The MacPorts ports tree
This report summarizes scanner evidence for macports/macports-ports, a Tcl project with 1,848 GitHub stars. SynthScan examined 68,085 lines of code across 627 source files, recording 295 pattern matches distributed across 9 syntactic categories. The legacy adjusted pattern signal is 4.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 281 finding(s).
Are imports declared and package/API names verified? 13 finding(s).
Are wrappers, guards, and repeated structures necessary? 1 finding(s).
Which changes need focused human review? 295 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 295 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | devel/libsockets/files/create-dylib.sh | 1 | #!/bin/bash | COMMENT |
| LOW | …bazel/files/xcode_locator_fixes/Xcode6-xcode_locator.m | 1 | // Copyright 2015 Google Inc. All rights reserved. | COMMENT |
| LOW | …bazel/files/xcode_locator_fixes/Xcode7-xcode_locator.m | 1 | // Copyright 2015 Google Inc. All rights reserved. | COMMENT |
| LOW | …bazel/files/xcode_locator_fixes/Xcode8-xcode_locator.m | 1 | // Copyright 2015 Google Inc. All rights reserved. | COMMENT |
| LOW | devel/libgit2-devel/files/copyfile.h | 61 | COMMENT | |
| LOW | devel/libgit2-devel/files/copyfile.h | 81 | #define COPYFILE_PACK (1<<22) | COMMENT |
| LOW | devel/libgit2/files/copyfile.h | 61 | COMMENT | |
| LOW | devel/libgit2/files/copyfile.h | 81 | #define COPYFILE_PACK (1<<22) | COMMENT |
| LOW | devel/libpdel/files/Darwin/hacks.h | 1 | #include <sys/param.h> | COMMENT |
| LOW | …es/mysql55-connector-cpp/files/examples-CMakeLists.txt | 1 | # MacPorts MySQL Connector/C++ examples CMake build | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 21 | #ifndef DEFAULT_TEXMFLOCAL | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 41 | #ifndef DEFAULT_TEXMFCONFIG | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 61 | #ifndef DEFAULT_WEB2C | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 81 | #ifndef DEFAULT_TEXFORMATS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 101 | #ifndef DEFAULT_MPPOOL | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 121 | #ifndef DEFAULT_GLYPHFONTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 141 | #ifndef DEFAULT_MLBIBINPUTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 161 | #ifndef DEFAULT_TEXPSHEADERS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 181 | #ifndef DEFAULT_OPENTYPEFONTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 201 | #ifndef DEFAULT_ENCFONTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 221 | #ifndef DEFAULT_PDFTEXCONFIG | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 241 | #ifndef DEFAULT_FONTCONFIG_FILE | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 261 | #ifndef DEFAULT_WEBINPUTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 281 | #ifndef DEFAULT_OVPFONTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 301 | #ifndef DEFAULT_TEX4HTINPUTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 321 | #ifndef DEFAULT_CLUAINPUTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 341 | #ifndef DEFAULT_RUBYINPUTS | COMMENT |
| LOW | tex/texlive-bin/files/texk_kpathsea_paths.h | 361 | #ifndef DEFAULT_TEX | COMMENT |
| LOW | net/junkbuster/files/patch-junkbstr.ini | 21 | # the logfile is where all logging and error messages are written | COMMENT |
| LOW | net/junkbuster/files/patch-junkbstr.ini | 41 | # files specify locations of "for information about trusted referers, see.." | COMMENT |
| LOW | net/libdnsres/files/patch-gethostnamadr.c | 1 | --- gethostnamadr.c.org 2005-07-13 17:14:28.000000000 -0700 | COMMENT |
| LOW | net/libdnsres/files/patch-getaddrinfo.c | 1 | --- getaddrinfo.c.org 2005-07-13 17:14:28.000000000 -0700 | COMMENT |
| LOW | net/dnsa/files/patch-sniffid.c | 1 | --- sniffid.c.orig Fri Oct 15 13:47:13 2004 | COMMENT |
| LOW | net/clash/files/options.yaml | 1 | # Port of HTTP(S) proxy server on the local end | COMMENT |
| LOW | net/clash/files/options.yaml | 21 | # Set to true to allow connections to the local-end server from | COMMENT |
| LOW | net/clash/files/options.yaml | 41 | # When set to false, resolver won't translate hostnames to IPv6 addresses | COMMENT |
| LOW | net/clash/files/options.yaml | 61 | routing-mark: 6666 | COMMENT |
| LOW | net/clash/files/options.yaml | 101 | # real IP addresses | COMMENT |
| LOW | net/clash/files/options.yaml | 121 | # - tcp://1.1.1.1 | COMMENT |
| LOW | net/clash/files/options.yaml | 141 | # - '+.facebook.com' | COMMENT |
| LOW | net/clash/files/options.yaml | 201 | cipher: auto | COMMENT |
| LOW | net/clash/files/options.yaml | 261 | # socks5 | COMMENT |
| LOW | net/clash/files/options.yaml | 321 | server: server | COMMENT |
| LOW | net/pidgin/files/autogen.sh | 1 | #! /bin/sh | COMMENT |
| LOW | net/pidgin/files/autogen.sh | 21 | ############################################################################### | COMMENT |
| LOW | net/tuic/files/client.toml | 61 | # [relay.proxy] | COMMENT |
| LOW | net/tuic/files/server.toml | 81 | COMMENT | |
| LOW | net/tuic/files/server.toml | 101 | # bind_ipv6 = ["::"] | COMMENT |
| LOW | net/tuic/files/server.toml | 121 | # addr = "example.com" | COMMENT |
| LOW | net/rsync-lart/files/copyfile.h | 61 | COMMENT | |
| LOW | net/rsync-lart/files/copyfile.h | 81 | #define COPYFILE_PACK (1<<22) | COMMENT |
| LOW | python/py-meson/files/rosetta-exe-wrapper.sh | 1 | #!/bin/sh | COMMENT |
| LOW | security/arti/files/arti.toml | 1 | # Configuration for arti, as installed by MacPorts. | COMMENT |
| LOW | security/arti/files/arti.toml | 21 | # Note that storage.state_dir and storage.cache_dir are deliberately not set | COMMENT |
| LOW | security/arti/files/arti.toml | 41 | # See @PREFIX@/share/doc/arti/bridges.md | COMMENT |
| LOW | security/lastpass-cli/files/version.h | 1 | #define LASTPASS_CLI_VERSION "1.5.0.GIT" | COMMENT |
| LOW | …-server/files/prefix/etc/dovecot/imap.keytab.README.sh | 81 | # kadmin> ext_keytab -k @PREFIX@/etc/dovecot/imap.keytab imap/@host@.@domain@.@tld@ | COMMENT |
| LOW | …-server/files/prefix/etc/dovecot/imap.keytab.README.sh | 101 | # c list "" * | COMMENT |
| LOW | …-server/files/prefix/etc/postfix/smtp.keytab.README.sh | 81 | # kadmin> ext_keytab -k @PREFIX@/etc/postfix/smtp.keytab smtp/@host@.@domain@.@tld@ | COMMENT |
| LOW | …-server/files/prefix/etc/postfix/smtp.keytab.README.sh | 121 | # (After postfix configured and loaded) | COMMENT |
| 204 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/py-pyobjc/files/multiinstall.py | 8 | CODE | |
| LOW | python/py-pyobjc/files/multiinstall.py | 9 | CODE | |
| LOW | python/py-pyobjc/files/multiinstall.py | 16 | CODE | |
| LOW | python/py-testfixtures/files/conftest.py | 4 | CODE | |
| LOW | python/py-tkinter/files/setup.py | 1 | CODE | |
| LOW | python/py-tkinter/files/setup.py | 1 | CODE | |
| LOW | python/py-tkinter/files/setup.py | 4 | CODE | |
| LOW | python/py-tkinter/files/setup.py | 5 | CODE | |
| LOW | python/py-tkinter/files/setup.py | 6 | CODE | |
| LOW | python/py-gdbm/files/setup-py3k.py | 2 | CODE | |
| LOW | python/py-gdbm/files/setup-py3k.py | 3 | CODE | |
| LOW | python/py-gdbm/files/setup-py3k.py | 4 | CODE | |
| LOW | gis/orfeotoolbox/files/__init__.py | 5 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | science/chemical-mime-data/files/autogen.sh | 9 | # This file is free software. The copyright owner gives unlimited | COMMENT |
| MEDIUM | x11/xinit/files/font_cache.sh | 6 | # This file contains Original Code and/or Modifications of Original Code | COMMENT |
| MEDIUM | x11/xinit/files/font_cache.sh | 50 | # Create a list of all files in the dir | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | audio/gmpc/files/autogen.sh | 50 | # Usage: | COMMENT |
| LOW | audio/gmpc/files/autogen.sh | 70 | # Usage: | COMMENT |
| LOW | audio/gmpc/files/autogen.sh | 123 | # Usage: | COMMENT |
| LOW | audio/gmpc/files/autogen.sh | 140 | # Usage: | COMMENT |
| LOW | audio/gmpc/files/autogen.sh | 150 | # Usage: | COMMENT |
| LOW | audio/gmpc/files/autogen.sh | 161 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | gnome/grisbi/files/autogen.sh | 9 | # Check if autoconf and automake are installed | COMMENT |
| LOW | gnome/grisbi/files/autogen.sh | 84 | # Check if the configure script is created | COMMENT |
| LOW | sysutils/backuppc/files/backuppc_config_template.rb | 123 | # Check if the generated user['uid'] is valid, if not raise an error | COMMENT |
| LOW | x11/xinit/files/font_cache.sh | 39 | # Check if the data in the given directory is newer than its cache | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | net/clash/files/options.yaml | 399 | # you can use RESTful API to switch proxy is recommended for use in GUI. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | graphics/field3d/files/patch-BuildSupport.py | 4 | # ------------------------------------------------------------------------------ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sysutils/collectd/files/dep-gen.sh | 9 | # ( awk '/^# WARNING: This list is generated/ { exit } { print }' < Portfile | sed '$d' ; ./files/dep-gen.sh ) > Portfil | COMMENT |
| LOW | sysutils/collectd/files/dep-gen.sh | 362 | echo "# WARNING: This list is generated by files/dep-gen.sh #" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | net/pidgin/files/autogen.sh | 42 | # variable in 'autogen.args'. For example, say you're using distcc, just add | COMMENT |