWsrc/core/structured-output-schema.ts99function collectAndRewriteCommonRefs(value: unknown, pendingDefs: Set<string>): unknown {CODE
LOWsrc/core/structured-output-schema.ts206function inlineRegistrationSchemaResource(schema: JsonObject): {CODE
LOWsrc/core/structured-output-schema.ts244function getMcpOutputSchemaForRegistrationJson(ref: StructuredOutputSchemaRef): JsonObject {CODE
LOWsrc/core/structured-output-schema.ts275export function getMcpOutputSchemaForRegistration(ref: StructuredOutputSchemaRef): McpOutputSchema {CODE
LOWsrc/core/resource-root.ts9export function resetResourceRootCacheForTests(): void {CODE
LOWsrc/core/resource-root.ts56function getExecutableResourceRoot(): string | null {CODE
LOWsrc/core/resource-root.ts93export function getStructuredOutputSchemasDir(): string {CODE
LOWsrc/core/manifest/load-manifest.ts251export function getWorkflowMetadataFromManifest(): Record<CODE
LOWsrc/core/__tests__/structured-output-schema.test.ts15function expectNoExternalCommonRefs(schema: JsonObject): void {CODE
LOWsrc/core/__tests__/structured-output-schema.test.ts28function stripRegistrationResourceEnvelope(schema: JsonObject): JsonObject {CODE
LOWsrc/visibility/exposure.ts19export function isWorkflowAvailableForRuntime(CODE
LOWsrc/visibility/exposure.ts33export function isWorkflowEnabledForRuntime(CODE
LOWsrc/visibility/exposure.ts50export function isToolAvailableForRuntime(tool: ToolManifestEntry, runtime: RuntimeKind): boolean {CODE
LOWsrc/visibility/exposure.ts112export function getDefaultEnabledWorkflows(CODE
LOWsrc/visibility/exposure.ts133export function isResourceAvailableForRuntime(CODE
LOWsrc/visibility/exposure.ts147export function isResourceExposedForRuntime(CODE
LOWsrc/snapshot-tests/json-harness.ts9export async function createMcpJsonSnapshotHarness(CODE
LOWsrc/snapshot-tests/tool-manifest-resolver.ts14export function resolveSnapshotToolManifest(CODE
LOWsrc/snapshot-tests/xcode-ide-availability.ts6export function isXcodeIdeBridgeAvailable(): boolean {CODE
LOWsrc/snapshot-tests/xcode-ide-availability.ts22export async function listAvailableXcodeIdeBridgeToolNames(): Promise<Set<string>> {CODE
LOWsrc/snapshot-tests/mcp-tool-contract-fixtures.ts116export function expectMcpToolContractFixtures(CODE
LOWsrc/snapshot-tests/fixture-io.ts279export function expectResultMatchesFixture(CODE
LOWsrc/snapshot-tests/fixture-io.ts310export function createResultFixtureMatcher(CODE
LOWsrc/snapshot-tests/output-parsers.ts35export function extractAppPathFromSnapshotOutput(output: string): string {CODE
LOWsrc/snapshot-tests/output-parsers.ts48export function extractAppPathFromSnapshotResult(result: SnapshotResult): string {CODE
LOWsrc/snapshot-tests/output-parsers.ts57export function extractProcessIdFromSnapshotOutput(output: string): number {CODE
LOWsrc/snapshot-tests/output-parsers.ts70export function extractProcessIdFromSnapshotResult(result: SnapshotResult): number {CODE
LOWsrc/snapshot-tests/codex-031-input-schema.ts7function deserializeToolInputSchema(value: unknown): JsonObject {CODE
LOWsrc/snapshot-tests/json-normalize.ts165function isSystemDebugStackLocation(displayLocation: string): boolean {CODE
LOWsrc/snapshot-tests/json-normalize.ts174function normalizeDebugStackDisplayLocation(displayLocation: string): string {CODE
LOWsrc/snapshot-tests/json-normalize.ts220function normalizeDebugStackFrames(items: unknown[]): unknown[] {CODE
LOWsrc/snapshot-tests/json-normalize.ts244function normalizeBuildSettingsEntryKey(key: string): string {CODE
LOWsrc/snapshot-tests/json-normalize.ts252function normalizeBuildSettingsEntryValue(CODE
LOWsrc/snapshot-tests/json-normalize.ts352function normalizeDiagnosticTestFailure(item: unknown): unknown {CODE
LOWsrc/snapshot-tests/json-normalize.ts367function normalizeDiagnosticTestFailures(items: unknown[]): unknown[] {CODE
LOWsrc/snapshot-tests/json-normalize.ts377function isSpringBoardHomeCompactCapture(value: Record<string, unknown>): boolean {CODE
LOWsrc/snapshot-tests/json-normalize.ts390function normalizeSpringBoardHomeCompactCapture(CODE
LOWsrc/snapshot-tests/json-normalize.ts493function normalizeXcodeBridgeCallEnvelope(CODE
LOWsrc/snapshot-tests/json-normalize.ts515export function normalizeStructuredEnvelope(CODE
LOWsrc/snapshot-tests/json-normalize.ts535export function formatStructuredEnvelopeFixture(CODE
LOWsrc/snapshot-tests/json-schema-validation.ts214function assertLocalReferencesResolve(value: unknown, root: unknown, label: string): void {CODE
LOWsrc/snapshot-tests/json-schema-validation.ts250function validateRegisteredOutputSchema(CODE
LOWsrc/snapshot-tests/json-schema-validation.ts310export function createStructuredFixtureSchemaValidator(): StructuredFixtureSchemaValidator {CODE
LOWsrc/snapshot-tests/normalize.ts141function normalizeDoctorProcessTree(text: string): string {CODE
LOWsrc/snapshot-tests/normalize.ts148function trimVolatileDebugStackPrefix(text: string): string {CODE
643 more matches not shown…
Structural Annotation Overuse19 hits · 40 pts
SeverityFileLineSnippetContext
LOW⚡.agents/skills/warden-sweep/references/patch-prompt.md15### Step 1: Understand the codeCOMMENT
LOW⚡.agents/skills/warden-sweep/references/patch-prompt.md18### Step 2: Apply a minimal fixCOMMENT
LOW⚡.agents/skills/warden-sweep/references/patch-prompt.md21### Step 3: Write testsCOMMENT
LOW⚡.agents/skills/warden-sweep/references/patch-prompt.md29### Step 4: Self-reviewCOMMENT
LOW⚡.agents/skills/warden-sweep/references/patch-prompt.md38### Step 5: CommitCOMMENT
LOW.agents/skills/warden-sweep/references/patch-prompt.md50### Step 6: OutputCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py358 # Step 1: Identify security findingsCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py366 # Step 2: Label security PRsCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py374 # Step 3: Update finding reports with PR linksCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py378 # Step 4: Copy security finding reports (after PR links are added)COMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py381 # Step 5: Generate summary and reportCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py385 # Step 6: Update tracking issue with PR resultsCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py389 # Step 7: Update manifestCOMMENT
LOW⚡skills/mobilebuildmcp/SKILL.md24## Step 1: Establish Session ContextCOMMENT
LOW⚡skills/mobilebuildmcp/SKILL.md32## Step 2: Understand Workflow-Scoped Tool AvailabilityCOMMENT
LOW⚡skills/mobilebuildmcp/SKILL.md38## Step 3: Report Context ClearlyCOMMENT
LOWskills/mobilebuildmcp-cli/SKILL.md10## Step 1: Ensure the CLI ExistsCOMMENT
LOWskills/mobilebuildmcp-cli/SKILL.md32## Step 2: Use Help-First DiscoveryCOMMENT
LOWskills/mobilebuildmcp-cli/SKILL.md44## Step 3: Keep Execution MinimalCOMMENT
Verbosity Indicators7 hits · 16 pts
SeverityFileLineSnippetContext
LOW⚡.agents/skills/warden-sweep/scripts/organize.py358 # Step 1: Identify security findingsCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py366 # Step 2: Label security PRsCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py374 # Step 3: Update finding reports with PR linksCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py378 # Step 4: Copy security finding reports (after PR links are added)COMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py381 # Step 5: Generate summary and reportCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py385 # Step 6: Update tracking issue with PR resultsCOMMENT
LOW⚡.agents/skills/warden-sweep/scripts/organize.py389 # Step 7: Update manifestCOMMENT
Modern AI Meta-Vocabulary7 hits · 14 pts
SeverityFileLineSnippetContext
MEDIUM.agents/skills/warden/references/config-schema.md17maxTurns = 50 # Max agentic turns per hunkCODE
MEDIUM…ut/mobilebuildmcp.output.scaffold-result/2.schema.json3 "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outpuCODE
MEDIUM…ut/mobilebuildmcp.output.scaffold-result/1.schema.json3 "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outpuCODE
MEDIUM…s/session-defaults-enabled/scaffold_macos_project.json96 "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outCODE
MEDIUM…cts/session-defaults-enabled/scaffold_ios_project.json117 "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outCODE
MEDIUM…/session-defaults-disabled/scaffold_macos_project.json96 "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outCODE
MEDIUM…ts/session-defaults-disabled/scaffold_ios_project.json117 "$id": "https://raw.githubusercontent.com/getsentry/MobileBuildMCP/main/schemas/structured-output/mobilebuildmcp.outCODE
Unused Imports11 hits · 10 pts
SeverityFileLineSnippetContext
LOW.agents/skills/warden-sweep/scripts/index_prs.py21CODE
LOW.agents/skills/warden-sweep/scripts/index_prs.py26CODE
LOW.agents/skills/warden-sweep/scripts/extract_findings.py18CODE
LOW.agents/skills/warden-sweep/scripts/organize.py27CODE
LOW.agents/skills/warden-sweep/scripts/find_reviewers.py19CODE
LOW.agents/skills/warden-sweep/scripts/generate_report.py16CODE
LOW.agents/skills/warden-sweep/scripts/create_issue.py20CODE
LOW.agents/skills/warden-sweep/scripts/scan.py23CODE
LOW.agents/skills/warden-sweep/scripts/scan.py35CODE
LOW.agents/skills/warden-sweep/scripts/_utils.py2CODE
LOWbenchmarks/claude-ui/parse_claude_conversation.py12CODE
Decorative Section Separators3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUMsrc/cli/commands/__tests__/upgrade.test.ts153 // ── Pure helpers ──────────────────────────────────────────────────────COMMENT
MEDIUMsrc/cli/commands/__tests__/upgrade.test.ts452 // ── Command flow ──────────────────────────────────────────────────────COMMENT
MEDIUMsrc/cli/commands/__tests__/upgrade.test.ts891 // ── Canonical latest release lookup ───────────────────────────────COMMENT
Deep Nesting7 hits · 7 pts
SeverityFileLineSnippetContext
LOW.agents/skills/warden-sweep/scripts/extract_findings.py38CODE
LOW.agents/skills/warden-sweep/scripts/extract_findings.py111CODE
LOW.agents/skills/warden-sweep/scripts/scan.py122CODE
LOW.agents/skills/warden-sweep/scripts/scan.py201CODE
LOW.agents/skills/warden-sweep/scripts/scan.py228CODE
LOW.agents/skills/warden-sweep/scripts/scan.py400CODE
LOWbenchmarks/claude-ui/parse_claude_conversation.py108CODE
Excessive Try-Catch Wrapping6 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUM.agents/skills/warden-sweep/scripts/extract_findings.py106 print(f"Error reading {log_path}: {e}", file=sys.stderr)CODE
LOW.agents/skills/warden-sweep/scripts/organize.py321 except Exception as e:CODE
LOW.agents/skills/warden-sweep/scripts/scan.py86 except Exception:CODE
LOW.agents/skills/warden-sweep/scripts/scan.py118 except Exception:CODE
LOW.agents/skills/warden-sweep/scripts/scan.py312 except Exception as e:CODE
LOW.agents/skills/warden-sweep/scripts/scan.py345 except Exception as e:CODE
Redundant / Tautological Comments4 hits · 6 pts
SeverityFileLineSnippetContext
LOW.agents/skills/warden-sweep/scripts/organize.py287 # Check if PR section already appendedCOMMENT
LOWscripts/release.sh347# Check if working directory is clean outside release-managed filesCOMMENT
LOWscripts/release.sh402# Check if package.json already has this version (from previous attempt)COMMENT
LOWscripts/bundle-axe.sh55 # Check if build succeededCOMMENT
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGH.agents/skills/warden-sweep/scripts/_utils.py98except (subprocess.TimeoutExpired, FileNotFoundError):CODE
Cross-Language Confusion (JS/TS)1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHsrc/mcp/tools/ui-automation/screenshot.ts124 print("\\(b["Width"] as? Int ?? 0),\\(b["Height"] as? Int ?? 0)")CODE
Fake / Example Data4 hits · 4 pts
SeverityFileLineSnippetContext
LOW…tools/ui-automation/__tests__/runtime-snapshot.test.ts34 AXValue: 'user@example.com',CODE
LOW…tools/ui-automation/__tests__/runtime-snapshot.test.ts67 value: 'user@example.com',CODE
LOWsrc/mcp/tools/ui-automation/__tests__/type_text.test.ts69 { simulatorId, elementRef: 'e1', text: 'user@example.com' },CODE
LOWsrc/mcp/tools/ui-automation/__tests__/type_text.test.ts88 ['/mocked/axe/path', 'type', 'user@example.com', '--udid', simulatorId],CODE
Modern Structural Boilerplate4 hits · 4 pts
SeverityFileLineSnippetContext
LOW.agents/skills/warden-sweep/scripts/organize.py172def update_tracking_issue(sweep_dir: str) -> None:CODE
LOW.agents/skills/warden-sweep/scripts/organize.py266def update_findings_with_pr_links(sweep_dir: str) -> None:CODE
LOW.agents/skills/warden-sweep/scripts/organize.py325def update_manifest(sweep_dir: str) -> None:CODE
LOW.agents/skills/warden-sweep/scripts/scan.py384def update_manifest_phase(sweep_dir: str, phase: str, status: str) -> None:CODE
Over-Commented Block1 hit · 1 pts
SeverityFileLineSnippetContext
LOW…ample_projects/iOS/MCPTestUITests/MCPTestUITests.swift1import XCTestCOMMENT