AI Slop Code Risk Monitor

graphql/graphql-js

SlopCodeMonitor badge for graphql/graphql-js Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

A reference implementation of GraphQL for JavaScript

1.1 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for graphql/graphql-js, a TypeScript project with 20,344 GitHub stars. SynthScan examined 158,715 lines of code across 556 source files, recording 161 pattern matches distributed across 6 syntactic categories. The legacy adjusted pattern signal is 1.1 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.1
Adjusted Signal
1.1
Raw Pattern Score
100%
Time Factor
2026-10-30
Last Push
20.3K
Stars
TypeScript
Language
158.7K
Lines of Code
556
Files
161
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 155 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.6/100 · LOW

Are imports declared and package/API names verified? 6 finding(s).

Agent Over-Engineering Ratio 4.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 144 finding(s).

PR Review Velocity Impact 5.6/100 · LOW

Which changes need focused human review? 161 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 3MEDIUM 3LOW 155

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 161 distinct pattern matches across 6 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers144 hits · 138 pts
SeverityFileLineSnippetContext
LOWresources/build-npm.ts253function buildPlatformConditionalExports(CODE
LOWresources/change-extension-in-import-paths.ts22export function changeExtensionInImportPaths(config: {CODE
LOWresources/change-extension-in-import-paths.ts70export function changeExtensionInImportPathsInBundle(config: {CODE
LOWresources/benchmark/statistics.ts82export function havePairwiseComparisonsStabilized(CODE
LOWresources/benchmark/statistics.ts113function computeRelativeMarginOfError(samples: ReadonlyArray<number>): number {CODE
LOW…es/eslint-internal-rules/require-public-api-exports.js77 function reportUnexpectedInternalDoc(node, name) {CODE
LOW…es/eslint-internal-rules/require-public-api-exports.js194function unwrapExportedDeclaration(statement) {CODE
LOW…es/eslint-internal-rules/require-public-api-exports.js453function isDocumentableDeclaration(node) {CODE
LOW…lint-internal-rules/require-graphql-public-api-docs.js12function requireGraphqlPublicApiDocs(context) {CODE
LOW…lint-internal-rules/require-graphql-public-api-docs.js128function unwrapExportedDeclaration(statement) {CODE
LOW…lint-internal-rules/require-graphql-public-api-docs.js198function isDocumentableDeclaration(node) {CODE
LOW⚡website/generate-api.js1782function signatureArrayElementTypeSource(type, ctx) {CODE
LOW⚡website/generate-api.js1791function signatureTypeArgumentsSource(type, ctx) {CODE
LOW⚡website/generate-api.js1798function signatureSourceTypeEquivalent(type, ctx) {CODE
LOW⚡website/generate-api.js1874function signatureInterfaceTypeSource(node, packagePath, ctx) {CODE
LOW⚡website/generate-api.js1881function signatureObjectTypeSource(members, ctx) {CODE
LOW⚡website/generate-api.js1887function signatureInterfaceMemberSource(member, packagePath, ctx) {CODE
LOWwebsite/generate-api.js384function collectDeclarationDefaults(metadata, statement, packagePath) {CODE
LOWwebsite/generate-api.js1159function typeLiteralIndexSignature(signature, options = {}) {CODE
LOWwebsite/generate-api.js1471function renderScannedSignatureSource(source, renderToken) {CODE
LOWwebsite/generate-api.js1503function renderLeadingWhitespaceToken(token, tokenText, atLineStart) {CODE
LOWwebsite/generate-api.js1510function createSignatureSourceContext(options = {}) {CODE
LOWwebsite/generate-api.js1522function withSignatureSourceContext(ctx, overrides) {CODE
LOWwebsite/generate-api.js1580function renderFormattedSignatureSource(source, ctx) {CODE
LOWwebsite/generate-api.js1586function renderFormattedSignatureToken(token, tokenText, ctx) {CODE
LOWwebsite/generate-api.js1601async function formatInterfaceMemberSource(memberSource) {CODE
LOWwebsite/generate-api.js1636function signatureTypeParametersSource(node, ctx) {CODE
LOWwebsite/generate-api.js1646function signatureTypeParameterSource(param, ctx) {CODE
LOWwebsite/generate-api.js1661function signatureParametersSource(signature, ctx, options = {}) {CODE
LOWwebsite/generate-api.js1669function signatureParameterDeclarationSource(CODE
LOWwebsite/generate-api.js1685function signatureFunctionTypeSource(signature, ctx) {CODE
LOWwebsite/generate-api.js1918function signatureReflectionTypeSource(node, ctx) {CODE
LOWwebsite/generate-api.js1939function signatureTypeLiteralIndexSignatureSource(signature, ctx) {CODE
LOWwebsite/generate-api.js1953function signatureIndexSignatureSource(CODE
LOWwebsite/generate-api.js1966function signatureTypedPropertySource(name, optional, type, ctx) {CODE
LOWwebsite/generate-api.js1972function signaturePropertyNameSource(name, ctx) {CODE
LOWwebsite/generate-api.js2063function signatureTypeNodeParameterSource(param, packagePath, ctx) {CODE
LOWwebsite/generate-api.js2143async function renderSignatureDeclaration(CODE
LOWwebsite/generate-api.js2166async function renderConstructorDeclaration(signature, options = {}) {CODE
LOWwebsite/generate-api.js2186async function renderTypeAliasDeclaration(node, options = {}) {CODE
LOWwebsite/generate-api.js2421function tableWithOptionalDescription(headers, rows) {CODE
LOWwebsite/generate-api.js2510async function renderInterfaceDeclaration(node, options = {}) {CODE
LOWwebsite/generate-api.js3076function assertAllItemsCategorized(docs) {CODE
LOWwebsite/generate-api.js3172function isLeadingLineCommentTrivia(value) {CODE
LOWwebsite/generate-api.js3273function exposePublicOverloadSignatures(dir) {CODE
LOWwebsite/generate-api.js3300function publicOverloadImplementationJSDocRanges(ast, content) {CODE
LOWwebsite/generate-api.js3364function stripCoverageIgnoreComments(dir) {CODE
LOWwebsite/generate-api.js3425function assertUniqueMajorVersions(sources) {CODE
LOWintegrationTests/diagnostics-bun/test.js145function runExecuteRootSelectionSetCase() {CODE
LOW…egrationTests/diagnostics-deno-with-node-build/test.js145function runExecuteRootSelectionSetCase() {CODE
LOW…egrationTests/diagnostics-deno-with-deno-build/test.js145function runExecuteRootSelectionSetCase() {CODE
LOWsrc/diagnostics.ts290function resolveDiagnosticsChannel(): DiagnosticsChannelModule | undefined {CODE
LOWsrc/graphql.ts261function validateAndExecute(CODE
LOWsrc/graphql.ts284function checkValidationAndExecute(CODE
LOWsrc/language/lexer.ts680function readEscapedUnicodeVariableWidth(CODE
LOWsrc/language/lexer.ts715function readEscapedUnicodeFixedWidth(CODE
LOWsrc/language/predicates.ts59export function isExecutableDefinitionNode(CODE
LOWsrc/language/predicates.ts86export function isSubscriptionOperationDefinitionNode(CODE
LOWsrc/language/predicates.ts212export function isTypeSystemDefinitionNode(CODE
LOWsrc/language/predicates.ts265export function isTypeSystemExtensionNode(CODE
84 more matches not shown…
Cross-Language Confusion (JS/TS)3 hits · 15 pts
SeverityFileLineSnippetContext
HIGHsrc/utilities/__tests__/TypeInfo-test.ts366 print(parse('{ human(id: 4) { name, pets }, alien }')),CODE
HIGHsrc/utilities/__tests__/TypeInfo-test.ts370 print(CODE
HIGHsrc/type/scalars.ts298 print(valueNode),CODE
Over-Commented Block7 hits · 7 pts
SeverityFileLineSnippetContext
LOWwebsite/next-env.d.ts1/// <reference types="next" />COMMENT
LOW.github/workflows/ci.yml261 - name: Run denoDist package publish dry-run checksCOMMENT
LOWsrc/language/lexer.ts281 //COMMENT
LOWsrc/execution/incremental/__tests__/stream-test.ts2661 // treated as still belonging to the outer @defer instead of to the streamCOMMENT
LOW…tion/legacyIncremental/__tests__/legacy-stream-test.ts2121 // Validation rejects the overlapping @stream selections. SeeCOMMENT
LOW…ion/rules/DeferStreamDirectiveOnValidOperationsRule.ts261// - Continue to the next {selection} in {selectionSet}.COMMENT
LOW…ion/rules/DeferStreamDirectiveOnValidOperationsRule.ts281// - Let {fragmentSelectionSet} be the selection set of {selection}.COMMENT
AI Slop Vocabulary3 hits · 7 pts
SeverityFileLineSnippetContext
MEDIUMwebsite/package-lock.json8418 "resolved": "https://registry.npmjs.org/robust-predicates/-/robust-predicates-3.0.2.tgz",CODE
MEDIUMwebsite/pages/api-v17/graphql/_meta.ts16 href: '/api-v17/graphql#category-harness',CODE
MEDIUMsrc/validation/__tests__/ScalarLeafsRule-test.ts67 // We can't leverage expectErrors since it doesn't support passing in theCOMMENT
Fake / Example Data3 hits · 4 pts
SeverityFileLineSnippetContext
LOWsrc/jsutils/keyMap.ts15 * { name: 'Jon', num: '555-1234' },COMMENT
LOWsrc/jsutils/keyValMap.ts12 * { name: 'Jon', num: '555-1234' },COMMENT
LOWsrc/jsutils/keyValMap.ts20 * ); // => { Jon: '555-1234', Jenny: '867-5309' }COMMENT
Slop Phrases1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/utilities/buildClientSchema.ts62 * This function expects a complete introspection result. Don't forget to checkCOMMENT