1.7

Adjusted Signal

1.7

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

13.7K

Stars

TypeScript

Language

243.1K

Lines of Code

1.0K

Files

282

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 5.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 228 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.9/100 · LOW

Are imports declared and package/API names verified? 25 finding(s).

Agent Over-Engineering Ratio 4.3/100 · LOW

Are wrappers, guards, and repeated structures necessary? 149 finding(s).

PR Review Velocity Impact 7.4/100 · LOW

Which changes need focused human review? 282 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 4MEDIUM 37LOW 241

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 282 distinct pattern matches across 13 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers120 hits · 120 pts

Severity	File	Line	Snippet	Context
LOW	test/e2e/scenarios/client-auth.test.ts	82	function createMockAuthorizationServer(config: MockASConfig = {}) {	CODE
LOW	test/e2e/scenarios/client-auth.test.ts	1489	function createScopeRequiringWorld() {	CODE
LOW	test/e2e/scenarios/client-auth.test.ts	2868	function createMigratingAuthorizationServer() {	CODE
LOW	test/e2e/scenarios/transport-raw.test.ts	60	function expectedNegotiatedVersion(requested: string): string {	CODE
LOW	test/e2e/helpers/express.ts	52	export async function startExpressWithHostValidation(allowedHosts: string[], handler: RequestHandler): Promise<ExpressHo	CODE
LOW	test/helpers/src/helpers/http.ts	32	export function createExpressResponseMock(options: { trackRedirectUrl?: boolean } = {}): Response & {	CODE
LOW	test/helpers/src/helpers/http.ts	87	export function createNodeServerResponseMock(): ServerResponse {	CODE
LOW	test/conformance/src/everythingClient.ts	246	async function runHttpStandardHeadersClient(serverUrl: string): Promise<void> {	CODE
LOW	test/conformance/src/everythingClient.ts	292	async function connectModernHeaderClient(serverUrl: string): Promise<Client> {	CODE
LOW	test/conformance/src/everythingClient.ts	305	async function runHttpCustomHeadersClient(serverUrl: string): Promise<void> {	CODE
LOW	test/conformance/src/everythingClient.ts	321	async function runHttpInvalidToolHeadersClient(serverUrl: string): Promise<void> {	CODE
LOW	test/conformance/src/everythingClient.ts	355	function withLocalDiscoverResponse(serverInfo: { name: string; version: string }): typeof fetch {	CODE
LOW	test/conformance/src/everythingClient.ts	595	async function runClientCredentialsBasic(serverUrl: string): Promise<void> {	CODE
LOW	test/conformance/src/everythingClient.ts	638	async function runCrossAppAccessCompleteFlow(serverUrl: string): Promise<void> {	CODE
LOW	test/conformance/src/everythingClient.ts	720	async function runElicitationDefaultsClient(serverUrl: string): Promise<void> {	CODE
LOW	test/conformance/src/everythingClient.ts	832	async function runJsonSchemaRefNoDerefClient(serverUrl: string): Promise<void> {	CODE
LOW	test/conformance/src/everythingClient.ts	943	async function runSkillsNoPrefetchClient(serverUrl: string): Promise<void> {	CODE
LOW	examples/oauth/client.ts	52	async function followAuthorizationRedirects(authorizationUrl: URL): Promise<URLSearchParams> {	CODE
LOW	examples/oauth/dualModeAuth.ts	39	function createHostManagedTransport(serverUrl: URL, session: HostSessionStore, ui: HostUi): StreamableHTTPClientTranspor	CODE
LOW	examples/oauth/dualModeAuth.ts	58	function createUserConfiguredTransport(	CODE
LOW	examples/cli-client/host/auth.ts	154	export async function completeAuthorizationWithBrowser(options: {	CODE
LOW	examples/repl/client.ts	672	async function runNotificationsToolWithResumability(interval: number, count: number): Promise<void> {	CODE
LOW	examples/shared/src/authServer.ts	350	export function createProtectedResourceMetadataRouter(resourcePath = '/mcp'): Router {	CODE
LOW	examples/shared/src/clientCredentialsAuthServer.ts	55	export function createClientCredentialsAuthServer(options: ClientCredentialsAuthServerOptions): ClientCredentialsAuthSer	CODE
LOW	scripts/sync-snippets.ts	300	function getOrLoadRegion(	CODE
LOW	…/middleware/express/src/middleware/originValidation.ts	50	export function localhostOriginValidation(): RequestHandler {	CODE
LOW	…ges/middleware/hono/src/middleware/originValidation.ts	36	export function localhostOriginValidation(): MiddlewareHandler {	CODE
LOW	packages/middleware/node/test/toNodeHandler.test.ts	40	function bodyDerivedStandardHeaders(body: unknown): Record<string, string> {	CODE
LOW	packages/middleware/node/test/streamableHttp.test.ts	3100	async function createTestServerWithDnsProtection(config: {	CODE
LOW	packages/middleware/node/src/toNodeHandler.ts	44	function resolveMaxRequestBodySize(value: number \| undefined): number {	CODE
LOW	packages/middleware/node/src/toNodeHandler.ts	359	function internalServerErrorResponse(id: string \| number \| null): Response {	CODE
LOW	…ges/middleware/node/src/middleware/originValidation.ts	52	export function localhostOriginValidation(): (req: IncomingMessage, res: ServerResponse) => boolean {	CODE
LOW	…/middleware/fastify/src/middleware/originValidation.ts	48	export function localhostOriginValidation() {	CODE
LOW	…es/core-internal/test/wire/stampingSuppression.test.ts	84	function expectNoStampedVocabulary(value: unknown): void {	CODE
LOW	packages/core-internal/src/types/guards.ts	128	export function assertCompleteRequestPrompt(request: CompleteRequest): asserts request is CompleteRequestPrompt {	CODE
LOW	packages/core-internal/src/types/guards.ts	135	export function assertCompleteRequestResourceTemplate(request: CompleteRequest): asserts request is CompleteRequestResou	CODE
LOW	packages/core-internal/src/wire/codec.ts	340	export function isExtensionReusedRequestMethod(method: string): boolean {	CODE
LOW	packages/core-internal/src/wire/resultFamilies.ts	13	export function normalizeContentlessToolResult(value: unknown): unknown {	CODE
LOW	packages/core-internal/src/wire/textFallback.ts	15	export function appendTextFallbackForNonObject(result: CallToolResult): CallToolResult {	CODE
LOW	…ges/core-internal/src/wire/rev2025-11-25/legacyWrap.ts	25	export function isNonObjectJsonSchemaRoot(json: Readonly<Record<string, unknown>>): boolean {	CODE
LOW	…ges/core-internal/src/wire/rev2025-11-25/legacyWrap.ts	127	export function wrapOutputSchemaForLegacy(natural: Readonly<Record<string, unknown>>): Record<string, unknown> {	CODE
LOW	packages/core-internal/src/util/standardSchema.ts	183	export function standardSchemaToJsonSchema(schema: StandardJSONSchemaV1, io: 'input' \| 'output' = 'input'): Record<strin	CODE
LOW	packages/core-internal/src/util/standardSchema.ts	248	function isProvablyObjectShapedRoot(schema: Record<string, unknown>, root = schema): boolean {	CODE
LOW	packages/core-internal/src/util/standardSchema.ts	322	function referencePatternsForFormat(format: NonNullable<StringSchema['format']>, pattern: string): ReadonlySet<string> {	CODE
LOW	packages/core-internal/src/util/standardSchema.ts	355	export function promptArgumentsFromStandardSchema(	CODE
LOW	…ckages/core-internal/src/shared/inputRequiredEngine.ts	64	function relatedMessagingUnavailable(member: string): never {	CODE
LOW	…ckages/core-internal/src/shared/inputRequiredEngine.ts	79	export function synthesizeInputRequestContext(	CODE
LOW	…ckages/core-internal/src/shared/inputRequiredEngine.ts	177	export function buildRetryLegRequestOptions(options: RequestOptions \| undefined, legOptions: InputRequiredRetryLegOption	CODE
LOW	packages/core-internal/src/shared/elicitation.ts	29	function convertStandardElicitationSchema(schema: StandardSchemaWithJSON): Record<string, unknown> {	CODE
LOW	packages/core-internal/src/shared/elicitation.ts	52	function isAnnotationOnlyJsonSchemaKeyword(key: string): boolean {	CODE
LOW	packages/core-internal/src/shared/elicitation.ts	134	function describeUnsupportedProperties(pruned: Record<string, unknown>, fallback: string): string {	CODE
LOW	packages/core-internal/src/shared/elicitation.ts	146	function findDroppedConstraintPaths(original: unknown, parsed: unknown, path = ''): string[] {	CODE
LOW	packages/core-internal/src/shared/elicitation.ts	163	export function normalizeElicitInputParams(input: ElicitInputParams): ElicitRequestFormParams {	CODE
LOW	packages/core-internal/src/shared/toolNameValidation.ts	109	export function validateAndWarnToolName(name: string): boolean {	CODE
LOW	…ckages/core-internal/src/shared/inputRequiredDriver.ts	78	export function resolveInputRequiredDriverConfig(options: InputRequiredOptions \| undefined): ResolvedInputRequiredDriver	CODE
LOW	…ckages/core-internal/src/shared/inputRequiredDriver.ts	126	export function buildInputRequiredRetryParams(	CODE
LOW	…ckages/core-internal/src/shared/inputRequiredDriver.ts	150	export function inputRequiredRoundsExceededMessage(method: string, maxRounds: number): string {	CODE
LOW	packages/core-internal/src/shared/mcpParamHeaders.ts	85	export function scanXMcpHeaderDeclarations(inputSchema: unknown): XMcpHeaderScanResult {	CODE
LOW	packages/core-internal/src/shared/mcpParamHeaders.ts	211	export function mcpParamPrimitiveToString(value: unknown): string \| undefined {	CODE
LOW	packages/core-internal/src/shared/mcpParamHeaders.ts	411	export function paramHeaderMismatchRejection(cell: string, header: string, body: string): InboundLadderRejection {	CODE
60 more matches not shown…

Decorative Section Separators29 hits · 93 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/e2e/scenarios/skills.test.ts	73	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	75	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	165	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	167	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	289	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	291	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	352	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	354	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	421	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	423	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	562	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	564	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	647	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	649	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	789	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	791	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	894	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/scenarios/skills.test.ts	896	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/helpers/index.ts	238	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/helpers/index.ts	240	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/helpers/index.ts	342	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/helpers/index.ts	344	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/helpers/index.ts	399	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	test/e2e/helpers/index.ts	407	// ───────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	scripts/build-docs-site.sh	32	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/build-docs-site.sh	34	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/build-docs-site.sh	45	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	scripts/build-docs-site.sh	47	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	packages/core-internal/src/wire/codec.ts	171	// ── Function-only validation surface ──────────────────────────────────	COMMENT

Over-Commented Block57 hits · 57 pts

Severity	File	Line	Snippet	Context
LOW	test/integration/test/server.test.ts	2121		COMMENT
LOW	test/integration/test/client/client.test.ts	2241		COMMENT
LOW	test/e2e/scenarios/jsonschema.test.ts	541	expect(r.structuredContent).toEqual({ result: [1, [2, 3]] });	COMMENT
LOW	test/e2e/helpers/wire-sniffer.ts	101	if (isJSONRPCResultResponse(msg)) {	COMMENT
LOW	test/e2e/helpers/index.ts	141	fetch,	COMMENT
LOW	test/conformance/expected-failures.2026-07-28.yaml	1	# Expected failures for the carried-forward x 2026-07-28 legs	COMMENT
LOW	test/conformance/expected-failures.2026-07-28.yaml	21	# suite, so the two legs that read this file never run them. Their 2026-07-28	COMMENT
LOW	test/conformance/expected-failures.2026-07-28.yaml	41	# corresponding scenarios start passing and MUST be removed from this list	COMMENT
LOW	test/conformance/expected-failures.yaml	1	# Conformance scenarios not yet implemented in the v2 TypeScript SDK.	COMMENT
LOW	test/conformance/expected-failures.yaml	21	# client@2025-11-25. The other version on each side runs in	COMMENT
LOW	test/conformance/expected-failures.yaml	41	# Entries are grouped by SEP. As each SEP/milestone is implemented in the SDK the	COMMENT
LOW	test/conformance/src/everythingClient.ts	221	await client.close();	COMMENT
LOW	test/conformance/src/everythingServer.ts	121	// attacker-controlled input. The SDK treats it as an opaque string and applies	COMMENT
LOW	test/conformance/src/everythingServer.ts	801	// ===== MULTI-ROUND-TRIP TOOLS (SEP-2322, protocol revision 2026-07-28) =====	COMMENT
LOW	test/conformance/src/everythingServer.ts	1081	return inputRequired({ inputRequests });	COMMENT
LOW	examples/shared/src/index.ts	1	// Argv-parse + assert scaffold (NO SDK calls — those go inline in each story).	COMMENT
LOW	examples/guides/serving/express.examples.ts	61	//#region createMcpExpressApp_listen	COMMENT
LOW	examples/guides/serving/stdio.examples.ts	61	}	COMMENT
LOW	examples/guides/get-started/packages.examples.ts	21		COMMENT
LOW	examples/guides/get-started/firstClient.examples.ts	141	// "Close the connection"	COMMENT
LOW	examples/gateway/client.ts	41	// Server identity: getServerVersion() resolves it from the discover result's	COMMENT
LOW	scripts/build-docs-site.sh	1	#!/usr/bin/env bash	COMMENT
LOW	packages/middleware/node/tsdown.config.ts	21	// 4. Type Definitions	COMMENT
LOW	packages/core-internal/test/types/registryPins.test.ts	21	import { describe, expect, it } from 'vitest';	COMMENT
LOW	packages/core-internal/src/index.ts	21	export * from './shared/stdio';	COMMENT
LOW	packages/core-internal/src/index.ts	41	export { codecForVersion, MODERN_WIRE_REVISION } from './wire/codec';	COMMENT
LOW	…ges/core-internal/src/wire/rev2025-11-25/legacyWrap.ts	121	* `$id`-scoped: if the natural root carries a base-establishing `$id` no	COMMENT
LOW	packages/core-internal/src/shared/protocol.ts	901	protected _onnotification(rawNotification: JSONRPCNotification, extra?: MessageExtraInfo): void {	COMMENT
LOW	packages/core-internal/src/shared/protocol.ts	1121	droppedInputResponseKeys: partitionedInputResponses.droppedKeys	COMMENT
LOW	packages/core-internal/src/shared/protocol.ts	1161		COMMENT
LOW	packages/core/test/coreSchemas.test.ts	21	expect(CursorSchema.parse('abc')).toBe('abc');	COMMENT
LOW	packages/core/src/index.ts	1	// @modelcontextprotocol/core	COMMENT
LOW	packages/core/src/internal.ts	1	// @modelcontextprotocol/core/internal	COMMENT
LOW	packages/server/src/stdio.ts	1	// Subpath entry for stdio serving.	COMMENT
LOW	packages/server/src/server/streamableHttp.ts	1221	// `streamId` above), not on whether a live SSE writer currently	COMMENT
LOW	packages/server/src/server/createMcpHandler.ts	741	}	COMMENT
LOW	packages/server/src/server/createMcpHandler.ts	801	// capacity / teardown. The factory IS constructed for listen — to read	COMMENT
LOW	packages/server/src/server/perRequestTransport.ts	281	// MissingRequiredClientCapability (-32021), whose 400 the spec	COMMENT
LOW	packages/server/src/server/serveStdio.ts	541	// channel must not tear down the connection the fallback is about to	COMMENT
LOW	packages/server/src/server/serveStdio.ts	641	}	COMMENT
LOW	packages/server/src/server/serveStdio.ts	661	// The connection was torn down while the factory was	COMMENT
LOW	packages/client/test/client/listen.test.ts	181	// The spec-defined remote termination signal is now observable on the	COMMENT
LOW	packages/client/src/stdio.ts	1	// Subpath entry for the stdio client transport.	COMMENT
LOW	packages/client/src/client/sse.ts	221	// Start from the caller-supplied `requestInit.headers` and `set()` the	COMMENT
LOW	packages/client/src/client/streamableHttp.ts	481		COMMENT
LOW	packages/client/src/client/streamableHttp.ts	541	// SEP-2243 standard headers, step 2 of the 5-step client algorithm:	COMMENT
LOW	packages/client/src/client/streamableHttp.ts	1121	throw markAuthSeamEscape(new UnauthorizedError());	COMMENT
LOW	packages/client/src/client/client.ts	1221	// value for BOTH handler registration and the auto-open filter, so	COMMENT
LOW	packages/client/src/client/client.ts	1261	// would silently tear the auto-opened stream down the moment	COMMENT
LOW	packages/client/src/client/client.ts	2021	throw reason instanceof SdkError ? reason : new SdkError(SdkErrorCode.RequestTimeout, String(reason));	COMMENT
LOW	packages/client/src/client/client.ts	2141		COMMENT
LOW	packages/client/src/client/client.ts	2221	// Per-URI eviction (mcp.d's `invalidateLogical`): the now-cached	COMMENT
LOW	packages/client/src/client/client.ts	2381	// branch. In a browser environment, dynamically named `Mcp-Param-*`	COMMENT
LOW	packages/client/src/client/client.ts	2441	assertCompiled();	COMMENT
LOW	packages/client/src/client/client.ts	2461	}	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	161	if (pm !== 'pnpm') return `${pm} install --ignore-scripts`;	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	721	for (const checkType of ['typecheck', 'build', 'test', 'lint']) {	COMMENT

Verbosity Indicators21 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	test/e2e/scenarios/flow.test.ts	315	// Step 1: first call rejects with UrlElicitationRequiredError	COMMENT
LOW⚡	test/e2e/scenarios/flow.test.ts	327	// Step 2: user "opens" the URL (out-of-band, simulated by marking complete)	COMMENT
LOW⚡	test/e2e/scenarios/flow.test.ts	330	// Step 3: server emits notifications/elicitation/complete and the client receives it for that exact elicitation	COMMENT
LOW⚡	test/e2e/scenarios/flow.test.ts	335	// Step 4: retry succeeds	COMMENT
LOW	test/e2e/scenarios/flow.test.ts	537	// Step 1: first connect fails with 401 → discovery + DCR + redirect to the authorization endpoint	COMMENT
LOW	test/e2e/scenarios/flow.test.ts	555	// Step 2: user completes redirect, finishAuth exchanges the code for tokens	COMMENT
LOW	test/e2e/scenarios/flow.test.ts	567	// Step 3: second connect with fresh transport succeeds and tools/list works	COMMENT
LOW	examples/gateway/client.ts	33	// Step 1: bootstrap — one server/discover probe.	COMMENT
LOW⚡	examples/gateway/client.ts	50	// Step 2: persist. In a real gateway you'd write this to Redis / a config	COMMENT
LOW⚡	examples/gateway/client.ts	57	// Step 3: three fresh workers connect from the persisted blob — zero	COMMENT
LOW	examples/gateway/client.ts	74	// Step 4: prove it. Three connect() calls and the count is unchanged	COMMENT
LOW⚡	scripts/build-docs-site.sh	33	# Step 1: Build V2 site from the current checkout	COMMENT
LOW⚡	scripts/build-docs-site.sh	46	# Step 2: Build V1 site from the v1.x branch	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	634	// Step 1: Clone or reset	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	653	// Step 2: Detect package manager	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	661	// Step 3: Install. A clone that is its own pnpm workspace (catalog:/workspace: deps) must keep its	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	683	// Step 4: Baseline checks	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	693	// Step 5: Run codemod (local in-process API, or published CLI)	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	705	// Step 6: Point the clone's v2 deps at the chosen SDK source, then re-install	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	718	// Step 7: Post-codemod checks	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	804	// Step 8: Write per-repo report (nested under the per-run results dir)	COMMENT

Structural Annotation Overuse21 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	test/e2e/scenarios/flow.test.ts	315	// Step 1: first call rejects with UrlElicitationRequiredError	COMMENT
LOW⚡	test/e2e/scenarios/flow.test.ts	327	// Step 2: user "opens" the URL (out-of-band, simulated by marking complete)	COMMENT
LOW⚡	test/e2e/scenarios/flow.test.ts	330	// Step 3: server emits notifications/elicitation/complete and the client receives it for that exact elicitation	COMMENT
LOW⚡	test/e2e/scenarios/flow.test.ts	335	// Step 4: retry succeeds	COMMENT
LOW	test/e2e/scenarios/flow.test.ts	537	// Step 1: first connect fails with 401 → discovery + DCR + redirect to the authorization endpoint	COMMENT
LOW	test/e2e/scenarios/flow.test.ts	555	// Step 2: user completes redirect, finishAuth exchanges the code for tokens	COMMENT
LOW	test/e2e/scenarios/flow.test.ts	567	// Step 3: second connect with fresh transport succeeds and tools/list works	COMMENT
LOW	examples/gateway/client.ts	33	// Step 1: bootstrap — one server/discover probe.	COMMENT
LOW⚡	examples/gateway/client.ts	50	// Step 2: persist. In a real gateway you'd write this to Redis / a config	COMMENT
LOW⚡	examples/gateway/client.ts	57	// Step 3: three fresh workers connect from the persisted blob — zero	COMMENT
LOW	examples/gateway/client.ts	74	// Step 4: prove it. Three connect() calls and the count is unchanged	COMMENT
LOW⚡	scripts/build-docs-site.sh	33	# Step 1: Build V2 site from the current checkout	COMMENT
LOW⚡	scripts/build-docs-site.sh	46	# Step 2: Build V1 site from the v1.x branch	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	634	// Step 1: Clone or reset	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	653	// Step 2: Detect package manager	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	661	// Step 3: Install. A clone that is its own pnpm workspace (catalog:/workspace: deps) must keep its	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	683	// Step 4: Baseline checks	COMMENT
LOW⚡	packages/codemod/src/bin/batchTest.ts	693	// Step 5: Run codemod (local in-process API, or published CLI)	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	705	// Step 6: Point the clone's v2 deps at the chosen SDK source, then re-install	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	718	// Step 7: Post-codemod checks	COMMENT
LOW	packages/codemod/src/bin/batchTest.ts	804	// Step 8: Write per-repo report (nested under the per-run results dir)	COMMENT

Fake / Example Data21 hits · 23 pts

Severity	File	Line	Snippet	Context
LOW	test/integration/test/server.test.ts	1054	name: 'John Doe',	CODE
LOW	test/integration/test/server.test.ts	1092	name: 'John Doe',	CODE
LOW	test/integration/test/server/mcp.test.ts	5061	name: 'John Doe',	CODE
LOW	test/integration/test/server/mcp.test.ts	6319	name: 'John Doe',	CODE
LOW	test/integration/test/server/elicitation.test.ts	69	content: { name: 'John Doe' }	CODE
LOW	test/integration/test/server/elicitation.test.ts	86	content: { name: 'John Doe' }	CODE
LOW	test/integration/test/server/elicitation.test.ts	143	street: '123 Main St',	CODE
LOW	test/integration/test/server/elicitation.test.ts	186	email: 'user@example.com'	CODE
LOW	test/integration/test/server/elicitation.test.ts	211	name: 'John Doe',	CODE
LOW	test/integration/test/server/elicitation.test.ts	447	content: { email: 'user@example.com' }	CODE
LOW	test/integration/test/server/elicitation.test.ts	464	content: { email: 'user@example.com' }	CODE
LOW	test/integration/test/client/client.test.ts	2139	name: 'John Doe',	CODE
LOW	test/integration/test/client/client.test.ts	2168	expect(structuredContent.name).toBe('John Doe');	CODE
LOW⚡	test/e2e/scenarios/prompts.test.ts	493	const withOpt = await client.getPrompt({ name: 'summarize', arguments: { text: 'lorem ipsum', max_words: '10' } });	CODE
LOW⚡	test/e2e/scenarios/prompts.test.ts	495	{ role: 'user', content: { type: 'text', text: 'Summarize the following text in at most 10 words:\nlorem ipsum'	CODE
LOW⚡	test/e2e/scenarios/prompts.test.ts	498	const withoutOpt = await client.getPrompt({ name: 'summarize', arguments: { text: 'lorem ipsum' } });	CODE
LOW⚡	test/e2e/scenarios/prompts.test.ts	499	expect(withoutOpt.messages).toEqual([{ role: 'user', content: { type: 'text', text: 'Summarize the following text:\n	CODE
LOW	test/conformance/src/everythingServer.ts	604	default: 'John Doe'	CODE
LOW	…kages/core-internal/test/validators/validators.test.ts	50	const result = validator('John Doe');	CODE
LOW	…kages/core-internal/test/validators/validators.test.ts	52	expect(result.data).toBe('John Doe');	CODE
LOW	…kages/core-internal/test/validators/validators.test.ts	76	expect(validator('user@example.com').valid).toBe(true);	CODE

Cross-Language Confusion (JS/TS)3 hits · 15 pts

Severity	File	Line	Snippet	Context
HIGH	examples/cli-client/host/ui.ts	27	print(text: string): void;	CODE
HIGH	examples/cli-client/host/ui.ts	129	print(text: string): void {	CODE
HIGH	examples/cli-client/script/scriptedUi.ts	33	print(text: string): void {	CODE

AI Slop Vocabulary4 hits · 12 pts

Severity	File	Line	Snippet	Context
MEDIUM	test/integration/test/server/cloudflareWorkers.test.ts	134	* cloudflare/workers-sdk#9193); Cloudflare's own CI harness likewise tree-kills rather	COMMENT
MEDIUM	test/conformance/expected-failures.yaml	63	# intentionally absent: the referee SKIPs it unconditionally (harness rewrite pending	COMMENT
MEDIUM	scripts/build-docs-site.sh	115	# (The v1 docs currently contain none; this keeps the build robust if tags appear.)	COMMENT
MEDIUM	…ckages/core-internal/test/types/specTypeSchema.test.ts	185	// robust to new auth schemas (e.g. IdJagTokenExchangeResponse) without a name-prefix heuristic.	COMMENT

Modern AI Meta-Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/shared/src/index.ts	1	// Argv-parse + assert scaffold (NO SDK calls — those go inline in each story).	COMMENT
MEDIUM	packages/codemod/src/utils/detectFormatter.ts	115	// git checkout (tarball, fresh scaffold, CI workspace), also stop before ascending into `$HOME`:	COMMENT

Magic Placeholder Names1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	examples/client-quickstart/src/index.ts	187	+ '\n export ANTHROPIC_API_KEY=your-api-key-here'	CODE

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/oauth/simpleOAuthClientProvider.ts	11	* In-memory OAuth client provider for demonstration purposes.	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	examples/guides/clients/connect.examples.ts	51	// ## Create a client and connect over HTTP	COMMENT

Example Usage Blocks1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	scripts/build-docs-site.sh	8	# Usage:	COMMENT

modelcontextprotocol/typescript-sdk

Open-Source Code Quality, Security and Technical Debt Review