Home / ktorio / ktor
AI Slop Code Risk Monitor

ktorio/ktor

SlopCodeMonitor badge for ktorio/ktor Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Framework for quickly creating connected applications in Kotlin with minimal effort

0.7 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for ktorio/ktor, a Kotlin project with 14,559 GitHub stars. SynthScan examined 327,963 lines of code across 2599 source files, recording 87 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 0.7 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

0.7
Adjusted Signal
0.7
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
14.6K
Stars
Kotlin
Language
328.0K
Lines of Code
2.6K
Files
87
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 1.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 55 finding(s).

Hallucinated Dependency & Supply Chain Risk 1.8/100 · LOW

Are imports declared and package/API names verified? 22 finding(s).

Agent Over-Engineering Ratio 0.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 12 finding(s).

PR Review Velocity Impact 3.2/100 · LOW

Which changes need focused human review? 87 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 11HIGH 0MEDIUM 13LOW 63

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 87 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hallucination Indicators11 hits · 110 pts
SeverityFileLineSnippetContext
CRITICAL…st-server/src/main/kotlin/test/server/tests/Cookies.kt25 val text = call.request.cookies.rawCookies.entries.joinToString()CODE
CRITICAL…tor-test-base/jvm/src/io/ktor/test/junit/Assertions.kt19 org.junit.jupiter.api.Assertions.assertTrue(predicate(item), message)CODE
CRITICAL…jvm/test/io/ktor/tests/server/netty/NettyEngineTest.kt475 call.respond(object : io.ktor.http.content.OutgoingContent.WriteChannelContent() {CODE
CRITICAL…m/test/io/ktor/tests/server/netty/NettySpecificTest.kt849 val headers = io.netty.handler.codec.http2.DefaultHttp2Headers().also {CODE
CRITICAL…m/test/io/ktor/tests/server/netty/NettySpecificTest.kt855 io.netty.handler.codec.http2.DefaultHttp2HeadersEncoder().encodeHeaders(streamId, headers, encoded)CODE
CRITICAL…jvm/src/io/ktor/server/netty/NettyApplicationEngine.kt436 .applicationProtocols(*io.netty.handler.codec.http3.Http3.supportedApplicationProtocols())CODE
CRITICAL…o/ktor/tests/server/tomcat/jakarta/TomcatEngineTest.kt115 private fun org.apache.catalina.startup.Tomcat.addAttributesFilter() {CODE
CRITICAL…m/test/io/ktor/tests/server/tomcat/TomcatEngineTest.kt117 private fun org.apache.catalina.startup.Tomcat.addAttributesFilter() {CODE
CRITICAL…c/io/ktor/openapi/ir/inference/CallReceiveInference.kt13 val packageFqName = call.symbol.owner.parent.kotlinFqName.asString()CODE
CRITICAL…c/io/ktor/openapi/ir/inference/CallRespondInference.kt23 val packageFqName = call.symbol.owner.parent.kotlinFqName.asString()CODE
CRITICAL…src/io/ktor/openapi/ir/inference/ParameterInference.kt60 val packageFqName = call.symbol.owner.parent.kotlinFqName.asString()CODE
Over-Commented Block37 hits · 37 pts
SeverityFileLineSnippetContext
LOW.gitpod.yml1## Learn more about this file at 'https://www.gitpod.io/docs/references/gitpod-yml'COMMENT
LOW.gitpod.yml21## The 'image' section defines which Docker image Gitpod should use.COMMENT
LOW.gitpod.yml41## or how Gitpod can start development servers. With Gitpod, there are threeCOMMENT
LOW.gitpod.yml61# # and to keep your codebase DRY.COMMENT
LOW.gitpod.yml101## the OpenVSX.org registry to be installed upon workspace startup. OpenVSXCOMMENT
LOW…ommon/test/io/ktor/tests/server/http/UrlEncodedTest.kt61 }COMMENT
LOW…ommon/test/io/ktor/tests/server/http/UrlEncodedTest.kt81//COMMENT
LOW…ommon/test/io/ktor/tests/server/http/UrlEncodedTest.kt101//COMMENT
LOW…ommon/test/io/ktor/tests/server/http/UrlEncodedTest.kt121// @TestCOMMENT
LOW…tor-client-curl/desktop/interop/include/curl/mprintf.h41#ifdef __MINGW_PRINTF_FORMAT /* mingw-w64 3.0.0+. Needs stdio.h. */COMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h61COMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h121COMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h681#define CURLE_SSL_PEER_CERTIFICATE CURLE_PEER_FAILED_VERIFICATIONCOMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h701#define CURLE_FTP_QUOTE_ERROR CURLE_QUOTE_ERRORCOMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h841#endifCOMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h1081#define CURLPROTO_SFTP (1L << 5)COMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h1101#define CURLPROTO_GOPHER (1L << 25)COMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h2341#define CURL_RTSPREQ_PLAY 5LCOMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h2361 CURL_NETRC_LAST = 3COMMENT
LOW…t/ktor-client-curl/desktop/interop/include/curl/curl.h3181#define CURL_VERSION_ASYNCHDNS (1<<7) /* Asynchronous DNS resolves */COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h61# define CURL_TYPEOF_CURL_OFF_T __int64COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h81# endifCOMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h101# endifCOMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h121# ifndef __LP64COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h141# define CURL_SUFFIX_CURL_OFF_T i64COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h161# define CURL_SUFFIX_CURL_OFF_TU ULCOMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h181#elif defined(__MVS__)COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h201# ifdef _LONG_LONGCOMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h221# define CURL_FORMAT_CURL_OFF_T "ld"COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h241 defined(__sparcv8plus))COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h261# define CURL_TYPEOF_CURL_OFF_T long longCOMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h281# define CURL_FORMAT_CURL_OFF_TU "llu"COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h301# include <inttypes.h>COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h321 defined(__sparc__) || defined(__mips__) || defined(__sh__) || \COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h341# define CURL_FORMAT_CURL_OFF_T "ld"COMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/system.h361# define CURL_SUFFIX_CURL_OFF_TU ULLCOMMENT
LOW…ktor-client-curl/desktop/interop/include/curl/urlapi.h81 CURLUPART_ZONEID /* added in 7.65.0 */COMMENT
Decorative Section Separators10 hits · 36 pts
SeverityFileLineSnippetContext
MEDIUMswitch-base-branch.sh11# ============================================================================COMMENT
MEDIUMswitch-base-branch.sh13# ============================================================================COMMENT
MEDIUM⚡switch-base-branch.sh26# ============================================================================COMMENT
MEDIUM⚡switch-base-branch.sh28# ============================================================================COMMENT
MEDIUM⚡switch-base-branch.sh34# ============================================================================COMMENT
MEDIUM⚡switch-base-branch.sh36# ============================================================================COMMENT
MEDIUMswitch-base-branch.sh54# ============================================================================COMMENT
MEDIUMswitch-base-branch.sh56# ============================================================================COMMENT
MEDIUMswitch-base-branch.sh490# ============================================================================COMMENT
MEDIUMswitch-base-branch.sh492# ============================================================================COMMENT
Structural Annotation Overuse12 hits · 18 pts
SeverityFileLineSnippetContext
LOW.claude/skills/fix-bug/SKILL.md44## Step 1: Assign Issue and Set In ProgressCOMMENT
LOW.claude/skills/fix-bug/SKILL.md56## Step 2: Understand the Codebase ContextCOMMENT
LOW.claude/skills/fix-bug/SKILL.md69## Step 3: Create branchCOMMENT
LOW.claude/skills/fix-bug/SKILL.md84## Step 4: Write a Failing Reproducer TestCOMMENT
LOW.claude/skills/fix-bug/SKILL.md114## Step 5: Commit the ReproducerCOMMENT
LOW.claude/skills/fix-bug/SKILL.md126## Step 6: Plan and Implement the FixCOMMENT
LOW.claude/skills/fix-bug/SKILL.md138## Step 7: Validate the FixCOMMENT
LOW.claude/skills/fix-bug/SKILL.md158## Step 8: Format and LintCOMMENT
LOW.claude/skills/fix-bug/SKILL.md166## Step 9: ABI ValidationCOMMENT
LOW.claude/skills/fix-bug/SKILL.md182## Step 10: Commit the FixCOMMENT
LOW.claude/skills/fix-bug/SKILL.md191## Step 11: Push and Create PRCOMMENT
LOW.claude/skills/fix-bug/SKILL.md229## Step 12: Documentation Issue (if needed)COMMENT
Fake / Example Data11 hits · 12 pts
SeverityFileLineSnippetContext
LOW…-auth/jvm/test/io/ktor/tests/auth/DigestRFC7616Test.kt122 val realm = "http-auth@example.org"CODE
LOW…-auth/jvm/test/io/ktor/tests/auth/DigestRFC7616Test.kt158 val realm = "http-auth@example.org"CODE
LOW…-auth/jvm/test/io/ktor/tests/auth/DigestRFC7616Test.kt203 val realm = "api@example.org"CODE
LOW…-auth/jvm/test/io/ktor/tests/auth/DigestRFC7616Test.kt242 val realm = "http-auth@example.org"CODE
LOW…-auth/jvm/test/io/ktor/tests/auth/DigestRFC7616Test.kt255 val realm = "http-auth@example.org"CODE
LOW…-auth/jvm/test/io/ktor/tests/auth/DigestRFC7616Test.kt543 val realm = "http-auth@example.org"CODE
LOW…io/ktor/server/auth/oidc/OidcJwtKeyAndAlgorithmTest.kt211 email = "user@example.com"CODE
LOW…ver-auth-oidc/jvm/src/io/ktor/server/auth/oidc/Oidc.kt150 * email = "user@example.com"COMMENT
LOW…/test/io/ktor/client/engine/java/RequestHeadersTest.kt43 assertHeaderReachesServer(HttpHeaders.From, "user@example.com")CODE
LOW…test/io/ktor/client/engine/java/RequestProducerTest.kt80 append(HttpHeaders.From, "user@example.com")CODE
LOW…test/io/ktor/client/engine/java/RequestProducerTest.kt95 assertEquals("user@example.com", headers.firstValue(HttpHeaders.From).get())CODE
Self-Referential Comments3 hits · 9 pts
SeverityFileLineSnippetContext
MEDIUM…or-client-core/common/src/io/ktor/client/HttpClient.kt29 * # Creating a clientCOMMENT
MEDIUM…or-client-core/common/src/io/ktor/client/HttpClient.kt341 * # Creating a clientCOMMENT
MEDIUM…or-client-core/common/src/io/ktor/client/HttpClient.kt658 * # Creating a clientCOMMENT
Hyper-Verbose Identifiers2 hits · 2 pts
SeverityFileLineSnippetContext
LOW…jvm/test/io/ktor/tests/server/netty/NettyEngineTest.kt897 private class Http3ResponseHandler : ChannelInboundHandlerAdapter() {CODE
LOW…/ktor/tests/server/netty/NettyHttp3CallExecutorTest.kt95 private class Http3ResponseHandler : ChannelInboundHandlerAdapter() {CODE
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOW.github/workflows/automations.yml49 # Check if the PR should be merged with fast-forward when:COMMENT