A native gRPC client & server implementation with async/await support.
This report summarizes scanner evidence for grpc/grpc-rust, a Rust project with 12,490 GitHub stars. SynthScan examined 126,333 lines of code across 516 source files, recording 565 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 4.2 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 561 finding(s).
Are imports declared and package/API names verified? 2 finding(s).
Are wrappers, guards, and repeated structures necessary? 2 finding(s).
Which changes need focused human review? 565 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 565 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | grpc-protobuf/src/lib.rs | 141 | /// across threads), | COMMENT |
| LOW | grpc-protobuf/src/lib.rs | 161 | /// | COMMENT |
| LOW | grpc-protobuf/src/status.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc-protobuf/src/status.rs | 41 | /// from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments | COMMENT |
| LOW | grpc-protobuf/src/status.rs | 61 | AlreadyExists = 6, | COMMENT |
| LOW | grpc-protobuf/src/status.rs | 81 | /// (a) Use `UNAVAILABLE` if the client can retry just the failing call. | COMMENT |
| LOW | grpc-protobuf/src/status.rs | 101 | /// be fixed if the system state changes. For example, a 32-bit file | COMMENT |
| LOW | grpc-protobuf/src/server/client_streaming.rs | 41 | use crate::server::GrpcStreamingRequest; | COMMENT |
| LOW | grpc-protobuf/src/server/server_streaming.rs | 41 | use crate::server::GrpcStreamingResponse; | COMMENT |
| LOW | grpc-protobuf/src/server/mod.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc-protobuf/src/client/mod.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc-protobuf/src/client/mod.rs | 101 | /// allow for sending the request message. Returns an error if the stream | COMMENT |
| LOW | …gen-rust-grpc/src/cpp_source/src/grpc_rust_generator.h | 1 | // Copyright 2025 gRPC authors. | COMMENT |
| LOW | …gen-rust-grpc/src/cpp_source/src/grpc_rust_generator.h | 101 | // | COMMENT |
| LOW | tonic-build/src/manual.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | tonic-build/src/manual.rs | 41 | //! .input_type("crate::HelloRequest") | COMMENT |
| LOW | tonic-build/src/manual.rs | 61 | path::{Path, PathBuf}, | COMMENT |
| LOW | tonic-build/src/manual.rs | 261 | /// This builder can be used to manually define gRPC method, which can be added to a gRPC service, | COMMENT |
| LOW | tonic-build/src/manual.rs | 301 | impl MethodBuilder { | COMMENT |
| LOW | tonic-build/src/lib.rs | 61 | COMMENT | |
| LOW | tonic-build/src/lib.rs | 141 | pub fn push_mod(&mut self, pattern: impl Into<String>, attr: impl Into<String>) { | COMMENT |
| LOW | grpc-xds/build.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc-xds/src/lib.rs | 41 | pub(crate) mod generated { | COMMENT |
| LOW | grpc-xds/src/xds_config.rs | 41 | RouteSource, VirtualHost, | COMMENT |
| LOW | grpc-xds/src/xds_config.rs | 161 | pub(crate) resolution_note: Option<Arc<str>>, | COMMENT |
| LOW | grpc-xds/src/resource/listener.rs | 41 | const HTTP_CONNECTION_MANAGER_TYPE_URL: &str = "type.googleapis.com/envoy.extensions.filters.network.http_connection_man | COMMENT |
| LOW | grpc-xds/src/resource/cluster.rs | 41 | // config once the dependency manager and LB policies exist to consume them. | COMMENT |
| LOW | grpc/src/send_future.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/send_future.rs | 41 | /// analysis incorrectly believes it is held across the await. | COMMENT |
| LOW | grpc/src/send_future.rs | 61 | /// | COMMENT |
| LOW | grpc/src/lib.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/attributes.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/attributes.rs | 81 | } | COMMENT |
| LOW | grpc/src/macros.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/macros.rs | 41 | /// are unmodified.** By default: | COMMENT |
| LOW | grpc/src/macros.rs | 61 | /// } | COMMENT |
| LOW | grpc/src/macros.rs | 81 | /// // Include message code. | COMMENT |
| LOW | grpc/src/macros.rs | 121 | /// | COMMENT |
| LOW | grpc/src/core/mod.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/codec/compression.rs | 41 | /// | COMMENT |
| LOW | grpc/src/codec/compression/gzip.rs | 121 | } | COMMENT |
| LOW | grpc/src/server/mod.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/server/mod.rs | 81 | Self::default() | COMMENT |
| LOW | grpc/src/server/mod.rs | 121 | /// closes the underlying socket/channel and rejects new incoming connections | COMMENT |
| LOW | grpc/src/server/mod.rs | 221 | /// not notified to shut down gracefully; they run until completion or client | COMMENT |
| LOW | grpc/src/server/mod.rs | 361 | /// documentation for information about the different types of items and the | COMMENT |
| LOW | grpc/src/server/mod.rs | 421 | /// Represents the receiving side of a server stream. | COMMENT |
| LOW | grpc/src/rt/mod.rs | 61 | COMMENT | |
| LOW | grpc/src/status/status_code.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/status/status_code.rs | 41 | COMMENT | |
| LOW | grpc/src/status/status_code.rs | 61 | /// even if the operation has completed successfully. For example, a | COMMENT |
| LOW | grpc/src/status/status_code.rs | 81 | /// instead for those errors). This error code does not imply the | COMMENT |
| LOW | grpc/src/status/status_code.rs | 101 | /// fails because the directory is non-empty, `FAILED_PRECONDITION` | COMMENT |
| LOW | grpc/src/status/status_code.rs | 121 | /// There is a fair bit of overlap between `FAILED_PRECONDITION` and | COMMENT |
| LOW | grpc/src/client/channel.rs | 101 | /// | COMMENT |
| LOW | grpc/src/client/channel.rs | 181 | // Optional values. | COMMENT |
| LOW | grpc/src/client/mod.rs | 21 | * IN THE SOFTWARE. | COMMENT |
| LOW | grpc/src/client/mod.rs | 81 | /// A gRPC channel begins in the `Idle` state. When an RPC is attempted or when | COMMENT |
| LOW | grpc/src/client/mod.rs | 141 | } | COMMENT |
| LOW | grpc/src/client/mod.rs | 241 | /// SendStream will do nothing. | COMMENT |
| 494 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | examples/data/tls/create.sh | 3 | # Create the server CA certs. | COMMENT |
| MEDIUM | examples/data/tls/create.sh | 15 | # Create the client CA certs. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | grpc-xds/src/resource/route.rs | 29 | // TODO: implement request routing components (virtual-host domain matching, then | COMMENT |
| LOW | grpc/src/client/load_balancing/mod.rs | 405 | // TODO: implement me. | COMMENT |
| LOW | grpc/src/client/load_balancing/mod.rs | 409 | // TODO: implement me. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/check_license.py | 142 | except Exception as e: | CODE |
| MEDIUM | tools/check_license.py | 168 | print(f"Error running git ls-files: {e}", file=sys.stderr) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tonic/src/codec/decode.rs | 336 | /// # Return value | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/check_license.py | 10 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tonic/Cargo.toml | 57 | # harness = false | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tonic-xds/src/xds/resource/san_matcher.rs | 301 | matcher: Some(exact("user@example.com")), | CODE |