AI Slop Code Risk Monitor

microsoft/msquic

SlopCodeMonitor badge for microsoft/msquic Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

Cross-platform, C implementation of the IETF QUIC protocol, exposed to C, C++, C# and Rust.

2.3 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for microsoft/msquic, a C project with 4,793 GitHub stars. SynthScan examined 256,174 lines of code across 535 source files, recording 583 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 2.3 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

2.3
Adjusted Signal
2.3
Raw Pattern Score
100%
Time Factor
2026-10-31
Last Push
4.8K
Stars
C
Language
256.2K
Lines of Code
535
Files
583
Pattern Hits
2026-10-31
Scan Date
0.00
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 10.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 582 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 1 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 11.1/100 · LOW

Which changes need focused human review? 583 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 1MEDIUM 7LOW 575

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 583 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block572 hits · 550 pts
SeverityFileLineSnippetContext
LOWcmake/openssl-prefix-rename.sh1#!/bin/bashCOMMENT
LOWcmake/openssl-prefix-rename.sh21#COMMENT
LOWcmake/openssl-prefix-rename.sh61gen-syms)COMMENT
LOW.github/workflows/build-reuse-unix.yml21 # - DebugCOMMENT
LOW.github/workflows/wan-perf.yml1name: WAN PerfCOMMENT
LOWsrc/inc/quic_var_int.h21// 00 1 byteCOMMENT
LOWsrc/inc/msquic_winkernel.h41COMMENT
LOWsrc/inc/msquic_winkernel.h61#endifCOMMENT
LOWsrc/inc/msquic_winkernel.h81#endifCOMMENT
LOWsrc/inc/msquic_winkernel.h101#define QUIC_STATUS_INVALID_STATE STATUS_INVALID_DEVICE_STATE // 0xc0000184COMMENT
LOWsrc/inc/msquic_winkernel.h121COMMENT
LOWsrc/inc/quic_platform_winkernel.h21#endifCOMMENT
LOWsrc/inc/quic_platform_winkernel.h41#include <ntverp.h>COMMENT
LOWsrc/inc/quic_platform_winkernel.h81#elseCOMMENT
LOWsrc/inc/quic_platform_winkernel.h141COMMENT
LOWsrc/inc/quic_platform_winkernel.h181COMMENT
LOWsrc/inc/quic_platform_winkernel.h201#define CXPLAT_DBG_ASSERTMSG(_exp, _msg) CXPLAT_ASSERT_CRASH(_exp, CXPLAT_WIDE_STRING(_msg))COMMENT
LOWsrc/inc/quic_platform_winkernel.h221 CXPLAT_ASSERT_NOOP(_exp, CXPLAT_WIDE_STRING(_msg))COMMENT
LOWsrc/inc/quic_platform_winkernel.h241COMMENT
LOWsrc/inc/quic_platform_winkernel.h361#define CxPlatDispatchLockAcquire(Lock) (Lock)->PrevIrql = KeAcquireSpinLockRaiseToDpc(&(Lock)->SpinLock)COMMENT
LOWsrc/inc/quic_platform_winkernel.h381#define CxPlatDispatchRwLockAcquireExclusive(Lock, PrevIrql) KIRQL PrevIrql = ExAcquireSpinLockExclusive(Lock)COMMENT
LOWsrc/inc/quic_platform_winkernel.h961#define CxPlatRundownInitialize(Rundown) ExInitializeRundownProtection(Rundown)COMMENT
LOWsrc/inc/quic_platform_winkernel.h981 );COMMENT
LOWsrc/inc/quic_platform_winkernel.h1001#define QuicSiloGetHostSilo() PsGetHostSilo()COMMENT
LOWsrc/inc/quic_platform.h21COMMENT
LOWsrc/inc/quic_platform.h41#define US_TO_MS(x) ((x) / 1000)COMMENT
LOWsrc/inc/quic_platform.h81COMMENT
LOWsrc/inc/quic_platform.h101#define QUIC_POOL_SENDBUF '21cQ' // Qc12 - QUIC Send BufferCOMMENT
LOWsrc/inc/quic_platform.h121#define QUIC_POOL_TLS_EXTRAS '62cQ' // Qc26 - QUIC Platform TLS Extra DataCOMMENT
LOWsrc/inc/quic_platform.h141#define QUIC_POOL_SEND_REQUEST 'A3cQ' // Qc3A - QUIC Send RequestCOMMENT
LOWsrc/inc/quic_platform.h181#define CX_PLATFORM_TYPE 2COMMENT
LOWsrc/inc/msquic.h21#ifndef _MSQUIC_COMMENT
LOWsrc/inc/msquic.h41#if defined(__cplusplus)COMMENT
LOWsrc/inc/msquic.h61COMMENT
LOWsrc/inc/msquic.h981#define QUIC_PARAM_PREFIX_TLS_SCHANNEL 0x07000000COMMENT
LOWsrc/inc/msquic.h1001#define QUIC_PARAM_GLOBAL_LIBRARY_GIT_HASH 0x01000008 // char[64]COMMENT
LOWsrc/inc/msquic.h1021#define QUIC_PARAM_CONFIGURATION_TICKET_KEYS 0x03000001 // QUIC_TICKET_KEY_CONFIG[]COMMENT
LOWsrc/inc/msquic.h1041#endifCOMMENT
LOWsrc/inc/msquic.h1061#define QUIC_PARAM_CONN_DATAGRAM_SEND_ENABLED 0x0500000E // uint8_t (BOOLEAN)COMMENT
LOWsrc/inc/msquic.h1101#endifCOMMENT
LOWsrc/inc/quic_trace_manifested_etw.h21// Defining MCGEN_PRIVATE_ENABLE_CALLBACK_V2, makes McGenControlCallbackV2COMMENT
LOWsrc/inc/msquic.hpp21 Linux User modeCOMMENT
LOWsrc/inc/quic_platform_winuser.h21#endifCOMMENT
LOWsrc/inc/quic_platform_winuser.h41#include <ws2ipdef.h>COMMENT
LOWsrc/inc/quic_platform_winuser.h61#define DEBUG 1COMMENT
LOWsrc/inc/quic_platform_winuser.h101#define QUIC_NO_SANITIZE(X)COMMENT
LOWsrc/inc/quic_platform_winuser.h161// CXPLAT_FRE_ASSERT - Asserts that must always crash the system.COMMENT
LOWsrc/inc/quic_platform_winuser.h201#endifCOMMENT
LOWsrc/inc/quic_platform_winuser.h541//COMMENT
LOWsrc/inc/quic_platform_winuser.h561#define CxPlatRwLockInitialize(Lock) InitializeSRWLock(Lock)COMMENT
LOWsrc/inc/quic_platform_winuser.h581#if defined(_X86_) || defined(_AMD64_)COMMENT
LOWsrc/inc/quic_platform_winuser.h601#endifCOMMENT
LOWsrc/inc/quic_platform_winuser.h1221#define CxPlatThreadWait(Thread) WaitForSingleObject(*(Thread), INFINITE)COMMENT
LOWsrc/inc/quic_storage.h81COMMENT
LOWsrc/inc/quic_toeplitz.h21 //COMMENT
LOWsrc/inc/quic_toeplitz.h41#define CXPLAT_TOEPLITZ_OUPUT_SIZE sizeof(uint32_t)COMMENT
LOWsrc/inc/quic_versions.h21#define QUIC_VERSION_DRAFT_29 0x1d0000ffU // IETF draft 29COMMENT
LOWsrc/inc/quic_datapath.h21#pragma warning(disable:4200) // nonstandard extension used: zero-sized array in struct/unionCOMMENT
LOWsrc/inc/quic_datapath.h81#define CXPLAT_ECN_FROM_TOS(ToS) (CXPLAT_ECN_TYPE)((ToS) & 0x3)COMMENT
LOWsrc/inc/quic_datapath.h241 // The data buffer containing the received bytes.COMMENT
512 more matches not shown…
AI Slop Vocabulary6 hits · 18 pts
SeverityFileLineSnippetContext
MEDIUMsrc/core/stream_send.c175 // Essentially, Reset trumps Reliable Reset, so if we have to call shutdown again, we reset.COMMENT
MEDIUMsrc/core/stream.h39#define QUIC_STREAM_SHUTDOWN_SILENT 0x8000 // Used in conjunction with the abort flags.COMMENT
MEDIUMsrc/core/unittest/CubicTest.cpp548// when the application doesn't fully utilize the window (BytesInFlightMax staysCOMMENT
MEDIUMsrc/test/lib/ApiTest.cpp1331 // Don't create it on the stack so we can leverage the "AutoDelete" clean up behavior on shutdown complete.COMMENT
MEDIUMsrc/platform/datapath_linux.c94 // everything **actually** works, so that we can be sure we can leverageCOMMENT
MEDIUMsrc/platform/datapath_iouring.c1222 // this should be made more robust.COMMENT
AI Response Leakage1 hit · 8 pts
SeverityFileLineSnippetContext
HIGHsrc/platform/tls_openssl.c1337// a TLS session ticket. In this implementation, it performs no action andCOMMENT
Self-Referential Comments1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/cargo.yml107 # Create the crate package (source tarball)COMMENT
Redundant / Tautological Comments1 hit · 2 pts
SeverityFileLineSnippetContext
LOWscripts/docker-script.sh27 # Check if this is dnf5 (Fedora 42+) which has different syntaxCOMMENT
Fake / Example Data1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/platform/selfsign_openssl.c552#define TEST_PASS "placeholder"COMMENT
TODO Padding1 hit · 2 pts
SeverityFileLineSnippetContext
LOWsrc/rs/lib.rs70 // TODO: implement Addr content debug stringCOMMENT