0.6

Adjusted Signal

0.6

Raw Pattern Score

100%

Time Factor

2026-07-14

Last Push

4.5K

Stars

Language

269.9K

Lines of Code

1.4K

Files

154

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.0/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 154 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 2.9/100 · LOW

Which changes need focused human review? 154 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 2LOW 152

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 154 distinct pattern matches across 4 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block142 hits · 142 pts

Severity	File	Line	Snippet	Context
LOW	test/lib/xprotocol/boltv2/config.go	161	return req, req.Content	COMMENT
LOW	test/lib/xprotocol/boltv1/config.go	161	return req, req.Content	COMMENT
LOW	istio/istio1106/mixer/v1/global_dictionary.yaml	1	# Copyright 2017 Istio Authors. All Rights Reserved.	COMMENT
LOW	istio/istio1106/mixer/v1/global_dictionary.yaml	21	# The main reason using yaml format is that it allows comments like this.	COMMENT
LOW	istio/istio1106/mixer/v1/mixer.pb.go	121	return fileDescriptor_f6f59c90bff4c1e2, []int{5, 0}	COMMENT
LOW	istio/istio1106/mixer/v1/mixer.pb.go	541	// The attributes to use for this request.	COMMENT
LOW	istio/istio1106/mixer/v1/attributes.pb.go	21		COMMENT
LOW	istio/istio1106/mixer/v1/attributes.pb.go	41	// original IP address of a TCP connection. For example:	COMMENT
LOW	istio/istio1106/mixer/v1/attributes.pb.go	101		COMMENT
LOW	istio/istio1106/mixer/v1/attributes.pb.go	301	// dictionary instead. The message-level dictionary is carried by the	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	21	var _ = fmt.Errorf	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	41	// [here](https://github.com/googleapis/gnostic/blob/master/examples/v2.0/yaml/petstore-simple.yaml)	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	61	// stringValue: findPets	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	81	// uriTemplate: /api/pets/{id}	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	101	// +genclient	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	161	// httpMethod: GET	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	341	// XXX_OneofWrappers is for the internal use of the proto package.	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	401	// apiVersion: config.istio.io/v1alpha2	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/api_spec.pb.go	421	// +cue-gen:HTTPAPISpecBinding:labels:app=istio-mixer,chart=istio,heritage=Tiller,release=istio	COMMENT
LOW	…o/istio1106/mixer/v1/config/client/client_config.pb.go	101	type ServiceConfig struct {	COMMENT
LOW	…o/istio1106/mixer/v1/config/client/client_config.pb.go	121	// includes the "source.ip" and "source.uid" attributes.	COMMENT
LOW	…o/istio1106/mixer/v1/config/client/client_config.pb.go	181	// servers. Defaults to "mixer_server". By using different names for	COMMENT
LOW	…o/istio1106/mixer/v1/config/client/client_config.pb.go	241		COMMENT
LOW	istio/istio1106/mixer/v1/config/client/service.pb.go	21	var _ = math.Inf	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/quota.pb.go	21	var _ = fmt.Errorf	COMMENT
LOW	istio/istio1106/mixer/v1/config/client/quota.pb.go	301	// +cue-gen:QuotaSpecBinding:version:v1alpha2	COMMENT
LOW	istio/istio1106/filter/stream/rbac/common/permission.go	261	// Receive the v2alpha.Permission input and convert it to mosn rbac permission	COMMENT
LOW	istio/istio1106/filter/stream/rbac/common/utils.go	1	///*	COMMENT
LOW	istio/_istio152/xds/conv/convertxds.go	501	filter.GoPluginConfig = filterConfig.GoPluginConfig	COMMENT
LOW	…/skywalking-plugin/http/skywalking-docker-compose.yaml	1	#Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	…s/trace/skywalking/http/skywalking-docker-compose.yaml	1	#Licensed to the Apache Software Foundation (ASF) under one or more	COMMENT
LOW	examples/codes/xds-server-sample/cmd/server/main.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	examples/codes/xds-server-sample/apis/v1alpha1/envoy.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	…es/codes/xds-server-sample/internal/watcher/watcher.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	…les/codes/xds-server-sample/internal/xdscache/cache.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	…codes/xds-server-sample/internal/resources/resource.go	1	// Copyright 2020 Envoyproxy Authors	COMMENT
LOW	…es/codes/xds-server-sample/internal/resources/cache.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	…odes/xds-server-sample/internal/processor/processor.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	…s/codes/xds-server-sample/internal/processor/parser.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	…ples/codes/xds-server-sample/internal/server/server.go	1	// Copyright Steve Sloka 2021	COMMENT
LOW	.github/workflows/reviewdog.yml	61	# A matrix proves the supported range of Go versions work. This must always	COMMENT
LOW	pkg/metrics/sink/prometheus/prometheus_test.go	401	//url, _ := url.Parse("http://127.0.0.1:8088/metrics")	COMMENT
LOW	pkg/types/stream.go	21	"context"	COMMENT
LOW	pkg/types/stream.go	41	// Core model in stream layer is stream, which manages process of a round-trip, a request and a corresponding response	COMMENT
LOW	pkg/types/stream.go	61	// From an abstract perspective, stream represents a virtual process on underlying connection. To make stream interact	COMMENT
LOW	pkg/types/stream.go	81	// \| 1\| \|1 \|1 \|	COMMENT
LOW	pkg/types/network.go	41	// \| PROTOCOL \|	COMMENT
LOW	pkg/types/network.go	61	// - ReadFilter	COMMENT
LOW	pkg/types/network.go	121	// SetListenerCallbacks set a listener event listener	COMMENT
LOW	pkg/proxy/proxy_downstream_test.go	41	"mosn.io/pkg/buffer"	COMMENT
LOW	pkg/proxy/downstream.go	81	// ~~~ state	COMMENT
LOW	pkg/proxy/downstream.go	961	ID := atomic.LoadUint32(&s.ID)	COMMENT
LOW	pkg/mtls/types.go	61	"http/1.1": true,	COMMENT
LOW	pkg/mtls/crypto/cgosm3/sm3_cgo.go	101	func (sm3 *SM3) Size() int { return 32 }	COMMENT
LOW	pkg/mtls/crypto/tls/handshake_test.go	21	"testing"	COMMENT
LOW	pkg/mtls/crypto/tls/common_cgo.go	221	// 5929, section 3). For resumed sessions this value will be nil	COMMENT
LOW	pkg/mtls/crypto/tls/common_cgo.go	281	// SessionID-based resumption. In TLS 1.3 they were merged into PSK modes, which	COMMENT
LOW	pkg/mtls/crypto/tls/common_cgo.go	321	// guide certificate selection in the GetCertificate callback.	COMMENT
LOW	pkg/mtls/crypto/tls/common_cgo.go	341		COMMENT
LOW	pkg/mtls/crypto/tls/common_cgo.go	361	// Conn is the underlying net.Conn for the connection. Do not read	COMMENT
82 more matches not shown…

TODO Padding10 hits · 17 pts

Severity	File	Line	Snippet	Context
LOW	test/lib/xprotocol/boltv2/client.go	84	// TODO: implement it	COMMENT
LOW	test/lib/xprotocol/boltv1/client.go	84	// TODO: implement it	COMMENT
LOW	test/lib/http/client.go	94	// TODO: implement it	COMMENT
LOW	pkg/module/http2/server.go	89	// TODO: implement	COMMENT
LOW	pkg/stream/http/stream_test.go	356	// TODO: Add test cases.	COMMENT
LOW	pkg/networkextention/l7/stream/stream.go	110	// TODO: implement api.StreamFilterHandler after add context and stream id for stream	COMMENT
LOW	pkg/moe/var.go	42	// TODO: implement me	COMMENT
LOW⚡	pkg/moe/var.go	77	// TODO: implement me	COMMENT
LOW⚡	pkg/moe/var.go	82	// TODO: implement me	COMMENT
LOW⚡	pkg/moe/var.go	87	// TODO: implement me	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	…osn-extensions/plugin/filter/python/plugin_pb2_grpc.py	46	# This class is part of an EXPERIMENTAL API.	COMMENT

AI Slop Vocabulary1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	pkg/module/http2/h2c/h2c.go	59	// any HTTP server that does not handle h2c. Therefore we leverage the HTTP/1	COMMENT

mosn/mosn

Open-Source Code Quality, Security and Technical Debt Review