Home / h2o / h2o
AI Slop Code Risk Monitor

h2o/h2o

SlopCodeMonitor badge for h2o/h2o Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

H2O - the optimized HTTP/1, HTTP/2, HTTP/3 server

1.8 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for h2o/h2o, a C project with 11,562 GitHub stars. SynthScan examined 507,589 lines of code across 1350 source files, recording 759 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 1.8 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

1.8
Adjusted Signal
1.8
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
11.6K
Stars
C
Language
507.6K
Lines of Code
1.4K
Files
759
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 6.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 651 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 13 finding(s).

Agent Over-Engineering Ratio 2.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 126 finding(s).

PR Review Velocity Impact 9.3/100 · LOW

Which changes need focused human review? 759 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 111LOW 647

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 759 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block594 hits · 574 pts
SeverityFileLineSnippetContext
LOWCMakeLists.txt1# Copyright (c) 2014,2015 DeNA Co., Ltd., Kazuho Oku, Brian Stanback, Laurentiu Nicola, Masanori Ogino, Ryosuke MatsumotCOMMENT
LOWmisc/tokens.pl1#! /bin/shCOMMENT
LOWmisc/embed_mruby_code.pl1#!/usr/bin/env perlCOMMENT
LOWmisc/mk-ca-bundle.pl1#!/usr/bin/perl -wCOMMENT
LOWmisc/mk-ca-bundle.pl21# *COMMENT
LOWmisc/mk-ca-bundle.pl341my $format = $opt_t ? "plain text and " : "";COMMENT
LOWmisc/mkhufftbl.py1#!/usr/bin/env pythonCOMMENT
LOWmisc/mkhufftbl.py21# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,COMMENT
LOWmisc/mruby-mtest/mrblib/mtest_unit.rb81 assert_respond_to obj, :empty?COMMENT
LOWinclude/h2o.h21 */COMMENT
LOWinclude/h2o.h41#include "h2o/hostinfo.h"COMMENT
LOWinclude/h2o.h61#endifCOMMENT
LOWinclude/h2o.h81#define H2O_DEFAULT_HTTP1_REQ_IO_TIMEOUT_IN_SECS 5COMMENT
LOWinclude/h2o/version.h21 */COMMENT
LOWinclude/h2o/version.h41#define H2O_LIBRARY_VERSION "0.16.0"COMMENT
LOWinclude/h2o/string_.h21 */COMMENT
LOWinclude/h2o/token_table.h21 */COMMENT
LOWinclude/h2o/token_table.h41#define H2O_TOKEN_ACCESS_CONTROL_ALLOW_ORIGIN (h2o__tokens + 14)COMMENT
LOWinclude/h2o/token_table.h61#define H2O_TOKEN_DATE (h2o__tokens + 34)COMMENT
LOWinclude/h2o/token_table.h81#define H2O_TOKEN_NO_EARLY_HINTS (h2o__tokens + 54)COMMENT
LOWinclude/h2o/httpclient.h21 */COMMENT
LOWinclude/h2o/http3_common.h21 */COMMENT
LOWinclude/h2o/http3_common.h41#define H2O_HTTP3_FRAME_TYPE_PRIORITY_UPDATE_PUSH 0xF0701COMMENT
LOWinclude/h2o/http3_common.h61#define H2O_HTTP3_ERROR_FRAME_UNEXPECTED QUICLY_ERROR_FROM_APPLICATION_ERROR_CODE(0x105)COMMENT
LOWinclude/h2o/http2_common.h21 */COMMENT
LOWinclude/h2o/http2_common.h41#define H2O_HTTP2_ERROR_INTERNAL -2COMMENT
LOWinclude/h2o/http2_common.h121#define H2O_HTTP2_FRAME_HEADER_SIZE 9COMMENT
LOWinclude/h2o/serverutil.h21 */COMMENT
LOWinclude/h2o/socketpool.h21 */COMMENT
LOWinclude/h2o/rand.h21 */COMMENT
LOWinclude/h2o/memory.h21 */COMMENT
LOWinclude/h2o/memory.h41#define H2O_ALIGNOF(type) (__alignof__(type))COMMENT
LOWinclude/h2o/memory.h61#define H2O_NORETURN _NoreturnCOMMENT
LOWinclude/h2o/http2.h21 */COMMENT
LOWinclude/h2o/openssl_backport.h41 memset(bm, 0, sizeof(*bm));COMMENT
LOWinclude/h2o/hiredis_.h21 */COMMENT
LOWinclude/h2o/socket.h21 */COMMENT
LOWinclude/h2o/socket.h41#include "h2o/openssl_backport.h"COMMENT
LOWinclude/h2o/socket.h61#define H2O_USE_NPN 0COMMENT
LOWinclude/h2o/socket/evloop.h21 */COMMENT
LOWt/injectaddr.c41 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS ORCOMMENT
LOWt/qif.c21 */COMMENT
LOWexamples/libh2o/latency-optimization.c21 */COMMENT
LOWexamples/libh2o/simple.c21 */COMMENT
LOWlib/handler/mruby.c21 * IN THE SOFTWARE.COMMENT
LOWlib/handler/fastcgi.c21 */COMMENT
LOWlib/handler/file.c21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGSCOMMENT
LOWlib/handler/access_log.c21 */COMMENT
LOWlib/handler/mruby/embedded/middleware.rb1# Copyright (c) 2017 Ichito Nagata, Fastly, Inc.COMMENT
LOWlib/handler/mruby/embedded/http_request.rb1# Copyright (c) 2015-2016 DeNA Co., Ltd., Kazuho OkuCOMMENT
LOWlib/handler/mruby/embedded/core.rb1# Copyright (c) 2014-2016 DeNA Co., Ltd., Kazuho Oku, Ryosuke Matsumoto,COMMENT
LOWlib/handler/mruby/embedded/channel.rb1# Copyright (c) 2017 Ritta NaritaCOMMENT
LOWlib/handler/mruby/embedded/sender.rb1# Copyright (c) 2014 DeNA Co., Ltd.COMMENT
LOWlib/handler/configurator/fastcgi.c21 */COMMENT
LOWlib/core/request.c21 */COMMENT
LOWlib/core/util.c21 */COMMENT
LOWlib/core/config.c21 */COMMENT
LOWlib/core/context.c21 */COMMENT
LOWlib/http2/hpack.c21 */COMMENT
LOWlib/common/http1client.c21 */COMMENT
534 more matches not shown…
Decorative Section Separators94 hits · 234 pts
SeverityFileLineSnippetContext
MEDIUMdeps/yaml/config/ltmain.sh169# ----------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh178# --------------------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh480# -------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh529# ---------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh575# ----------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh598# --------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh622# ------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh646# ------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh679# -------------------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh691# --------------------------------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh712# ----------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh731# --------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh740# ------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh776# -----------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh789# -----------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh801# -----------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh812# ---------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh838# ---------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh886# -------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh924# ------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1014# --------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1030# --------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1095# --------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1147# -------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1177# ---------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1207# -----------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1232# ------------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1261# ----------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1282# -------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1295# -----------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1308# ----------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1333# -----------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1350# ---------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1483# -----------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1495# ---------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1512# ------------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1523# ---------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1625# ---------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1648# --------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1672# ---------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1773# ------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1804# ----------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1832# ------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1845# ------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1880# -----------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1906# ----------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1919# ------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1939# ------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh1984# ----------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2004# -------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2083# ---------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2100 # ---------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2122# -------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2134# -----------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2154# -------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2175# -----------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2218# ------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2255# -----------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2306# ---------------------------------COMMENT
MEDIUMdeps/yaml/config/ltmain.sh2404# ---------------------------------COMMENT
34 more matches not shown…
Hyper-Verbose Identifiers31 hits · 38 pts
SeverityFileLineSnippetContext
LOWmisc/mkhufftbl.py416def huffman_tree_build_transition_table(ctx):STRING
LOWmisc/mkhufftbl.py460def huffman_tree_print_transition_table(ctx):STRING
LOW⚡deps/mruby/test/assert.rb332def assert_raise_with_message(*args, &block)CODE
LOW⚡deps/mruby/test/assert.rb335def assert_raise_with_message_pattern(*args, &block)CODE
LOW⚡deps/mruby/test/assert.rb338def _assert_raise_with_message(type, exc, exp_msg, msg = nil, &block)CODE
LOWdeps/mruby/test/t/module.rb24def assert_uninitialized_const(&block)CODE
LOWdeps/mruby/mrbgems/mruby-array-ext/test/array.rb4def assert_permutation_combination(exp, receiver, meth, *args)CODE
LOWdeps/mruby/mrbgems/mruby-array-ext/test/array.rb21def assert_repeated_permutation(exp, receiver, *args)CODE
LOWdeps/mruby/mrbgems/mruby-array-ext/test/array.rb25def assert_repeated_combination(exp, receiver, *args)CODE
LOWdeps/mruby/lib/mruby/build.rb381 def define_installer_if_needed(bin)CODE
LOW⚡deps/quicly/misc/qlog-adapter.py111def handle_data_blocked_receive(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py121def handle_handshake_done_receive(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py126def handle_handshake_done_send(event):CODE
LOWdeps/quicly/misc/qlog-adapter.py154def handle_max_streams_receive(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py165def handle_max_stream_data_receive(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py172def handle_max_stream_data_send(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py179def handle_new_connection_id_receive(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py188def handle_new_connection_id_send(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py216def handle_retire_connection_id_receive(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py222def handle_retire_connection_id_send(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py228def handle_stream_data_blocked_receive(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py235def handle_stream_data_blocked_send(event):CODE
LOW⚡deps/quicly/misc/qlog-adapter.py242def handle_stream_on_receive_reset(event):CODE
LOWdeps/quicly/misc/qlog-adapter.py267def handle_stream_on_send_stop(event):CODE
LOWdeps/quicly/misc/qlog-adapter.py274def handle_streams_blocked_receive(event):CODE
LOWdeps/quicly/misc/qlog-adapter.py285def handle_streams_blocked_send(event):CODE
LOWdeps/quicly/misc/qlog-adapter.py296def handle_transport_close_receive(event):CODE
LOWdeps/quicly/misc/qlog-adapter.py304def handle_transport_close_send(event):CODE
LOWdoc/search/oktavia-english-search.js1904function LoadedStringListMapResult() {CODE
LOWshare/h2o/mruby/bootstrap.rb29 def add_post_handler_generation_hook(hook)CODE
LOWshare/h2o/mruby/bootstrap.rb32 def call_post_handler_generation_hooks(handler)CODE
Self-Referential Comments14 hits · 27 pts
SeverityFileLineSnippetContext
MEDIUMdeps/picotls/deps/cifra/doc/conf.py6# This file is execfile()d with the current directory set to itsCOMMENT
MEDIUMdeps/mruby/test/assert.rb54# Create the assertion in a readable wayCOMMENT
MEDIUMdeps/mruby/mrbgems/mruby-struct/src/struct.c252 * # Create a structure with a name in StructCOMMENT
MEDIUMdeps/mruby/mrbgems/mruby-struct/src/struct.c256 * # Create a structure named by its constantCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh1402# This file is a library for parsing options in your shell scripts alongCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh2502# This function is only a basic sanity check; it will hardly flush outCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh2512# This function implements the same check as func_lalib_p withoutCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh2535# This function is only a basic sanity check; it will hardly flush outCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh2545# This function is only a basic sanity check; it will hardly flush outCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh2570# This function is only a basic sanity check; it will hardly flush outCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh2710# Create a libtool object file (analogous to a ".la" file),COMMENT
MEDIUMdeps/yaml/config/ltmain.sh7475 # Create the object directory.COMMENT
MEDIUMdeps/yaml/config/ltmain.sh10154 # Create the old-style object.COMMENT
MEDIUMdeps/yaml/config/ltmain.sh10174 # Create an invalid libtool object if no PIC, so that we don'tCOMMENT
Fake / Example Data9 hits · 10 pts
SeverityFileLineSnippetContext
LOWdeps/picotls/t/fusion.c132 static const char input[32] = "Lorem ipsum dolor sit amet, con";CODE
LOWdeps/picotls/t/fusion.c132 static const char input[32] = "Lorem ipsum dolor sit amet, con";CODE
LOWdeps/picotls/t/fusion.c175 "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor "; /* last 16 bytes are NUL CODE
LOWdeps/picotls/t/fusion.c175 "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor "; /* last 16 bytes are NUL CODE
LOWdeps/picotls/t/fusion.c203 "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut la";CODE
LOWdeps/picotls/t/fusion.c203 "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut la";CODE
LOWdeps/mruby/mrbgems/mruby-struct/src/struct.c527 * jane = Customer.new("Jane Doe", "456 Elm, Anytown NC", 12345)COMMENT
LOWdeps/mruby/doc/guides/mrbgems.md242 spec.author = 'John Doe'CODE
LOWdeps/mruby-json/src/parson.c571Example: "\u006Corem ipsum" -> lorem ipsum */CODE
AI Slop Vocabulary3 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMdeps/yaml/config/ltmain.sh331# Sed substitution that helps us do robust quoting. It backslashifiesCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh5227# Sed substitution that helps us do robust quoting. It backslashifiesCOMMENT
MEDIUMdeps/yaml/config/ltmain.sh9176 # This code stresses the "libraries are programs" paradigm to itsCOMMENT
Empty Error Handlers1 hit · 5 pts
SeverityFileLineSnippetContext
HIGHdeps/quicly/misc/quictrace-adapter.py187except OSError:CODE
Redundant / Tautological Comments6 hits · 4 pts
SeverityFileLineSnippetContext
LOWdeps/yaml/config/ltmain.sh623# Set func_arith_result to the result of evaluating TERMs.COMMENT
LOWdeps/yaml/config/ltmain.sh647# Set func_basename_result to FILE with everything up to and includingCOMMENT
LOWdeps/yaml/config/ltmain.sh813# Set func_len_result to the length of STRING. STRING may notCOMMENT
LOWdeps/yaml/config/ltmain.sh1031# Set func_relative_path_result to the relative path from SRCDIR to DSTDIR.COMMENT
LOWdeps/yaml/config/ltmain.sh3911 # Check if any of the arguments is a wrapper script.COMMENT
LOWdeps/yaml/config/ltmain.sh9877 # Loop over the list of objects to be linked.COMMENT
Unused Imports4 hits · 4 pts
SeverityFileLineSnippetContext
LOWmisc/mkhufftbl.py41CODE
LOWmisc/mkhufftbl.py43CODE
LOWdeps/quicly/misc/quictrace-adapter.py2CODE
LOWdeps/quicly/misc/quictrace-adapter.py9CODE
Slop Phrases2 hits · 2 pts
SeverityFileLineSnippetContext
LOWinclude/h2o/http2.h31/* don't forget to update SERVER_PREFACE when choosing non-default parameters */COMMENT
LOWdeps/mruby/src/gc.c484 arguments. Don't forget to remove the object usingCODE
Deep Nesting1 hit · 1 pts
SeverityFileLineSnippetContext
LOWmisc/mkhufftbl.py426CODE