WinGet is the Windows Package Manager. This project includes a CLI (Command Line Interface), PowerShell modules, and a COM (Component Object Model) API (Application Programming Interface).
This report presents the forensic synthetic code analysis of microsoft/winget-cli, a C++ project with 26,165 GitHub stars. SynthScan v2.0 examined 324,887 lines of code across 2111 source files, recording 859 pattern matches distributed across 9 syntactic categories. The overall adjusted score of 3.0 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 859 distinct pattern matches across 9 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tallAndCheckCorrelation/InstallAndCheckCorrelation.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | tools/SampleWinGetUWPCaller/AppInstallerCaller/pch.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | tools/SampleWinGetUWPCaller/AppInstallerCaller/App.cpp | 101 | /// <summary> | COMMENT |
| LOW | tools/IndexComparisonTool/pch.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | tools/IndexComparisonTool/pch.h | 21 | #include <string> | COMMENT |
| LOW | tools/IndexComparisonTool/pch.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | samples/ConnectionValidationSample/Program.cs | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | samples/WinGetUWPCaller/WinGetUWPCaller/pch.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | samples/WinGetUWPCaller/WinGetUWPCaller/pch.h | 21 | #include <mutex> | COMMENT |
| LOW | samples/WinGetUWPCaller/WinGetUWPCaller/MainPage.cpp | 841 | else if (uninstallResult) | COMMENT |
| LOW | samples/WinGetUWPCaller/WinGetUWPCaller/App.cpp | 101 | /// <summary> | COMMENT |
| LOW | .github/workflows/spelling3.yml | 1 | # spelling.yml is blocked per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p | COMMENT |
| LOW | .github/workflows/spelling3.yml | 21 | # | COMMENT |
| LOW | .github/workflows/spelling3.yml | 41 | # Access to SARIF reports is generally restricted (by GitHub) to members of the repository. | COMMENT |
| LOW | .github/actions/spelling/patterns.txt | 81 | COMMENT | |
| LOW | doc/specs/#888 - Com Api.md | 441 | /// SAMPLE VALUES: For OpenWindowsCatalog "Microsoft.Winget.Source_8wekyb3d8bbwe" | COMMENT |
| LOW | doc/specs/#888 - Com Api.md | 661 | FindPackagesOptions(); | COMMENT |
| LOW | src/binver/binver/version.h | 1 | #define STRINGIZE2(s) #s | COMMENT |
| LOW | src/binver/binver/version.h | 21 | #define VER_COPYRIGHT_STR "Copyright (c) Microsoft Corporation" | COMMENT |
| LOW | src/binver/binver/resource.h | 1 | //{{NO_DEPENDENCIES}} | COMMENT |
| LOW | …nitTests/ManifestUnitTest/ManifestEqualityUnitTests.cs | 121 | /// Manifest with all properties that provide equality. | COMMENT |
| LOW | …terop.UnitTests/ManifestUnitTest/V1ManifestReadTest.cs | 541 | #pragma warning disable SA1310 // FieldNamesMustNotContainUnderscore | COMMENT |
| LOW | …terop.UnitTests/ManifestUnitTest/V1ManifestReadTest.cs | 561 | COMMENT | |
| LOW | src/AppInstallerTestExeInstaller/main.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/ComInprocTestbed/pch.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/ComInprocTestbed/pch.h | 21 | #include <string_view> | COMMENT |
| LOW | src/ComInprocTestbed/Tests.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/ComInprocTestbed/pch.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/Dependencies.cpp | 1 | #include "pch.h" | COMMENT |
| LOW | src/AppInstallerCLITests/PinFlow.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/pch.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/pch.h | 21 | #include <catch2/reporters/catch_reporter_registrars.hpp> | COMMENT |
| LOW | src/AppInstallerCLITests/pch.h | 41 | #include <fstream> | COMMENT |
| LOW | src/AppInstallerCLITests/WorkFlow.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/WorkflowCommon.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/TestCommon.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/CustomHeader.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/PortableInstaller.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/Command.cpp | 181 | COMMENT | |
| LOW | src/AppInstallerCLITests/WorkflowGroupPolicy.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/PreIndexedPackageSource.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/UserSettings.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/RestClient.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/TestHooks.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/CompositeSource.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/InstallDependenciesFlow.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/ARPChanges.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/RestInterface_1_7.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/HttpClientHelper.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/InstallFlow.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/RestInterface_1_0.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/main.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/WorkflowCommon.h | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/Sources.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/ResumeFlow.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/AppInstallerCLITests/SQLiteIndex.cpp | 1 | // Copyright (c) Microsoft Corporation. | COMMENT |
| LOW | src/WinGetUtilInterop/Manifest/ManifestVersion.cs | 1 | // ----------------------------------------------------------------------------- | COMMENT |
| LOW | src/WinGetUtilInterop/Manifest/ManifestVersion.cs | 21 | /// <summary> | COMMENT |
| LOW | src/WinGetUtilInterop/Manifest/ManifestVersion.cs | 41 | /// <summary> | COMMENT |
| LOW | src/WinGetUtilInterop/Manifest/V1/MinManifestInfo.cs | 41 | public string ManifestType { get; set; } | COMMENT |
| 755 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 10 | // ── State ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 46 | // ── DOM refs ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 66 | // ── Helpers ────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 153 | // ── Filter logic ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 213 | // ── Sidebar builder ────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 353 | // ── Virtual scroll renderer ─────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 452 | // ── Scroll handler (virtual scroll repaint) ─────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 474 | // ── Error navigation ───────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 497 | // ── Option toggles ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 513 | // ── Search ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 523 | // ── Level / Channel / Subchannel "All / None" buttons ──────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 567 | // ── Export ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/media/viewer.js | 577 | // ── Message handler (from extension host) ───────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/src/logViewerProvider.ts | 21 | // ── CustomReadonlyEditorProvider ──────────────────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/src/logViewerProvider.ts | 97 | // ── Public: open any log file in a new panel ───────────────────── | COMMENT |
| MEDIUM | tools/WinGetLogViewer/src/logViewerProvider.ts | 166 | // ── HTML builder ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | src/AppInstallerCLICore/Commands/DebugCommand.cpp | 399 | // ── LogViewerTestCommand ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/AppInstallerCLICore/Commands/DebugCommand.cpp | 430 | // ── All five levels on CLI ──────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/AppInstallerCLICore/Commands/DebugCommand.cpp | 437 | // ── One Info entry on every channel ────────────────────────────────── | COMMENT |
| MEDIUM⚡ | src/AppInstallerCLICore/Commands/DebugCommand.cpp | 447 | // ── Subchannel simulation (sub-component logs routed through CLI) ───── | COMMENT |
| MEDIUM | src/AppInstallerCLICore/Commands/DebugCommand.cpp | 471 | // ── Follow mode: stream log lines every 3 seconds ──────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ryCore/Microsoft/Schema/1_0/SearchResultsTable_1_0.cpp | 78 | // Create an insert statement to select values into the table as requested. | COMMENT |
| HIGH | …ryCore/Microsoft/Schema/2_0/SearchResultsTable_2_0.cpp | 80 | // Create an insert statement to select values into the table as requested. | COMMENT |
| HIGH | src/AppInstallerRepositoryCore/Rest/RestClient.cpp | 170 | // Cache the information value as requested | COMMENT |
| HIGH | …et.SharedLib/Resources/GroupPolicyResource.Designer.cs | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …t.Configuration.Engine/Resources/Resources.Designer.cs | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | ….WinGet.Client.Engine/Properties/Resources.Designer.cs | 3 | // This code was generated by a tool. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …c/AppInstallerCLIE2ETests/PowerShell/PowerShellHost.cs | 65 | var newModulePath = this.PowerShell.Runspace.SessionStateProxy.PSVariable.GetValue("env:PSModulePath") + $"; | CODE |
| CRITICAL | …c/AppInstallerCLIE2ETests/PowerShell/PowerShellHost.cs | 66 | this.PowerShell.Runspace.SessionStateProxy.PSVariable.Set("env:PSModulePath", newModulePath); | CODE |
| CRITICAL | …nitTests/Tests/ConfigurationProcessorTelemetryTests.cs | 189 | Assert.Equal(testObjects.GetResult.ResultInformation.ResultCode.HResult.ToString(), runEvent.Properties[Tele | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/AppInstallerCLITests/RestClient.cpp | 65 | // Update this test to next version so that we don't forget to add to supported versions before rest e2e tests are a | COMMENT |
| LOW | src/AppInstallerCLITests/TestHooks.h | 29 | // Don't forget to clear the overrides after use! | COMMENT |
| MEDIUM | src/AppInstallerCLICore/Argument.cpp | 336 | // Used for demonstration purposes | COMMENT |
| MEDIUM | src/AppInstallerCLICore/ExecutionArgs.h | 196 | // Used for demonstration purposes | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …oryCore/Microsoft/PredefinedInstalledSourceFactory.cpp | 320 | // TODO: To support servicing, the initial implementation of update will simply leverage | COMMENT |
| MEDIUM | …sitoryCore/Microsoft/ConfigurableTestSourceFactory.cpp | 30 | // TODO: If this becomes more dynamic, refactor the UserSettings code to make it easier to leverage | COMMENT |
| MEDIUM | …nstallerCLICore/ConfigurationDynamicRuntimeFactory.cpp | 44 | // have this implementation leverage that one with an event handler for the packaged specifics. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | doc/windows/package-manager/package/repository.md | 31 | ### Step 1: Validate your manifest | COMMENT |
| LOW | doc/windows/package-manager/package/repository.md | 41 | ### Step 2: Clone the repository | COMMENT |
| LOW | doc/windows/package-manager/package/repository.md | 58 | ### Step 3: Add your manifest to the local repository | COMMENT |
| LOW | doc/windows/package-manager/package/repository.md | 72 | ### Step 4: Submit your manifest to the remote repository | COMMENT |
| LOW | doc/windows/package-manager/package/repository.md | 86 | ### Step 5: Create a pull request | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …stallerRepositoryCore/Public/winget/RepositorySearch.h | 376 | // Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/AppInstallerCLITests/TestRestRequestHandler.h | 6 | class TestRestRequestHandler : public web::http::http_pipeline_stage | CODE |