1.0

Adjusted Signal

1.0

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

21.0K

Stars

Language

488.7K

Lines of Code

307

Files

375

Pattern Hits

2026-10-31

Scan Date

0.04

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 4.6/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 373 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.0/100 · LOW

Are imports declared and package/API names verified? 2 finding(s).

Agent Over-Engineering Ratio 0.0/100 · LOW

Are wrappers, guards, and repeated structures necessary? 0 finding(s).

PR Review Velocity Impact 4.4/100 · LOW

Which changes need focused human review? 375 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 12MEDIUM 3LOW 360

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 375 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Over-Commented Block344 hits · 344 pts

Severity	File	Line	Snippet	Context
LOW	main.go	1	// Copyright 2012-2026 The NATS Authors	COMMENT
LOW	logger/log.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	logger/log_test.go	1	// Copyright 2012-2026 The NATS Authors	COMMENT
LOW	logger/syslog.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	logger/syslog_test.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	logger/syslog_windows.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	logger/syslog_windows_test.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	test/pedantic_test.go	1	// Copyright 2012-2019 The NATS Authors	COMMENT
LOW	test/verbose_test.go	1	// Copyright 2012-2018 The NATS Authors	COMMENT
LOW	test/auth_test.go	1	// Copyright 2012-2024 The NATS Authors	COMMENT
LOW	test/cluster_test.go	1	// Copyright 2013-2026 The NATS Authors	COMMENT
LOW	test/services_test.go	1	// Copyright 2020-2025 The NATS Authors	COMMENT
LOW	test/fanout_test.go	1	// Copyright 2018-2025 The NATS Authors	COMMENT
LOW	test/test.go	1	// Copyright 2012-2026 The NATS Authors	COMMENT
LOW	test/accounts_cycles_test.go	1	// Copyright 2020-2026 The NATS Authors	COMMENT
LOW	test/operator_test.go	1	// Copyright 2018-2025 The NATS Authors	COMMENT
LOW	test/routes_test.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	test/test_test.go	1	// Copyright 2016-2025 The NATS Authors	COMMENT
LOW	test/service_latency_test.go	1	// Copyright 2019-2026 The NATS Authors	COMMENT
LOW	test/new_routes_test.go	1	// Copyright 2018-2026 The NATS Authors	COMMENT
LOW	test/new_routes_test.go	2121		COMMENT
LOW	test/monitor_test.go	1	// Copyright 2012-2024 The NATS Authors	COMMENT
LOW	test/port_test.go	1	// Copyright 2014-2019 The NATS Authors	COMMENT
LOW	test/ports_test.go	1	// Copyright 2018-2024 The NATS Authors	COMMENT
LOW	test/route_discovery_test.go	1	// Copyright 2015-2024 The NATS Authors	COMMENT
LOW	test/proto_test.go	1	// Copyright 2012-2024 The NATS Authors	COMMENT
LOW	test/ping_test.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	test/ocsp_test.go	1	// Copyright 2021-2026 The NATS Authors	COMMENT
LOW	test/system_services_test.go	1	// Copyright 2019-2026 The NATS Authors	COMMENT
LOW	test/cluster_tls_test.go	1	// Copyright 2013-2025 The NATS Authors	COMMENT
LOW	test/gateway_test.go	1	// Copyright 2018-2026 The NATS Authors	COMMENT
LOW	test/opts_test.go	1	// Copyright 2015-2025 The NATS Authors	COMMENT
LOW	test/client_auth_test.go	1	// Copyright 2016-2025 The NATS Authors	COMMENT
LOW	test/bench_test.go	1	// Copyright 2012-2026 The NATS Authors	COMMENT
LOW	test/pid_test.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	test/tls_test.go	1	// Copyright 2015-2026 The NATS Authors	COMMENT
LOW	test/tls_test.go	1361	err error	COMMENT
LOW	test/leafnode_test.go	1	// Copyright 2019-2026 The NATS Authors	COMMENT
LOW	test/client_cluster_test.go	1	// Copyright 2013-2026 The NATS Authors	COMMENT
LOW	test/gosrv_test.go	1	// Copyright 2012-2025 The NATS Authors	COMMENT
LOW	test/user_authorization_test.go	1	// Copyright 2016-2025 The NATS Authors	COMMENT
LOW	test/maxpayload_test.go	1	// Copyright 2015-2026 The NATS Authors	COMMENT
LOW	test/norace_test.go	1	// Copyright 2019-2025 The NATS Authors	COMMENT
LOW	test/ocsp_peer_test.go	1	// Copyright 2023-2025 The NATS Authors	COMMENT
LOW	internal/antithesis/noop.go	1	// Copyright 2022-2024 The NATS Authors	COMMENT
LOW	internal/antithesis/test_assert.go	1	// Copyright 2022-2024 The NATS Authors	COMMENT
LOW	internal/antithesis/test_assert.go	21	"fmt"	COMMENT
LOW	internal/antithesis/test_assert.go	61	// Always print the stack trace	COMMENT
LOW	internal/testhelper/logging.go	1	// Copyright 2019-2025 The NATS Authors	COMMENT
LOW	internal/ocsp/ocsp.go	1	// Copyright 2019-2024 The NATS Authors	COMMENT
LOW	server/norace_2_test.go	1	// Copyright 2018-2026 The NATS Authors	COMMENT
LOW	server/reload.go	1	// Copyright 2017-2026 The NATS Authors	COMMENT
LOW	server/reload.go	1301	// The `co` compression options are applied to the given leaf connection `c`.	COMMENT
LOW	server/jetstream_cluster.go	1	// Copyright 2020-2026 The NATS Authors	COMMENT
LOW	server/jetstream_cluster.go	41	)	COMMENT
LOW	server/jetstream_cluster.go	81	// that have a local consumer the meta layer doesn't know about (yet).	COMMENT
LOW	server/jetstream_cluster.go	201	// Excluded peers are evacuated and can't be added to this group as part of the meta	COMMENT
LOW	server/log.go	1	// Copyright 2012-2026 The NATS Authors	COMMENT
LOW	server/accounts.go	1	// Copyright 2018-2026 The NATS Authors	COMMENT
LOW	server/accounts.go	201	// Reply subjects are normally unique per request, so the overwhelming majority	COMMENT
284 more matches not shown…

Synthetic Comment Markers12 hits · 90 pts

Severity	File	Line	Snippet	Context
HIGH	server/jetstream_cluster.go	6251	// Report the config as requested, the stream can still be running at its origin.	COMMENT
HIGH	server/jetstream_cluster.go	6897	// Report the config as requested, the stream can still be running at its origin.	COMMENT
HIGH	server/jetstream_cluster.go	6980	// Report the config as requested, the stream can still be running at its origin.	COMMENT
HIGH	server/jetstream_cluster.go	14309	// Report the config as requested, the stream can still be running at its origin.	COMMENT
HIGH	server/monitor.go	3196	// Report the config as requested, the stream can still be running at its origin.	COMMENT
HIGH	server/events.go	3234	// Reload the server config, as requested.	COMMENT
HIGH	server/jetstream_api.go	2188	// Report the config as requested, the stream can still be running at its origin.	COMMENT
HIGH	server/jetstream_cluster_3_test.go	12889	// The running config is at its origin, while the config as requested is the target.	COMMENT
HIGH	server/jetstream_cluster_3_test.go	12900	// Placement/retention as requested by the user.	COMMENT
HIGH	server/jetstream_cluster_3_test.go	12973	// Must be reported as requested, i.e. reverting back to the target.	COMMENT
HIGH	server/jetstream_cluster_3_test.go	13182	// The update response must report the config as requested.	COMMENT
HIGH	server/jetstream_cluster_3_test.go	13212	// But stream info, stream list and jsz must all report the config as requested.	COMMENT

Verbosity Indicators11 hits · 16 pts

Severity	File	Line	Snippet	Context
LOW	server/reload.go	471	// If the mode is "s2_auto", we need to check if there is really	COMMENT
LOW	server/reload.go	1317	// If the mode is "s2_auto", we need to check if there is really	COMMENT
LOW	server/jetstream_cluster.go	2786	// If we're not recovering, we need to check if we have any left-over streams or consumers that aren't	COMMENT
LOW	server/auth_callout_test.go	4442	// Step 1: Inject zombie connections into FOO account.	COMMENT
LOW	server/auth_callout_test.go	4454	// Step 2: Connect legitimate clients. FOO has max_connections: 5.	COMMENT
LOW	server/route.go	1810	// We need to check if this route is "no_pool" in which case we	COMMENT
LOW	server/client.go	5872	// We need to check if this is a request that has a stamped client information header.	COMMENT
LOW	server/consumer.go	6758	// We need to check if the pending items left are still valid.	COMMENT
LOW	server/leafnode.go	2966	// If we are a spoke, we need to check if we are allowed to send this subscription over to the hub.	COMMENT
LOW	server/jetstream_cluster_3_test.go	4762	// we need to check if it restored from the snapshot properly	COMMENT
LOW	server/raft.go	5142	// This is us. We need to check if we can become the leader.	COMMENT

AI Slop Vocabulary3 hits · 9 pts

Severity	File	Line	Snippet	Context
MEDIUM	server/mqtt.go	5069	// TODO: would prefer a more robust and performant way of checking the	COMMENT
MEDIUM	server/jetstream_leafnode_test.go	2086	// Pointer-equality on *subscription is timing-robust:	COMMENT
MEDIUM	server/avl/seqset.go	152	// This will more effectively utilize space versus self selecting.	COMMENT

Structural Annotation Overuse2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	server/auth_callout_test.go	4442	// Step 1: Inject zombie connections into FOO account.	COMMENT
LOW	server/auth_callout_test.go	4454	// Step 2: Connect legitimate clients. FOO has max_connections: 5.	COMMENT

Fake / Example Data2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	server/util_test.go	169	{"nats://foo:bar@example.org", "nats://foo:xxxxx@example.org"},	CODE
LOW	server/util_test.go	170	{"nats://foo@example.org", "nats://foo@example.org"},	CODE

Redundant / Tautological Comments1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	server/monitor_test.go	5942	# Set this to make sure that it does not impact secure monitoring	COMMENT

nats-io/nats-server

Open-Source Code Quality, Security and Technical Debt Review