XGo is a programming language that reads like plain English. But it's also incredibly powerful — it lets you leverage assets from C/C++, Go, Python, and JavaScript/TypeScript, creating a unified software engineering ecosystem. Our vision is to enable everyone to become a builder of the world.
This report summarizes scanner evidence for goplus/xgo, a Go project with 9,492 GitHub stars. SynthScan examined 88,500 lines of code across 408 source files, recording 159 pattern matches distributed across 3 syntactic categories. The legacy adjusted pattern signal is 1.6 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 159 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 0 finding(s).
Which changes need focused human review? 159 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 159 distinct pattern matches across 3 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | all.bash | 1 | #! /usr/bin/env bash | COMMENT |
| LOW | make.bash | 1 | #! /usr/bin/env bash | COMMENT |
| LOW | token/types.go | 21 | COMMENT | |
| LOW | token/types.go | 41 | // equivalent to comparing the respective source file offsets. If p and q | COMMENT |
| LOW | dql/reflects/node.go | 141 | // - $name | COMMENT |
| LOW | dql/fetcher/pkg.go.dev/importedBy/xgo_autogen.go | 21 | // New extracts the number of packages that import the given package from | COMMENT |
| LOW | dql/json/json.go | 41 | // New creates a JSON NodeSet from JSON data read from r. | COMMENT |
| LOW | dql/yaml/yaml.go | 41 | // New creates a YAML NodeSet from YAML data read from r. | COMMENT |
| LOW | printer/printer.go | 521 | // comment line is indented, all but the first line have some form of space prefix). | COMMENT |
| LOW | printer/printer.go | 581 | prefix = prefix[0:i] | COMMENT |
| LOW | printer/printer.go | 821 | p.indent = 0 | COMMENT |
| LOW | printer/printer.go | 881 | if pos.IsValid() { | COMMENT |
| LOW | printer/nodes.go | 61 | // Print as many newlines as necessary (but at least min newlines) to get to | COMMENT |
| LOW | printer/nodes.go | 221 | // initialize expression/key size: a zero value indicates expr/key doesn't fit on a single line | COMMENT |
| LOW | printer/nodes.go | 701 | } | COMMENT |
| LOW | printer/nodes.go | 721 | // expressions (function calls, parenthesized exprs), and apply these rules: | COMMENT |
| LOW | printer/nodes.go | 1701 | // The keepTypeColumn function determines if the type column of a series of | COMMENT |
| LOW | printer/nodes.go | 1801 | // contain a backward- or double-quoted path string that does | COMMENT |
| LOW | printer/nodes.go | 2061 | defer func(level int) { | COMMENT |
| LOW | tpl/token/types.go | 21 | ) | COMMENT |
| LOW | tpl/scanner/scanner.go | 121 | // It is ok to re-use the same file when re-scanning the same file as | COMMENT |
| LOW | tpl/scanner/scanner.go | 721 | // Scan scans the next token and returns the token position, the token, | COMMENT |
| LOW | parser/parser_xgo.go | 121 | return ParseFSEntry(fset, fsx.Local, filename, src, conf) | COMMENT |
| LOW | parser/interface.go | 61 | goReservedFlags Mode = ((1 << 16) - 1) | COMMENT |
| LOW | parser/interface.go | 121 | COMMENT | |
| LOW | parser/interface.go | 161 | // report an error if there's more tokens. | COMMENT |
| LOW | parser/parser.go | 361 | } | COMMENT |
| LOW | parser/parser.go | 2401 | return p.parseLiteralValueOrMapComprehension() | COMMENT |
| LOW | parser/parser.go | 2881 | // once we have found the end of the unary expression. There | COMMENT |
| LOW | format/format.go | 41 | const parserMode = parser.ParseComments | COMMENT |
| LOW | ast/ast_xgo.go | 61 | // It appears as the Type field of *TypeSpec when the syntax | COMMENT |
| LOW | ast/ast_xgo.go | 141 | COMMENT | |
| LOW | ast/ast_xgo.go | 501 | } | COMMENT |
| LOW | ast/ast_xgo.go | 701 | COMMENT | |
| LOW | ast/resolve.go | 61 | ident.Obj = obj | COMMENT |
| LOW | ast/filter.go | 421 | // times in different package files; only at | COMMENT |
| LOW | ast/ast.go | 21 | import ( | COMMENT |
| LOW | ast/ast.go | 981 | // specNode() ensures that only spec nodes can be | COMMENT |
| LOW | ast/commentmap.go | 121 | return top | COMMENT |
| LOW | doc/string.md | 401 | s := "Hello" | COMMENT |
| LOW | doc/docs.md | 741 | // 0 | COMMENT |
| LOW | cl/stmt.go | 701 | } | COMMENT |
| LOW | cl/stmt.go | 801 | cb.SetComments(comments, once) | COMMENT |
| LOW | cl/stmt.go | 901 | } | COMMENT |
| LOW | cl/compile.go | 81 | // if the call result is not a constant, the recorded type is | COMMENT |
| LOW | cl/compile.go | 101 | // expression F(int(1)) to the inferred type arguments [int], and resulting | COMMENT |
| LOW | cl/compile.go | 121 | // For an embedded field, Use maps the *TypeName it denotes. | COMMENT |
| LOW | cl/compile.go | 141 | COMMENT | |
| LOW | cl/compile.go | 161 | // *ast.CaseClause | COMMENT |
| LOW | cl/internal/test/case.go | 41 | // by calling runtime.Goexit (which then runs all deferred calls in the | COMMENT |
| LOW | cl/internal/test/case.go | 81 | // SkipNow marks the test as having been skipped and stops its execution | COMMENT |
| LOW | cl/internal/test/case.go | 101 | // first called order. | COMMENT |
| LOW | cl/cltest/recorder.go | 21 | COMMENT | |
| LOW | cl/cltest/recorder.go | 41 | // expression x.f is found only in the Selections map, the | COMMENT |
| LOW | cl/cltest/recorder.go | 61 | } | COMMENT |
| LOW | cl/cltest/recorder.go | 81 | } | COMMENT |
| LOW | cl/cltest/recorder.go | 101 | // Thus, the package scope can be found in the type-checked Package object. | COMMENT |
| LOW | scanner/scanner.go | 121 | // scanner at the beginning of src. The scanner uses the file set file | COMMENT |
| LOW | scanner/scanner.go | 801 | // If the returned token is a literal (token.IDENT, token.INT, token.FLOAT, | COMMENT |
| LOW | x/typesutil/gopinfo.go | 41 | // For (possibly parenthesized) identifiers denoting built-in | COMMENT |
| 90 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | doc/contributing.md | 38 | ### Step 1: Fork the upstream repository | COMMENT |
| LOW | doc/contributing.md | 47 | ### Step 2: Clone the forked repository | COMMENT |
| LOW | doc/contributing.md | 59 | ### Step 3: Create a new branch | COMMENT |
| LOW | doc/contributing.md | 74 | ### Step 4: Make the changes | COMMENT |
| LOW | doc/contributing.md | 82 | ### Step 5: Commit and push | COMMENT |
| LOW | doc/contributing.md | 101 | ### Step 6: Open a pull request | COMMENT |
| LOW | doc/contributing.md | 111 | ### Step 7: Engage with feedback | COMMENT |
| LOW | doc/contributing.md | 129 | ### Step 8: Do post-merge cleanup | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | parser/parser.go | 1118 | // it here for more robust parsing and better error messages | COMMENT |