AI Slop Code Risk Monitor

ipfs/kubo

SlopCodeMonitor badge for ipfs/kubo Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

IPFS implementation in Go: a daemon that stores and serves content-addressed data, with a CLI, HTTP Gateway, and RPC API

2.4 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for ipfs/kubo, a Go project with 17,164 GitHub stars. SynthScan examined 161,381 lines of code across 804 source files, recording 192 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 2.4 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

2.4
Adjusted Signal
2.4
Raw Pattern Score
100%
Time Factor
2026-10-28
Last Push
17.2K
Stars
Go
Language
161.4K
Lines of Code
804
Files
192
Pattern Hits
2026-10-31
Scan Date
0.01
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.1/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 140 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.1/100 · LOW

Are imports declared and package/API names verified? 9 finding(s).

Agent Over-Engineering Ratio 3.4/100 · LOW

Are wrappers, guards, and repeated structures necessary? 43 finding(s).

PR Review Velocity Impact 10.4/100 · LOW

Which changes need focused human review? 192 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 7HIGH 1MEDIUM 47LOW 137

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 192 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block114 hits · 114 pts
SeverityFileLineSnippetContext
LOWtracing/doc.go1// Package tracing contains the tracing logic for go-ipfs, including configuring the tracer andCOMMENT
LOWtracing/doc.go21// - OTEL_EXPORTER_OTLP_PROTOCOLCOMMENT
LOWtracing/doc.go41// a full Jaeger stack and configure Kubo to publish traces to it:COMMENT
LOWtracing/doc.go61//COMMENT
LOWcore/builder.go21type FXNodeInfo struct {COMMENT
LOWcore/builder.go141 // TODO: How soon will bootstrap move to libp2p?COMMENT
LOWcore/corehttp/gateway.go301COMMENT
LOWcore/corehttp/corehttp.go81// Serve accepts incoming HTTP connections on the listener and passes themCOMMENT
LOWcore/coreiface/unixfs.go81 Get(context.Context, path.Path) (files.Node, error)COMMENT
LOWcore/coreiface/unixfs.go101 Ls(context.Context, path.Path, chan<- DirEntry, ...options.UnixfsLsOption) errorCOMMENT
LOWcore/coreiface/name.go21// IPNS is a PKI namespace, where names are the hashes of public keys, and theCOMMENT
LOWcore/commands/provide.go201COMMENT
LOWcore/commands/provide.go781COMMENT
LOWcore/commands/ls.go281}COMMENT
LOWcore/commands/refs.go221 var count intCOMMENT
LOWcore/commands/keystore.go301// therefore written in place.COMMENT
LOWcore/commands/dag/import.go121COMMENT
LOWcore/commands/dag/export.go161// CARv1 stream.COMMENT
LOWcore/commands/cmdenv/cidbase.go61}COMMENT
LOWcore/commands/cmdenv/env.go101// - If Provide.DHT.SweepEnabled=true or OptimisticProvide=true, we make anCOMMENT
LOWcore/commands/cmdenv/env.go121// - wait: whether to block until provide completes (sync mode)COMMENT
LOWcore/commands/cmdenv/env.go201// Context handling:COMMENT
LOWcore/node/provider.go101const consecutiveAlertsThreshold = 3COMMENT
LOWcore/node/provider.go121 // can happen if the provider is closed or if the node is currently OfflineCOMMENT
LOWcore/node/provider.go141 // The keys are not deleted from the keystore, so they will continue to beCOMMENT
LOWcore/node/provider.go661 // In no-schedule mode the on-disk keystore is never used. If aCOMMENT
LOWcore/node/provider.go721 }COMMENT
LOWcore/node/provider.go1321COMMENT
LOWcore/node/storage.go121COMMENT
LOWcore/node/p2pforge_resolver.go21// falls back to network DNS. This ensures future <peerID>.libp2p.direct recordsCOMMENT
LOWcore/node/libp2p/routingopt.go321// httpRouterAddrFunc returns a function that resolves provider addresses forCOMMENT
LOWcore/node/libp2p/addrs.go61// listenAddrs must be already-resolved interface addresses (output ofCOMMENT
LOWcore/node/libp2p/addrs.go141 return "", falseCOMMENT
LOWcore/node/libp2p/addrs.go201// MonitorDeadListeners runs findDeadListeners at startup and on everyCOMMENT
LOWtest/ipfs-test-lib.sh81}COMMENT
LOWtest/sharness/t0051-object.sh41 # only manipulates ProtoNode links without updating UnixFS metadata.COMMENT
LOWtest/sharness/t0095-refs.sh1#!/usr/bin/env bashCOMMENT
LOWtest/sharness/t0095-refs.sh21# L2- D 1.txt B 2.txtCOMMENT
LOWtest/sharness/t0095-refs.sh41# added QmU6xujRsYzcrkocuR3fhfnkZBB8eyUFFq4WKRGw2aS15h ACOMMENT
LOWtest/sharness/t0116-gateway-cache.sh1#!/usr/bin/env bashCOMMENT
LOWtest/sharness/t0114-gateway-subdomains/README.md101# RSA_IPNS_IDv0=QmVujd5Vb7moysJj8itnGufN7MEtPRCNHkKpNuA4onsRa3COMMENT
LOWtest/cli/add_test.go601// createDirectoryForHAMTLinksEstimation creates a directory with the specified numberCOMMENT
LOWtest/cli/provider_test.go1421 // dagwalker: bloom creation logCOMMENT
LOWtest/cli/provider_test.go1821// cancellation as shutdown-caused and logs at Debug asCOMMENT
LOWtest/cli/cid_profiles_test.go61COMMENT
LOWtest/cli/dag_layout_test.go21//COMMENT
LOWtest/cli/key_test.go21// same interoperable format. Regenerate with:COMMENT
LOWtest/cli/pubsub_test.go41 }COMMENT
LOWtest/cli/dag_test.go501 // leaves 2 blocks. Asserting the exact count proves --offline wasCOMMENT
LOWtest/cli/update_test.go161 t.Parallel()COMMENT
LOWtest/cli/update_test.go321 "binary at %s should contain the extracted archive content", tmpBinPath)COMMENT
LOWtest/cli/update_test.go481// "ipfs update check" and "ipfs update versions" without touching theCOMMENT
LOWtest/cli/block_size_test.go21 twoMiBPlus = twoMiB + 1 // 2097153COMMENT
LOWtest/cli/block_size_test.go201 t.Run("ipfs add non-raw-leaves", func(t *testing.T) {COMMENT
LOWtest/cli/provide_stats_test.go41// Tests will naturally fail if upstream removes/renames fields we depend on.COMMENT
LOWtest/cli/fuse/realworld_test.go1//go:build (linux || darwin || freebsd) && !nofuseCOMMENT
LOWtest/cli/harness/log.go21func (e events) Len() int { return len(e) }COMMENT
LOWtest/cli/harness/dht_stub_peers.go21// queries GET_PROVIDERS from any peer, it finds the record becauseCOMMENT
LOWtest/cli/autoconf/extensibility_test.go21// 1. New systems can be added via AutoConf's SystemRegistryCOMMENT
LOWtest/cli/autoconf/expand_comprehensive_test.go1// Package autoconf provides comprehensive tests for --expand-auto functionality.COMMENT
54 more matches not shown…
Decorative Section Separators43 hits · 111 pts
SeverityFileLineSnippetContext
MEDIUMtest/sharness/t0114-gateway-subdomains.sh10## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh12## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh83## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh85## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh128## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh131## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh206## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh209## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh292## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh294## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh324## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh327## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh342# =============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh466# ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh497# ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh521## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh573# =============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh599## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh601## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh616# =============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh646## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh649## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh740## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh742## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh773## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh775## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh807## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh809## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh890## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh892## ============================================================================COMMENT
MEDIUMtest/sharness/t0114-gateway-subdomains.sh908# =============================================================================COMMENT
MEDIUMtest/sharness/t0109-gateway-web-_redirects.sh10## ============================================================================COMMENT
MEDIUMtest/sharness/t0109-gateway-web-_redirects.sh12## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh10## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh12## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh30## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh32## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh68## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh70## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh109## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh111## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh160## ============================================================================COMMENT
MEDIUMtest/sharness/t0115-gateway-dir-listing.sh162## ============================================================================COMMENT
Hallucination Indicators7 hits · 100 pts
SeverityFileLineSnippetContext
CRITICAL⚡core/node/groups.go117 enableTCPTransport := cfg.Swarm.Transports.Network.TCP.WithDefault(true)CODE
CRITICAL⚡core/node/groups.go118 enableWebsocketTransport := cfg.Swarm.Transports.Network.Websocket.WithDefault(true)CODE
CRITICAL⚡core/node/groups.go119 enableRelayTransport := cfg.Swarm.Transports.Network.Relay.WithDefault(true) // nolintCODE
CRITICALcore/node/bitswap.go134 maxProviders = int(in.Cfg.Internal.Bitswap.ProviderSearchMaxResults.WithDefault(DefaultMaxProviders))CODE
CRITICAL⚡plugin/plugins/telemetry/telemetry.go565 p.event.ProvideDHTSweepEnabled = p.config.Provide.DHT.SweepEnabled.WithDefault(config.DefaultProvideDHTSweepEnabled)CODE
CRITICAL⚡plugin/plugins/telemetry/telemetry.go566 p.event.ProvideDHTIntervalCustom = !p.config.Provide.DHT.Interval.IsDefault()CODE
CRITICAL⚡plugin/plugins/telemetry/telemetry.go567 p.event.ProvideDHTMaxWorkersCustom = !p.config.Provide.DHT.MaxWorkers.IsDefault()CODE
Structural Annotation Overuse11 hits · 19 pts
SeverityFileLineSnippetContext
LOWtest/cli/autoconf/autoconf_test.go423 // Step 1: Create bootstrap node (target for connections)COMMENT
LOWtest/cli/autoconf/autoconf_test.go443 // Step 2: Create autoconf server that returns bootstrap node's addressCOMMENT
LOWtest/cli/autoconf/autoconf_test.go466 // Step 3: Create autoconf-enabled node that should connect to bootstrap nodeCOMMENT
LOW⚡test/cli/autoconf/autoconf_test.go479 // Step 4: Give time for autoconf resolution and connection attemptsCOMMENT
LOW⚡test/cli/autoconf/autoconf_test.go482 // Step 5: Verify both nodes are responsiveCOMMENT
LOW⚡test/cli/autoconf/autoconf_test.go489 // Step 6: Verify that autoconf node connected to bootstrap nodeCOMMENT
LOWtest/cli/autoconf/autoconf_test.go511 // Step 7: Verify bootstrap configuration still shows "auto" (not resolved values)COMMENT
LOWdocs/add-code-flow.md55### Step 1: ChunkingCOMMENT
LOWdocs/add-code-flow.md75### Step 2: Building the DAGCOMMENT
LOWdocs/add-code-flow.md111### Step 3: Storing BlocksCOMMENT
LOWdocs/add-code-flow.md118### Step 4: PinningCOMMENT
Verbosity Indicators7 hits · 13 pts
SeverityFileLineSnippetContext
LOWtest/cli/autoconf/autoconf_test.go423 // Step 1: Create bootstrap node (target for connections)COMMENT
LOWtest/cli/autoconf/autoconf_test.go443 // Step 2: Create autoconf server that returns bootstrap node's addressCOMMENT
LOWtest/cli/autoconf/autoconf_test.go466 // Step 3: Create autoconf-enabled node that should connect to bootstrap nodeCOMMENT
LOW⚡test/cli/autoconf/autoconf_test.go479 // Step 4: Give time for autoconf resolution and connection attemptsCOMMENT
LOW⚡test/cli/autoconf/autoconf_test.go482 // Step 5: Verify both nodes are responsiveCOMMENT
LOW⚡test/cli/autoconf/autoconf_test.go489 // Step 6: Verify that autoconf node connected to bootstrap nodeCOMMENT
LOWtest/cli/autoconf/autoconf_test.go511 // Step 7: Verify bootstrap configuration still shows "auto" (not resolved values)COMMENT
AI Response Leakage1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHtracing/doc.go60// # In this example the Jaeger UI is available at http://localhost:16686.COMMENT
AI Slop Vocabulary2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMcmd/ipfs/kubo/daemon.go465 // Private setups can't leverage peers returned by default IPNIs (Routing.Type=auto)COMMENT
MEDIUM.github/workflows/gotest.yml189 # under the harness temp dir (ipfs/ipns/mfs subdirectories).COMMENT
Self-Referential Comments2 hits · 6 pts
SeverityFileLineSnippetContext
MEDIUMtest/sharness/t0114-gateway-subdomains.sh28 # Create a raw URL version with IP to ensure hostname from Host header is usedCOMMENT
MEDIUMtest/sharness/t0250-files-api.sh70 # Create the files in reverse (unsorted) order (`seq 100 -1 1`)COMMENT
Example Usage Blocks2 hits · 3 pts
SeverityFileLineSnippetContext
LOWbin/push-docker-tags.sh15# Usage:COMMENT
LOWbin/get-docker-tags.sh5# Usage:COMMENT
Fake / Example Data2 hits · 2 pts
SeverityFileLineSnippetContext
LOWtest/cli/provider_test.go1777 fmt.Sprintf("/provider/keystore/%d/fake-key-%d", i%2, i),CODE
LOWtest/cli/provider_test.go1800 key := fmt.Sprintf("/provider/keystore/%d/fake-key-%d", i%2, i)CODE
Redundant / Tautological Comments1 hit · 1 pts
SeverityFileLineSnippetContext
LOWcore/commands/log.go87 ipfs log level all info # Set ALL to 'info' (including default)CODE