AI Slop Code Risk Monitor

miurla/morphic

SlopCodeMonitor badge for miurla/morphic Adjusted legacy signal; badge bands: 25 / 50 / 75 (different from dashboard bands).

An AI-powered search engine with a generative UI

2.3 Low pattern signal View on GitHub

Open-Source Code Quality, Security and Technical Debt Review

This report summarizes scanner evidence for miurla/morphic, a TypeScript project with 9,232 GitHub stars. SynthScan examined 97,046 lines of code across 620 source files, recording 121 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 2.3 (Low pattern signal); it is not an authorship estimate.

Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.

2.3
Adjusted Signal
2.3
Raw Pattern Score
100%
Time Factor
2026-11-01
Last Push
9.2K
Stars
TypeScript
Language
97.0K
Lines of Code
620
Files
121
Pattern Hits
2026-10-31
Scan Date
0.02
HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.5/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 83 finding(s).

Hallucinated Dependency & Supply Chain Risk 6.4/100 · LOW

Are imports declared and package/API names verified? 38 finding(s).

Agent Over-Engineering Ratio 3.7/100 · LOW

Are wrappers, guards, and repeated structures necessary? 70 finding(s).

PR Review Velocity Impact 10.4/100 · LOW

Which changes need focused human review? 121 finding(s).

What These Metrics Mean

Adjusted Signal
Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score
Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor
A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits
Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate
High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files
Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 7HIGH 5MEDIUM 2LOW 107

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 121 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers70 hits · 73 pts
SeverityFileLineSnippetContext
LOWevals/evaluators/related-questions.ts114export function summarizeRelatedQuestions(CODE
LOWevals/lib/dataset.ts49export function loadRelatedQuestionsDataset({CODE
LOWlib/search-mode-availability.ts16export function isAdaptiveModeAuthBlocked({CODE
LOWlib/tools/search.ts37function getOptimizedSearchProviderType(): SearchProviderType {CODE
LOWlib/tools/search.ts51function describeRecoverableSearchFailure(CODE
LOWlib/tools/search/providers/recoverable-error.ts62export function classifyRecoverableSearchError(CODE
LOWlib/config/model-selection-cookie.ts8export function serializeModelSelectionCookie(CODE
LOWlib/config/model-selection-cookie.ts16export function parseModelSelectionCookie(CODE
LOWlib/config/load-models-config.ts19function validateModelsConfigStructure(CODE
LOWlib/config/ollama-validator.ts18async function getConfiguredOllamaModels(): Promise<Model[]> {CODE
LOWlib/config/ollama-validator.ts48export async function initializeOllamaValidation(): Promise<void> {CODE
LOWlib/auth/provider.ts23function enforceCloudDeploymentGuard(CODE
LOWlib/auth/better-auth/invitations.ts84export async function hasRecentBootstrapInvitation(CODE
LOWlib/auth/better-auth/config.ts25export function isBetterAuthSmtpConfigured(): boolean {CODE
LOWlib/render/linked-cards-markdown.ts42export function linkedCardsFenceToMarkdown(fence: string): string | null {CODE
LOWlib/render/prompt.ts7export function getRelatedQuestionsSpecPrompt(): string {CODE
LOW⚡lib/render/streamdown-spec.tsx8export function createStreamdownSpecRenderer(): CustomRenderer {CODE
LOW⚡lib/render/streamdown-spec.tsx18export function createStreamdownDraftRenderer(): CustomRenderer {CODE
LOW⚡lib/render/streamdown-spec.tsx27export function mergeStreamdownSpecRenderer(CODE
LOWlib/render/__tests__/parse-spec-block.test.ts6function buildRelatedQuestionsSource(questions: string[]): string {CODE
LOWlib/agents/prompts/search-mode-prompts.ts35function getSourceDirectionGuidance(allowFallback = true): string {CODE
LOWlib/utils/message-mapping.ts137export function mapUIMessagePartsToDBParts(CODE
LOW⚡lib/utils/search-config.ts10export function isGeneralSearchProviderAvailable(): boolean {CODE
LOW⚡lib/utils/search-config.ts17export function getGeneralSearchProviderName(): string {CODE
LOW⚡lib/utils/search-config.ts27export function supportsMultimediaContentTypes(): boolean {CODE
LOWlib/utils/search-config.ts90export function getSearchStrategyGuidance(): string {CODE
LOWlib/utils/search-config.ts113export function getGeneralSearchProviderType(): 'brave' | null {CODE
LOWlib/utils/perf-tracking.ts30export function incrementDbOperationCount() {CODE
LOWlib/utils/registry.ts13function normalizeOpenAICompatibleBaseURL(raw: string): string {CODE
LOWlib/utils/citation.ts27export function createCitationLabelAllocator(seed = 1): CitationLabelAllocator {CODE
LOWlib/utils/citation.ts193export function extractCitationMapsFromMessages(CODE
LOWlib/models/fetch-models.ts128function passesOpenAICompatibleFilters(id: string): boolean {CODE
LOWlib/models/fetch-models.ts318export async function fetchOpenAICompatibleModels(): Promise<Model[]> {CODE
LOWlib/usage-budget/analytics.ts39export function trackUsageGrantSyncFailed(data: {CODE
LOWlib/usage-budget/analytics.ts54export function trackAdditionalUsageInterest(userId: string): Promise<void> {CODE
LOWlib/usage-budget/gate.ts200async function getOrSyncGrantLimit(params: {CODE
LOWlib/usage-budget/events.ts40export async function recordAdditionalUsageInterest(CODE
LOWlib/storage/r2-client.ts31export function parseSignedUrlStabilityWindowSeconds(CODE
LOWlib/storage/r2-client.ts92export function isObjectStorageConfigured() {CODE
LOWlib/storage/r2-client.ts119export function getObjectKeyFromSignedUrl(url: string): string | undefined {CODE
LOWlib/storage/r2-client.ts160export function getChatFileObjectKeyPrefix(userId: string, chatId: string) {CODE
LOWlib/storage/r2-client.ts164export function getUserFileObjectKeyPrefix(userId: string) {CODE
LOWlib/supabase/keys.ts1export function getSupabasePublishableKey() {CODE
LOWlib/streaming/create-ephemeral-chat-stream-response.ts63export async function createEphemeralChatStreamResponse(CODE
LOWlib/streaming/helpers/log-api-call-error.ts129export function logAPICallErrorDiagnostics(error: unknown): void {CODE
LOWlib/streaming/helpers/log-api-call-error.ts141export function buildAPICallErrorDiagnostics(CODE
LOWlib/streaming/helpers/stream-error-diagnostics.ts110export function buildStreamErrorSpanUpdate(CODE
LOWlib/streaming/helpers/strip-spec-from-messages.ts24function stripNonRelatedSpecBlocks(text: string): string {CODE
LOWlib/streaming/helpers/compact-historical-messages.ts207export function compactHistoricalMessages(CODE
LOWlib/streaming/helpers/has-answer-after-tool-failure.ts23export function hasAnswerAfterToolFailure(CODE
LOW…ming/helpers/slice-without-splitting-surrogate-pair.ts1export function sliceWithoutSplittingSurrogatePair(CODE
LOWlib/streaming/helpers/cap-historical-attachments.ts35export function parseAttachmentTokenBudget(raw: string | undefined): number {CODE
LOWlib/streaming/helpers/trim-cold-start-history.ts13export function parseColdStartHistoryTokenLimit(CODE
LOWlib/streaming/helpers/cap-historical-pasted-content.ts8export function parsePastedContentCharBudget(raw: string | undefined): number {CODE
LOWlib/streaming/helpers/cap-historical-pasted-content.ts41export function capHistoricalPastedContent(CODE
LOWlib/streaming/helpers/attachment-token-estimates.ts13export function buildAttachmentTokenEstimates(CODE
LOWlib/schema/question.ts42export function getQuestionSchemaForModel(fullModel: string) {CODE
LOWlib/actions/admin.ts147export async function resetMemberPasswordAction(params: {CODE
LOWlib/actions/chat.ts139export async function createChatWithFirstMessage(CODE
LOWlib/db/actions.ts783export async function getAttachmentSizesByObjectKey({CODE
10 more matches not shown…
Hallucination Indicators7 hits · 70 pts
SeverityFileLineSnippetContext
CRITICAL…_tests__/create-ephemeral-chat-stream-response.test.ts299 const update = mocks.span.update.mock.calls.at(-1)?.[0]CODE
CRITICAL…_tests__/create-ephemeral-chat-stream-response.test.ts320 const update = mocks.span.update.mock.calls.at(-1)?.[0]CODE
CRITICAL…_tests__/create-ephemeral-chat-stream-response.test.ts337 const update = mocks.span.update.mock.calls.at(-1)?.[0]CODE
CRITICAL…_tests__/create-ephemeral-chat-stream-response.test.ts355 const update = mocks.span.update.mock.calls.at(-1)?.[0]CODE
CRITICAL…treaming/__tests__/create-chat-stream-response.test.ts420 const update = mocks.span.update.mock.calls.at(-1)?.[0]CODE
CRITICAL…treaming/__tests__/create-chat-stream-response.test.ts653 const update = mocks.span.update.mock.calls.at(-1)?.[0]CODE
CRITICAL…treaming/__tests__/create-chat-stream-response.test.ts678 const update = mocks.span.update.mock.calls.at(-1)?.[0]CODE
Magic Placeholder Names5 hits · 32 pts
SeverityFileLineSnippetContext
HIGH⚡docs/CONFIGURATION.md62OPENAI_API_KEY=[YOUR_API_KEY]CODE
HIGH⚡docs/CONFIGURATION.md68ANTHROPIC_API_KEY=[YOUR_API_KEY]CODE
HIGH⚡docs/CONFIGURATION.md74GOOGLE_GENERATIVE_AI_API_KEY=[YOUR_API_KEY]CODE
HIGHdocs/CONFIGURATION.md100OPENAI_COMPATIBLE_API_KEY=[YOUR_API_KEY]CODE
HIGHdocs/CONFIGURATION.md588JINA_API_KEY=[YOUR_API_KEY]CODE
Fake / Example Data26 hits · 26 pts
SeverityFileLineSnippetContext
LOWapp/api/feedback/__tests__/route.test.ts110 email: 'user@example.com'CODE
LOWcomponents/sidebar/__tests__/version-footer.test.tsx31 email: 'user@example.com',CODE
LOWcomponents/sidebar/__tests__/version-footer.test.tsx102 vi.stubEnv('MORPHIC_ADMIN_EMAILS', 'user@example.com')CODE
LOW…mponents/__tests__/reset-member-password-form.test.tsx13 { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'admin' },CODE
LOWcomponents/__tests__/login-form.test.tsx68 target: { value: 'user@example.com' }CODE
LOWcomponents/__tests__/login-form.test.tsx77 email: 'user@example.com',CODE
LOWcomponents/__tests__/login-form.test.tsx92 target: { value: 'user@example.com' }CODE
LOWcomponents/__tests__/login-form.test.tsx109 target: { value: 'user@example.com' }CODE
LOWcomponents/__tests__/login-form.test.tsx127 target: { value: 'user@example.com' }CODE
LOWcomponents/__tests__/login-form.test.tsx147 target: { value: 'user@example.com' }CODE
LOWcomponents/__tests__/member-role-manager.test.tsx16 { id: 'admin-1', email: 'admin@example.com', name: 'Admin', role: 'admin' },CODE
LOWlib/auth/__tests__/supabase-provider.test.ts47 await supabaseAuthProvider.requestPasswordReset!('user@example.com')CODE
LOWlib/auth/__tests__/supabase-provider.test.ts50 expect(resetPasswordForEmail).toHaveBeenCalledWith('user@example.com', {CODE
LOWlib/auth/__tests__/better-auth-provider.test.ts139 email: 'admin@example.com',CODE
LOWlib/auth/__tests__/better-auth-provider.test.ts228 email: 'admin@example.com',CODE
LOWlib/auth/__tests__/better-auth-provider.test.ts360 email: 'admin@example.com',CODE
LOWlib/auth/__tests__/better-auth-provider.test.ts381 email: 'admin@example.com',CODE
LOWlib/auth/__tests__/better-auth-provider.test.ts945 await betterAuthProvider.requestPasswordReset!('admin@example.com')CODE
LOWlib/auth/__tests__/better-auth-provider.test.ts960 await betterAuthProvider.requestPasswordReset!('admin@example.com')CODE
LOWlib/auth/__tests__/better-auth-provider.test.ts966 email: 'admin@example.com',CODE
LOWlib/auth/better-auth/__tests__/config.test.ts102 process.env.BOOTSTRAP_ADMIN_EMAIL = 'admin@example.com'CODE
LOWlib/auth/better-auth/__tests__/config.test.ts115 applyBootstrapAdminGate({ email: 'admin@example.com' })CODE
LOWlib/auth/better-auth/__tests__/config.test.ts120 process.env.BOOTSTRAP_ADMIN_EMAIL = 'admin@example.com'CODE
LOWlib/utils/__tests__/search-query.test.ts65 expect(normalizeSearchQuery(prefix + 'user@example.com')).toBe(CODE
LOWlib/actions/__tests__/admin.test.ts48 email: 'admin@example.com',CODE
LOWlib/actions/__tests__/account-better-auth.test.ts65 email: 'user@example.com',CODE
Over-Commented Block11 hits · 11 pts
SeverityFileLineSnippetContext
LOWsearxng-limiter.toml1#https://docs.searxng.org/admin/searx.limiter.htmlCOMMENT
LOWdocker-compose.yaml21 ENABLE_AUTH: ${ENABLE_AUTH:-false}COMMENT
LOWapp/api/auth/[...all]/route.ts1import { getAuth } from '@/lib/auth/better-auth/config'COMMENT
LOWcomponents/sidebar/chat-history-search.tsx121 useEffect(() => {COMMENT
LOWcomponents/sidebar/chat-history-client.tsx41 const resultsRef = useRef<HTMLDivElement>(null)COMMENT
LOWcomponents/sidebar/chat-history-client.tsx61 // successful fetch.COMMENT
LOWlib/auth/providers/better-auth.ts401 // Fail closed: without a canonical origin the confirmation linkCOMMENT
LOWlib/auth/better-auth/config.ts421 // verification, so this is the only email better-auth delivers;COMMENT
LOWlib/utils/search-query.ts41COMMENT
LOWlib/supabase/middleware.ts61 url.pathname = '/auth/login'COMMENT
LOWlib/actions/account.ts121 if (provider.validateDeletion) {COMMENT
Slop Phrases1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUMproxy.ts79 * Feel free to modify this pattern to include more paths.COMMENT
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippetContext
MEDIUM.github/workflows/eval.yml21 # Only what changes model behaviour. A change to the harness itself moves noCOMMENT