3.3

Adjusted Signal

3.3

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

3.1K

Stars

Rust

Language

366.1K

Lines of Code

1.5K

Files

1.0K

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 12.8/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 976 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.8/100 · LOW

Are imports declared and package/API names verified? 6 finding(s).

Agent Over-Engineering Ratio 2.6/100 · LOW

Are wrappers, guards, and repeated structures necessary? 105 finding(s).

PR Review Velocity Impact 15.0/100 · LOW

Which changes need focused human review? 1026 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 6HIGH 0MEDIUM 54LOW 966

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1026 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block895 hits · 892 pts

Severity	File	Line	Snippet	Context
LOW	.azure-pipelines/1ES.Build.Official.yml	1	# Copyright (c) Microsoft Corporation. All rights reserved.	COMMENT
LOW	.azure-pipelines/1ES.IsolationSession.TestBundle.yml	1	# Copyright (c) Microsoft Corporation. All rights reserved.	COMMENT
LOW	.azure-pipelines/templates/Rust.Toolchain.Public.yml	1	# Copyright (c) Microsoft Corporation. All rights reserved.	COMMENT
LOW	.azure-pipelines/templates/Rust.Toolchain.Public.yml	21	# That URL is byte-stable for a given (version, triple) so the SHA-256	COMMENT
LOW	.azure-pipelines/templates/Publish.CratesIo.Job.yml	1	# Copyright (c) Microsoft Corporation. All rights reserved.	COMMENT
LOW	…es/templates/IsolationSession.TestBundle.Build.Job.yml	1	# Copyright (c) Microsoft Corporation. All rights reserved.	COMMENT
LOW	.azure-pipelines/templates/Fuzz.Build.Job.yml	1	# Copyright (c) Microsoft Corporation. All rights reserved.	COMMENT
LOW	tests/scripts/run_bwrap_teardown_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_enforcement_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_bwrap_readonly_denial_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_inbound_deny_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_inbound_deny_test.sh	41	# invocation still fails: under `set -o pipefail` the chain snapshots below	COMMENT
LOW	tests/scripts/run_lxc_inbound_traffic_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_seatbelt_network_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_seatbelt_network_test.sh	101	# reordering silently reopens loopback while every behavioral assertion above	COMMENT
LOW	tests/scripts/run_bwrap_denied_masking_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_deny_precedence_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_bwrap_dns_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_reuse_loosen_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_reuse_tighten_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_seatbelt_filesystem_test.sh	81	# That the write fails proves nothing on its own: /usr is root-owned and this	COMMENT
LOW	tests/scripts/run_bwrap_most_specific_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_bwrap_inbound_deny_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_bwrap_inbound_deny_test.sh	21	# rules, and INPUT actually jumps to it -- asserted for both families,	COMMENT
LOW	tests/scripts/run_seatbelt_profile_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_extra_nic_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_timeout_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_most_specific_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_bwrap_directional_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_bwrap_directional_test.sh	301	fi	COMMENT
LOW	tests/scripts/run_bwrap_directional_test.sh	361	echo "$PORT_OUT"	COMMENT
LOW	tests/scripts/run_lxc_network_deny_all_loopback_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_seatbelt_gui_access_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_seatbelt_proxy_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_denied_masking_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_env_cwd_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_no_network_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_bwrap_filesystem_object_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_env_test.sh	61	export MXC_LEAK_PROBE="LXC_HOST_ENV_LEAKED"	COMMENT
LOW	tests/scripts/run_seatbelt_rejections_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_ga_egress_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/run_lxc_network_ga_egress_test.sh	181		COMMENT
LOW	tests/scripts/run_bwrap_environment_test.sh	61	# Exported here rather than set by a config: the guarantee is unconditional, so	COMMENT
LOW	tests/scripts/run_lxc_network_ipv6_cidr_test.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/lib/chain_name.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/lib/lxc_dns_peer.sh	1	#!/bin/bash	COMMENT
LOW	tests/scripts/lib/lxc_peer_listener.sh	1	#!/bin/bash	COMMENT
LOW	docs/development/plans/backend-support-probe-api.md	21	// One host-available backend, plus its effective isolation tier (if any).	COMMENT
LOW	docs/development/architecture/container-lifecycle.md	1201	///	COMMENT
LOW	docs/development/architecture/container-lifecycle.md	1361	/// the calling process's own stderr.	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk.ConsoleDriver/Program.cs	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk.AotSmokeTest/Program.cs	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	…otnet/Microsoft.Mxc.Sdk/Generated/MxcConfigV1_0_0.g.cs	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk/V1/ContainerId.cs	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk/V1/PlatformDiscovery.cs	61	/// <summary>Windows ProcessContainer denial capture.</summary>	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk/V1/PlatformDiscovery.cs	81	/// </summary>	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk/V1/PlatformDiscovery.cs	101	public IsolationTier? Tier { get; init; }	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk/V1/MxcLifecycle.cs	181	return envelope;	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk/V1/TelemetryPolicyState.cs	1	// Copyright (c) Microsoft Corporation.	COMMENT
LOW	sdk/dotnet/Microsoft.Mxc.Sdk/V1/TelemetryPolicyState.cs	21	/// </summary>	COMMENT
835 more matches not shown…

Decorative Section Separators41 hits · 123 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/scripts/run_lxc_inbound_deny_test.sh	108	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_lxc_inbound_deny_test.sh	110	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_lxc_inbound_deny_test.sh	168	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_lxc_inbound_deny_test.sh	170	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_lxc_inbound_deny_test.sh	198	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_lxc_inbound_deny_test.sh	200	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_inbound_deny_test.sh	122	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_inbound_deny_test.sh	126	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_inbound_deny_test.sh	179	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_inbound_deny_test.sh	181	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_inbound_deny_test.sh	224	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_inbound_deny_test.sh	226	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_directional_test.sh	42	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_directional_test.sh	44	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_directional_test.sh	99	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_directional_test.sh	101	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_directional_test.sh	368	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	tests/scripts/run_bwrap_directional_test.sh	370	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	src/tools/mxc_darwin/src/main.rs	125	// ── Telemetry init ──────────────────────────────────────────────	COMMENT
MEDIUM	src/tools/mxc_darwin/src/main.rs	172	// ── Telemetry emit ──────────────────────────────────────────────	COMMENT
MEDIUM	src/tools/wxc/src/main.rs	1251	// ── Telemetry init ──────────────────────────────────────────────	COMMENT
MEDIUM	src/mxc-sdk/src/core/mxc_common/config_parser.rs	4673	// ── Telemetry ────────────────────────────────────────────────────	COMMENT
MEDIUM	src/mxc-sdk/src/core/mxc_common/process_util.rs	621	// ── Captured-output process execution ──────────────────────────────────────	COMMENT
MEDIUM	src/mxc-sdk/src/core/mxc_common/process_util.rs	752	// ── Capability SID helpers ────────────────────────────────────────────────	COMMENT
MEDIUM	src/mxc-sdk/src/core/mxc_common/process_util.rs	765	// ── Sibling binary resolution ─────────────────────────────────────────────	COMMENT
MEDIUM	src/mxc-sdk/src/core/mxc_common/mxc_error.rs	533	// ── Structured failure fields ────────────────────────────────────────	COMMENT
MEDIUM	…xc-sdk/src/backends/bubblewrap/common/network_rules.rs	2239	// ── Ingress ──────────────────────────────────────────────────────────────	COMMENT
MEDIUM	…src/backends/isolation_session/common/console_relay.rs	327	// ── ConsoleRelayParams + create_console_relay_thread ──────────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	513	// ── Best-effort text fields are normalised at construction ───────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	560	// ── Constants pinned to the OS values they mirror ────────────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	583	// ── nativeCode rendering ─────────────────────────────────────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	591	// ── Stale promotion ──────────────────────────────────────────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	634	// ── Transport messages tolerate an absent platform text ──────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	671	// ── The status getter itself can fail ────────────────────────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	716	// ── Field population and the MxcError invariant ──────────────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	899	// ── One-shot rendering (Display) ─────────────────────────────────────	COMMENT
MEDIUM	…mxc-sdk/src/backends/isolation_session/common/error.rs	957	// ── operation values ─────────────────────────────────────────────────	COMMENT
MEDIUM	…dk/src/backends/isolation_session/common/pipe_relay.rs	133	// ── Stop-event-aware pipe relay ────────────────────────────────────────────	COMMENT
MEDIUM	…dk/src/backends/isolation_session/common/pipe_relay.rs	599	// ── Tests for `create_relay_thread_with_stop` ──────────────────────────	COMMENT
MEDIUM	…/src/backends/isolation_session/common/console_mode.rs	26	// ── Local console raw-VT-mode RAII guard ──────────────────────────────────	COMMENT
MEDIUM	…/src/backends/isolation_session/common/console_mode.rs	146	// ── Console Ctrl handler RAII guard ──────────────────────────────────────	COMMENT

Hyper-Verbose Identifiers61 hits · 64 pts

Severity	File	Line	Snippet	Context
LOW	tests/scripts/run_bwrap_terminal_isolation_test.sh	32	def run_with_controlling_terminal(command, redirected):	CODE
LOW	docs/api-reference/node/v1/api.md	161	export async function getTelemetryConsentStatus(): Promise<TelemetryConsentStatus>;	CODE
LOW	docs/api-reference/node/v1/dev.md	24	export function spawnInContainerWithPtyJson(	CODE
LOW	sdk/node/tests/unit/probe.test.ts	64	function assertProbeOutputRejected(payload: unknown): void {	CODE
LOW	sdk/node/tests/unit/state-aware.test.ts	132	function installStateAwareExecBinding(	CODE
LOW	sdk/node/tests/integration/dev-api.ts	13	export function verifyPackedDevSignatures(	CODE
LOW⚡	sdk/node/tests/integration/test-helpers.ts	228	export function stateAwareRuntimeUnavailable(error: unknown): boolean {	CODE
LOW⚡	sdk/node/tests/integration/test-helpers.ts	238	function addUserFeatureUnavailable(error: MxcError): boolean {	CODE
LOW⚡	sdk/node/tests/integration/test-helpers.ts	245	export function isolationSessionFeatureSkipReason(error: unknown): string \| undefined {	CODE
LOW	sdk/node/tests/integration/test-helpers.ts	378	export async function probeIsolationSessionFeature(): Promise<string \| undefined> {	CODE
LOW	sdk/node/src/v1/lifecycle.ts	95	async function runStateAwareEnvelopeRequest(	CODE
LOW	sdk/node/src/v1/lifecycle.ts	158	function assertStateAwareStreamingOptions(	CODE
LOW	sdk/node/src/v1/platform.ts	123	function isWindowsSandboxAvailable(): boolean {	CODE
LOW	sdk/node/src/v1/platform.ts	184	export function getPlatformSupportForExecutable(executablePath?: string): PlatformSupport {	CODE
LOW	sdk/node/src/v1/platform.ts	255	function populateIsolationFromProbe(support: PlatformSupport, runner: ProbeRunner): string \| undefined {	CODE
LOW	sdk/node/src/v1/platform.ts	538	function defaultLxcAvailabilityProbe(): boolean {	CODE
LOW	sdk/node/src/v1/platform.ts	848	function defaultBwrapVersionRunner(): BwrapVersionResult {	CODE
LOW	sdk/node/src/v1/container.ts	42	function generateRandomContainerName(): string {	CODE
LOW	sdk/node/src/v1/container.ts	174	function buildProcessBaseContainerConfig(	CODE
LOW	sdk/node/src/v1/telemetry.ts	253	function tryRegisterFailureCategory(category: string): boolean {	CODE
LOW	sdk/node/src/v1/telemetry.ts	328	export async function getTelemetryConsentStatus(): Promise<TelemetryConsentStatus> {	CODE
LOW	sdk/node/src/v1/dev/index.ts	214	export async function spawnInContainerWithPtyJson(	CODE
LOW	sdk/node/src/v1/policy/filesystem.ts	149	function hasAllApplicationPackagesAccess(dirPath: string): boolean {	CODE
LOW	sdk/node/src/bindings/streaming.ts	118	function bindStreamingNativeFacade(	CODE
LOW	sdk/node/src/bindings/streaming.ts	499	export function createNativeLifecycleDriver(	CODE
LOW	sdk/node/src/bindings/streaming.ts	551	export async function createStreamingDriverFromJson(	CODE
LOW	sdk/node/src/bindings/streaming.ts	581	export function createStreamingDriverSync(	CODE
LOW	sdk/node/src/bindings/streaming.ts	602	function ensureSupportedNodeVersion(): void {	CODE
LOW	sdk/node/src/bindings/streaming.ts	635	export async function spawnBindingSandboxProcess(	CODE
LOW	sdk/node/src/bindings/streaming.ts	658	export async function spawnBindingSandboxProcessJson(	CODE
LOW	sdk/node/src/bindings/streaming.ts	676	export function spawnBindingSandboxProcessSync(	CODE
LOW	sdk/node/src/bindings/streaming.ts	710	export function createStateAwareStreamingDriver(	CODE
LOW	sdk/node/src/bindings/streaming.ts	755	export function spawnStateAwareBindingSandboxProcess(	CODE
LOW	sdk/node/src/bindings/streaming.ts	779	export async function createStateAwareStreamingDriverAsync(	CODE
LOW	sdk/node/src/bindings/streaming.ts	807	export async function spawnStateAwareBindingSandboxProcessAsync(	CODE
LOW	sdk/node/src/bindings/telemetry-request-worker.ts	47	export function runTelemetryConsentRequestAsync(	CODE
LOW	sdk/node/src/bindings/pty.ts	230	function execStateAwareBindingSandboxWithPtyNative(	CODE
LOW	sdk/node/src/bindings/pty.ts	269	export function execStateAwareBindingSandboxWithPty(	CODE
LOW	sdk/node/src/bindings/pty.ts	285	function spawnBindingSandboxWithPtyNative(	CODE
LOW	sdk/node/src/bindings/pty.ts	318	export function spawnBindingSandboxWithPty(	CODE
LOW	sdk/node/src/bindings/pty.ts	327	function spawnBindingSandboxWithPtyJsonNative(	CODE
LOW	sdk/node/src/bindings/pty.ts	363	export function spawnBindingSandboxWithPtyJson(	CODE
LOW	sdk/node/src/bindings/process-container-pty.ts	142	async function spawnWithWxcExecutablePty(	CODE
LOW	sdk/node/src/bindings/process-container-pty.ts	220	export function spawnProcessContainerWithPty(	CODE
LOW	sdk/node/src/bindings/process-container-pty.ts	229	export function spawnProcessContainerWithPtyJson(	CODE
LOW	sdk/node/src/bindings/probe.ts	46	export function readAvailableBackendsJsonWithNative(	CODE
LOW	sdk/node/src/bindings/probe.ts	65	export function readAvailableBackendsJson(): string {	CODE
LOW	sdk/node/src/bindings/native-stdio.ts	280	export function nativeStdioNodeRequirement(	CODE
LOW⚡	sdk/node/src/bindings/telemetry.ts	170	export function readTelemetryConsentStatusJsonAsync(): Promise<string> {	CODE
LOW⚡	sdk/node/src/bindings/telemetry.ts	174	export function withdrawTelemetryConsentJsonAsync(): Promise<string> {	CODE
LOW⚡	sdk/node/src/bindings/telemetry.ts	178	export function requestTelemetryConsentJson(	CODE
LOW	sdk/node/src/bindings/state-aware.ts	55	function bindStateAwareNativeFacade(	CODE
LOW	sdk/node/src/bindings/state-aware.ts	112	export async function runBindingStateAwareRequestWithNative(	CODE
LOW	sdk/node/src/bindings/state-aware.ts	141	async function runBindingStateAwareRequestAsyncNative(	CODE
LOW	sdk/node/src/bindings/state-aware.ts	169	export function runBindingStateAwareRequestAsync(	CODE
LOW	sdk/node/src/bindings/one-shot.ts	65	function resolveOneShotContainment(config: ContainerConfig): OneShotContainment {	CODE
LOW	sdk/node/src/bindings/run.ts	176	async function runOneShotJsonAsyncNative(	CODE
LOW	sdk/node/src/bindings/run.ts	183	async function runRawOneShotJsonAsyncNative(	CODE
LOW	scripts/versioning/check-contract-codegen.js	87	function validatePublishedRegistry(registry, stableSchemas, minimumVersion) {	CODE
LOW	scripts/versioning/check-contract-codegen.js	265	function contractsWithGeneratedArtifacts(registry) {	CODE
1 more matches not shown…

Hallucination Indicators6 hits · 60 pts

Severity	File	Line	Snippet	Context
CRITICAL	sdk/dotnet/Microsoft.Mxc.Sdk/V1/ContainerAdapters.cs	74	Microsoft.Mxc.Sdk.V1.MxcPlatform.GetAvailableBackends();	CODE
CRITICAL	sdk/dotnet/Microsoft.Mxc.Sdk/V1/ContainerAdapters.cs	78	Microsoft.Mxc.Sdk.V1.MxcPlatform.GetPlatformSupport();	CODE
CRITICAL	sdk/dotnet/Microsoft.Mxc.Sdk/V1/Dev/MxcContainer.cs	61	Microsoft.Mxc.Sdk.V1.MxcLifecycle.RunBlockingOperationAsync(	CODE
CRITICAL	sdk/dotnet/Microsoft.Mxc.Sdk/V1/Dev/MxcContainer.cs	95	Microsoft.Mxc.Sdk.V1.MxcLifecycle.RunBlockingOperationAsync(	CODE
CRITICAL	sdk/dotnet/Microsoft.Mxc.Sdk/V1/Dev/MxcLifecycle.cs	26	using var process = await Microsoft.Mxc.Sdk.V1.MxcLifecycle.RunBlockingOperationAsync(	CODE
CRITICAL	sdk/dotnet/Microsoft.Mxc.Sdk/V1/Dev/MxcLifecycle.cs	79	Microsoft.Mxc.Sdk.V1.MxcLifecycle.RunBlockingOperationAsync(	CODE

AI Slop Vocabulary9 hits · 27 pts

Severity	File	Line	Snippet	Context
MEDIUM	tests/scripts/run_lxc_network_enforcement_test.sh	166	# Alive is not reachable. A peer that never bound has to fail here as harness	COMMENT
MEDIUM	tests/scripts/run_lxc_network_deny_precedence_test.sh	168	# Alive is not reachable. A peer that never bound has to fail here as harness	COMMENT
MEDIUM	tests/scripts/run_lxc_network_test.sh	116	# Alive is not reachable. A peer that never bound has to fail here as harness	COMMENT
MEDIUM	tests/scripts/run_lxc_network_ga_egress_test.sh	266	# Alive is not reachable. A peer that never bound has to fail here as harness	COMMENT
MEDIUM	tests/scripts/run_lxc_network_ga_egress_test.sh	304	# that ignores echo has to fail here as harness breakage instead.	COMMENT
MEDIUM	tests/scripts/lib/seatbelt_common.sh	6	# or wrong OS means the harness is misconfigured -- reporting that as "skipped"	COMMENT
MEDIUM	tests/scripts/lib/lxc_peer_listener.sh	10	# harness for a race.	COMMENT
MEDIUM	sdk/dotnet/Microsoft.Mxc.Sdk.Tests/MxcProcessTests.cs	216	// expansion — no external process spawn, so it is robust to the sandbox	COMMENT
MEDIUM	src/mxc-sdk/src/core/mxc_common/proxy_env.rs	13	//! Two hygiene rules make this robust:	COMMENT

Self-Referential Comments2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	.azure-pipelines/1ES.Release.Crates.yml	50	# Create the crate artifact consumed by the publish stage.	COMMENT
MEDIUM	…windows-sdk/ProcessSecurityEnvironment.provenance.toml	3	# This file is the single source of truth for the pinned regeneration toolchain	COMMENT

Verbosity Indicators4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	306	/// Step 2: Start the isolation session for the pegged agent user.	COMMENT
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	401	/// Step 3: Create a process inside the started isolation session and run it	COMMENT
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	668	/// Step 4: Stop the isolation session.	COMMENT
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	679	/// Step 5: Deprovision the agent user.	COMMENT

Structural Annotation Overuse4 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	306	/// Step 2: Start the isolation session for the pegged agent user.	COMMENT
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	401	/// Step 3: Create a process inside the started isolation session and run it	COMMENT
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	668	/// Step 4: Stop the isolation session.	COMMENT
LOW	…c-sdk/src/backends/isolation_session/common/manager.rs	679	/// Step 5: Deprovision the agent user.	COMMENT

Excessive Try-Catch Wrapping3 hits · 4 pts

Severity	File	Line	Snippet	Context
LOW	src/mxc-sdk/tests/wxc_e2e_tests_e2e_windows.rs	1071	except Exception as e:\n\	CODE
LOW	src/mxc-sdk/tests/nvx_e2e/network.rs	501	except Exception as error:	CODE
MEDIUM	src/mxc-sdk/tests/nvx_e2e/network.rs	20	def connect(port):	CODE

Modern AI Meta-Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/Build.yml	2	# split: this file orchestrates, each stage lives in its own reusable.	COMMENT

microsoft/mxc

Open-Source Code Quality, Security and Technical Debt Review