Home / grpc / grpc-java
AI Slop Code RIsk Monitor

grpc/grpc-java

The Java gRPC implementation. HTTP/2 based RPC

11.3 Moderate pattern signal View on GitHub

Maintenance and Governance Review

This report summarizes scanner evidence for grpc/grpc-java, a Java project with 12,075 GitHub stars. SynthScan examined 438,478 lines of code across 1822 source files, recording 556 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 11.3 (Moderate pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

11.3
Adjusted Signal
11.3
Raw Pattern Score
100%
Time Factor
2026-10-09
Last Push
12.1K
Stars
Java
Language
438.5K
Lines of Code
1.8K
Files
556
Pattern Hits
2026-10-12
Scan Date
0.27
HC Hit Rate

Risk Review · v3

Use each vector to guide manual verification of the underlying findings.

Cognitive Ownership Risk 0.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 56 finding(s).

Hallucinated Dependency & Supply Chain Risk 42.7/100 · MEDIUM

Are imports declared and package/API names verified? 500 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 2 finding(s).

PR Review Velocity Impact 43.6/100 · MEDIUM

Which changes need focused human review? 556 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 496HIGH 0MEDIUM 2LOW 58

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 556 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators496 hits · 4885 pts
SeverityFileLineSnippetContext
CRITICAL⚡…grpc/gcp/observability/interceptors/LogHelperTest.java187 io.grpc.observabilitylog.v1.Payload.newBuilder()CODE
CRITICAL⚡…grpc/gcp/observability/interceptors/LogHelperTest.java193 io.grpc.observabilitylog.v1.Payload.newBuilder()CODE
CRITICAL⚡…grpc/gcp/observability/interceptors/LogHelperTest.java199 io.grpc.observabilitylog.v1.Payload.newBuilder().putMetadata("a", DATA_A).build());CODE
CRITICAL⚡…grpc/gcp/observability/interceptors/LogHelperTest.java203 io.grpc.observabilitylog.v1.Payload.newBuilder().putMetadata("a", DATA_A).build());CODE
CRITICAL⚡…grpc/gcp/observability/interceptors/LogHelperTest.java206 io.grpc.observabilitylog.v1.Payload.newBuilder()CODE
CRITICAL⚡…grpc/gcp/observability/interceptors/LogHelperTest.java212 io.grpc.observabilitylog.v1.Payload.newBuilder()CODE
CRITICAL⚡…grpc/gcp/observability/interceptors/LogHelperTest.java219 io.grpc.observabilitylog.v1.Payload.newBuilder()CODE
CRITICAL…/io/grpc/gcp/observability/logging/GcpLogSinkTest.java84 .setPayload(io.grpc.observabilitylog.v1.Payload.newBuilder().setTimeout(TIMEOUT))CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java270 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java280 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java290 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java640 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java650 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java669 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java679 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java689 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java1035 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java1046 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java1056 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…grpc/opentelemetry/OpenTelemetryTracingModuleTest.java1066 io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java85 com.google.common.truth.Truth.assertThat(sink.getMeasuresSize()).isEqualTo(3);CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java87 com.google.common.truth.Truth.assertThat(sink.getMeasures().get(0).getMeasure())CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java90 com.google.common.truth.Truth.assertThat(sink.getMeasures().get(1).getMeasure())CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java93 com.google.common.truth.Truth.assertThat(sink.getMeasures().get(2).getMeasure())CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java123 com.google.common.truth.Truth.assertThat(sink.getMeasuresSize()).isEqualTo(3);CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java125 com.google.common.truth.Truth.assertThat(sink.getMeasures().get(0)).isNull();CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java127 com.google.common.truth.Truth.assertThat(sink.getMeasures().get(1)).isNull();CODE
CRITICAL⚡…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java129 com.google.common.truth.Truth.assertThat(sink.getMeasures().get(2)).isNull();CODE
CRITICAL…io/grpc/opentelemetry/OpenTelemetryMetricSinkTest.java441 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java308 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java352 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java484 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java544 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java575 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java659 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java858 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1027 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1119 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1172 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1177 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1287 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1292 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1353 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1358 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1423 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1428 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1489 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1494 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java1979 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2013 = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2106 io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2142 io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2176 io.opentelemetry.api.common.Attributes.of(METHOD_KEY, "other");CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2196 io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2238 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2282 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2326 io.opentelemetry.api.common.Attributes attributes = io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…grpc/opentelemetry/OpenTelemetryMetricsModuleTest.java2630 io.opentelemetry.api.common.Attributes.of(CODE
CRITICAL…/io/grpc/opentelemetry/OpenTelemetryMetricsModule.java353 AttributesBuilder builder = io.opentelemetry.api.common.Attributes.builder()CODE
CRITICAL…/io/grpc/opentelemetry/OpenTelemetryMetricsModule.java468 AttributesBuilder builder = io.opentelemetry.api.common.Attributes.builder()CODE
436 more matches not shown…
Over-Commented Block50 hits · 50 pts
SeverityFileLineSnippetContext
LOW…src/main/java/io/grpc/internal/ManagedChannelImpl.java261 // 1b delayedTransport.shutdown()COMMENT
LOW…rc/main/java/io/grpc/internal/SerializingExecutor.java101 try {COMMENT
LOW…/src/main/java/io/grpc/internal/ProxyDetectorImpl.java41import javax.annotation.Nullable;COMMENT
LOW…/src/main/java/io/grpc/internal/ProxyDetectorImpl.java61 // UNBREAK THE CONFIG FILE.COMMENT
LOW…/src/main/java/io/grpc/internal/ProxyDetectorImpl.java81 // coredump_dir /var/spool/squidCOMMENT
LOW…/src/main/java/io/grpc/internal/ProxyDetectorImpl.java101 //COMMENT
LOWistio-interop-testing/third_party/istio/import.sh1#!/bin/bashCOMMENT
LOW…/java/io/grpc/binder/internal/BinderTransportTest.java121COMMENT
LOW…/io/grpc/opentelemetry/OpenTelemetryTracingModule.java561COMMENT
LOW…rc/jmh/java/io/grpc/netty/InboundHeadersBenchmark.java141 private static void clientHandler(Blackhole bh, Http2Headers headers) {COMMENT
LOW…rc/jmh/java/io/grpc/netty/InboundHeadersBenchmark.java161 // long c = 10L;COMMENT
LOWautosharding/third_party/autosharding/import.sh1#!/bin/bashCOMMENT
LOWgradle/libs.versions.toml1[versions]COMMENT
LOWgradle/libs.versions.toml81javax-servlet-api = "javax.servlet:javax.servlet-api:4.0.1"COMMENT
LOW…o/grpc/examples/preserialized/PreSerializedServer.java101 responseObserver.onCompleted();COMMENT
LOW…xamples/manualflowcontrol/ManualFlowControlServer.java41 (ServerCallStreamObserver<HelloReply>) responseObserver;COMMENT
LOW…xamples/manualflowcontrol/ManualFlowControlClient.java61 //COMMENT
LOW…n/java/io/grpc/examples/keepalive/KeepAliveClient.java61COMMENT
LOW…n/java/io/grpc/examples/keepalive/KeepAliveServer.java41COMMENT
LOWbuildscripts/sonatype-upload.sh1#!/bin/bashCOMMENT
LOWbuildscripts/sonatype-upload.sh61COMMENT
LOWbuildscripts/sonatype-upload.sh121# -H "Authorization: Bearer ${USERPASS}" \COMMENT
LOWbuildscripts/sign-local-repo.sh1#!/bin/bashCOMMENT
LOWbuildscripts/observability-test/build_docker.sh1#!/bin/bashCOMMENT
LOWbuildscripts/observability-test/run.sh1#!/bin/bashCOMMENT
LOWbuildscripts/kokoro/psm-interop-build-java.sh1#!/usr/bin/env bashCOMMENT
LOWbuildscripts/kokoro/psm-interop-build-java.sh41 set +xCOMMENT
LOWbuildscripts/kokoro/unix.sh1#!/bin/bashCOMMENT
LOW…rc/context/java/io/grpc/ThreadLocalContextStorage.java41 @OverrideCOMMENT
LOW…n/java/io/grpc/okhttp/internal/OkHostnameVerifier.java181 // Invalid domain nameCOMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java101 TLS_DHE_DSS_WITH_AES_128_CBC_SHA256("TLS_DHE_DSS_WITH_AES_128_CBC_SHA256", 0x0040, 5246, 7, 21),COMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java121 // TLS_PSK_WITH_RC4_128_SHA("TLS_PSK_WITH_RC4_128_SHA", 0x008a, 4279, MAX_VALUE, MAX_VALUE),COMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java141 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256("TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", 0x009e, 5288, 8, 21),COMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java161 // TLS_DHE_PSK_WITH_AES_128_CBC_SHA256("TLS_DHE_PSK_WITH_AES_128_CBC_SHA256", 0x00b2, 5487, MAX_VALUE, MAX_VALUE),COMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java241 // TLS_RSA_WITH_ARIA_128_CBC_SHA256("TLS_RSA_WITH_ARIA_128_CBC_SHA256", 0xc03c, 6209, MAX_VALUE, MAX_VALUE),COMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java261 // TLS_RSA_WITH_ARIA_128_GCM_SHA256("TLS_RSA_WITH_ARIA_128_GCM_SHA256", 0xc050, 6209, MAX_VALUE, MAX_VALUE),COMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java281 // TLS_PSK_WITH_ARIA_128_CBC_SHA256("TLS_PSK_WITH_ARIA_128_CBC_SHA256", 0xc064, 6209, MAX_VALUE, MAX_VALUE),COMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java301 // TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256("TLS_ECDH_RSA_WITH_CAMELLIA_128_CBC_SHA256", 0xc078, 6367, MAX_VALUE, MAXCOMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java321 // TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256("TLS_ECDH_RSA_WITH_CAMELLIA_128_GCM_SHA256", 0xc08c, 6367, MAX_VALUE, MAXCOMMENT
LOW…ttp/main/java/io/grpc/okhttp/internal/CipherSuite.java341 // TLS_RSA_WITH_AES_128_CCM_8("TLS_RSA_WITH_AES_128_CCM_8", 0xc0a0, 6655, MAX_VALUE, MAX_VALUE),COMMENT
LOWxds/third_party/protoc-gen-validate/import.sh1#!/bin/bashCOMMENT
LOWxds/third_party/envoy/import.sh1#!/bin/bashCOMMENT
LOWxds/third_party/googleapis/import.sh1#!/bin/bashCOMMENT
LOWxds/third_party/cel-spec/import.sh1#!/bin/bashCOMMENT
LOWxds/third_party/xds/import.sh1#!/bin/bashCOMMENT
LOW…n/java/io/grpc/xds/WeightedRoundRobinLoadBalancer.java641 private final AtomicInteger sequence;COMMENT
LOW…c/main/java/io/grpc/xds/client/ControlPlaneClient.java161COMMENT
LOWcompiler/src/java_plugin/cpp/java_generator.cpp21// multiplied many times and could easily bloat binaries if added to withoutCOMMENT
LOWcompiler/src/java_plugin/cpp/java_generator.cpp41#include "java_generator.h"COMMENT
LOWcompiler/src/java_plugin/cpp/java_generator.cpp61#endifCOMMENT
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMbuildscripts/kokoro/psm-interop-build-java.sh17# This file defines psm::lang::build_docker_images, which is directly calledCOMMENT
MEDIUMbuildscripts/kokoro/unix.sh3# This file is used for both Linux and MacOS builds.COMMENT
Fake / Example Data4 hits · 4 pts
SeverityFileLineSnippetContext
LOW…/java/io/grpc/internal/DelayedClientTransportTest.java118 private final CallOptions callOptions = CallOptions.DEFAULT.withAuthority("dummy_value");CODE
LOW…src/test/java/io/grpc/internal/ClientCallImplTest.java381 final CallOptions callOptions = baseCallOptions.withAuthority("dummy_value");CODE
LOW…t/java/io/grpc/xds/WeightedTargetLoadBalancerTest.java188 Attributes.Key<Object> fakeKey = Attributes.Key.create("fake_key");CODE
LOW…rc/test/java/io/grpc/xds/ExtAuthzConfigParserTest.java57 Any.pack(AccessTokenCredentials.newBuilder().setToken("fake-token").build());CODE
Hyper-Verbose Identifiers2 hits · 2 pts
SeverityFileLineSnippetContext
LOW…o/grpc/xds/internal/extauthz/CheckResponseHandler.java39public class CheckResponseHandler {CODE
LOWxds/src/main/java/io/grpc/xds/client/XdsClientImpl.java1024 private class ResponseHandler implements XdsResponseHandler {CODE
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOW…p/main/java/io/grpc/okhttp/internal/proxy/HttpUrl.java333 // TODO: implement all label limits.COMMENT
Slop Phrases1 hit · 1 pts
SeverityFileLineSnippetContext
LOWxds/src/main/java/io/grpc/xds/CdsLoadBalancer2.java223 @CheckReturnValue // don't forget to return up the stack after the fail callCODE