3.7

Adjusted Signal

3.7

Raw Pattern Score

100%

Time Factor

2026-10-28

Last Push

4.7K

Stars

Language

130.9K

Lines of Code

419

Files

492

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 16.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 489 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 0 finding(s).

Agent Over-Engineering Ratio 0.5/100 · LOW

Are wrappers, guards, and repeated structures necessary? 4 finding(s).

PR Review Velocity Impact 17.5/100 · LOW

Which changes need focused human review? 492 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 2MEDIUM 1LOW 489

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 492 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block480 hits · 467 pts

Severity	File	Line	Snippet	Context
LOW	CMakeLists.txt	1	#	COMMENT
LOW	demo/http_client/CMakeLists.txt	1	#	COMMENT
LOW	demo/http_client/http_client.c	1	//	COMMENT
LOW	demo/http_client/http_client.c	21	// since this program just exits. In longer running programs or libraries,	COMMENT
LOW	demo/reqrep/reqrep.c	1	//	COMMENT
LOW	demo/stream/stream.c	1	// Copyright 2020 Hugo Lindström <hugolm84@gmail.com>	COMMENT
LOW	demo/stream/platform/posix/server.c	1	// Copyright 2020 Hugo Lindström <hugolm84@gmail.com>	COMMENT
LOW	demo/async/CMakeLists.txt	1	#	COMMENT
LOW	demo/async/server.c	1	// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>	COMMENT
LOW	demo/async/server.c	21	// To run this program, start the server as async_demo <url> -s	COMMENT
LOW	demo/async/client.c	1	// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>	COMMENT
LOW	demo/pubsub_forwarder/pubsub_forwarder.c	1	//	COMMENT
LOW	demo/pubsub_forwarder/pubsub_forwarder.c	21	// - In a third terminal, run	COMMENT
LOW	demo/raw/raw.c	1	// Copyright 2025 Staysail Systems, Inc. <info@staysail.tech>	COMMENT
LOW	demo/raw/raw.c	21	// For example:	COMMENT
LOW	demo/rest/server.c	1	//	COMMENT
LOW	demo/rest/server.c	21	// The reply is obtained from the server, and sent back to the client via	COMMENT
LOW	demo/rest/server.c	41	#include <string.h>	COMMENT
LOW	include/nng/http.h	1	//	COMMENT
LOW	include/nng/http.h	101		COMMENT
LOW	include/nng/http.h	121	// than the amount requested. (It completes as soon as at least one	COMMENT
LOW	include/nng/http.h	161		COMMENT
LOW	include/nng/http.h	201	// headers, and servers (and callbacks on the server) modify response headers.	COMMENT
LOW	include/nng/http.h	241	//	COMMENT
LOW	include/nng/http.h	261	typedef void (nng_http_handler_func)(nng_http , void , nng_aio );	COMMENT
LOW	include/nng/http.h	281	NNG_DECL nng_err nng_http_handler_alloc_static(	COMMENT
LOW	include/nng/http.h	301	// method, then the handler is executed regardless of method, and must	COMMENT
LOW	include/nng/http.h	321		COMMENT
LOW	include/nng/http.h	341	// from the URL. If a server already exists, then a hold is placed on it, and	COMMENT
LOW	include/nng/http.h	361	// nng_http_server_add_handler registers a handler on the server.	COMMENT
LOW	include/nng/http.h	381	NNG_DECL nng_err nng_http_server_set_tls(nng_http_server , nng_tls_config );	COMMENT
LOW	include/nng/http.h	401	NNG_DECL nng_err nng_http_server_set_error_file(	COMMENT
LOW	include/nng/http.h	421		COMMENT
LOW	include/nng/http.h	441	// nng_http_client_connect establishes a new connection with the server	COMMENT
LOW	include/nng/args.h	1	//	COMMENT
LOW	include/nng/args.h	21	// This is a header library, and it does not depend on anything else in NNG.	COMMENT
LOW	include/nng/args.h	41	int a_val; // Value stored on a good parse (>0)	COMMENT
LOW	include/nng/nng.h	1	//	COMMENT
LOW	include/nng/nng.h	21	extern "C" {	COMMENT
LOW	include/nng/nng.h	41	#if defined(NNG_SHARED_LIB) && defined(NNG_HIDDEN_VISIBILITY)	COMMENT
LOW	include/nng/nng.h	61	#define NNG_MINOR_VERSION 2	COMMENT
LOW	include/nng/nng.h	121	// codes. We try hard to match things semantically to one of our standard	COMMENT
LOW	include/nng/nng.h	181	// Internal details are opaque.	COMMENT
LOW	include/nng/nng.h	321		COMMENT
LOW	include/nng/nng.h	361	// and starts it listening. It is functionally equivalent to the legacy	COMMENT
LOW	include/nng/nng.h	461	// nng_strerror returns a human-readable string associated with the error	COMMENT
LOW	include/nng/nng.h	481	NNG_DECL int nng_sendmsg(nng_socket, nng_msg *, int);	COMMENT
LOW	include/nng/nng.h	501	NNG_DECL void nng_socket_recv(nng_socket, nng_aio *);	COMMENT
LOW	include/nng/nng.h	521	// nng_ctx_id returns the numeric id for the context; this will be	COMMENT
LOW	include/nng/nng.h	561	// nng_free is used to free memory allocated with nng_alloc. As the	COMMENT
LOW	include/nng/nng.h	581	// The meaning of the inputs and the outputs are determined by the	COMMENT
LOW	include/nng/nng.h	601	// when this is called.	COMMENT
LOW	include/nng/nng.h	621		COMMENT
LOW	include/nng/nng.h	661	// nng_aio_get_output retrieves the output result at the given index.	COMMENT
LOW	include/nng/nng.h	681	NNG_DECL nng_err nng_aio_set_iov(nng_aio , unsigned, const nng_iov );	COMMENT
LOW	include/nng/nng.h	701	// for any reason, the cancellation callback should do nothing. The	COMMENT
LOW	include/nng/nng.h	801	// Options.	COMMENT
LOW	include/nng/nng.h	821	// only available for pipes. This option may return incorrect results if	COMMENT
LOW	include/nng/nng.h	841	// middle boxes thinking the session has gone idle (e.g. keeping NAT	COMMENT
LOW	include/nng/nng.h	861	// for its peer to accept the connection. The duration must be positive.	COMMENT
420 more matches not shown…

Empty Error Handlers2 hits · 10 pts

Severity	File	Line	Snippet	Context
HIGH	src/sp/transport/dtls/dtls_soak.py	541	except (OSError, ValueError):	CODE
HIGH	src/sp/transport/dtls/dtls_soak.py	507	except subprocess.TimeoutExpired:	CODE

Deep Nesting5 hits · 5 pts

Severity	File	Line	Context
LOW	cmake/NNGCheckCoverage.py	17	CODE
LOW	src/sp/transport/dtls/dtls_soak.py	104	CODE
LOW	src/sp/transport/dtls/dtls_soak.py	327	CODE
LOW	src/sp/transport/dtls/dtls_soak.py	428	CODE
LOW	src/sp/transport/dtls/dtls_interop_test.py	16	CODE

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	demo/http_client/http_client.c	27	// Example usage:	COMMENT
LOW	demo/rest/server.c	24	// Example usage:	COMMENT

Slop Phrases1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	demo/rest/server.c	20	// NNG REP server (builtin inproc_server, for demonstration purposes only).	COMMENT

Hyper-Verbose Identifiers1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	docs/theme/nng-site-header.js	76	function addLegacyDocumentationBar() {	CODE

Excessive Try-Catch Wrapping1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	src/sp/transport/dtls/dtls_soak.py	491	except Exception as error:	CODE

nanomsg/nng

Open-Source Code Quality, Security and Technical Debt Review