NextTrace, an open source visual route tracking CLI tool
This report summarizes scanner evidence for nxtrace/NTrace-core, a Go project with 8,262 GitHub stars. SynthScan examined 113,090 lines of code across 503 source files, recording 86 pattern matches distributed across 7 syntactic categories. The legacy adjusted pattern signal is 1.4 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 60 finding(s).
Are imports declared and package/API names verified? 0 finding(s).
Are wrappers, guards, and repeated structures necessary? 54 finding(s).
Which changes need focused human review? 86 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 86 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | util/trace_test.go | 11 | // ──────── GetIPHeaderLength ──────── | COMMENT |
| MEDIUM | util/trace_test.go | 56 | // ──────── GetICMPID / GetICMPSeq ──────── | COMMENT |
| MEDIUM | util/trace_test.go | 87 | // ──────── GetTCPPorts / GetTCPSeq ──────── | COMMENT |
| MEDIUM | util/trace_test.go | 119 | // ──────── GetUDPPorts / GetUDPSeq / GetUDPSeqv6 ──────── | COMMENT |
| MEDIUM | util/trace_test.go | 166 | // ──────── GetICMPResponsePayload ──────── | COMMENT |
| MEDIUM | util/util_test.go | 17 | // ──────── IsIPv6 ──────── | COMMENT |
| MEDIUM | util/util_test.go | 31 | // ──────── AddrIP ──────── | COMMENT |
| MEDIUM | util/util_test.go | 67 | // ──────── StringInSlice ──────── | COMMENT |
| MEDIUM | util/util_test.go | 81 | // ──────── HideIPPart ──────── | COMMENT |
| MEDIUM | util/util_test.go | 96 | // ──────── UDPBaseSum ──────── | COMMENT |
| MEDIUM | util/util_test.go | 117 | // ──────── FudgeWordForSeq ──────── | COMMENT |
| MEDIUM | util/util_test.go | 134 | // ──────── MakePayloadWithTargetChecksum ──────── | COMMENT |
| MEDIUM | util/util_test.go | 537 | // ──────── GetPowProvider ──────── | COMMENT |
| MEDIUM | util/dns_resolver.go | 11 | // ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | util/dns_resolver.go | 17 | // ────────────────────────────────────────────────── | COMMENT |
| MEDIUM | util/dns_resolver_test.go | 17 | // ── ResolverForDot 映射 ───────────────────────────── | COMMENT |
| MEDIUM | util/dns_resolver_test.go | 54 | // ── IP 字面量短路 ──────────────────────────────────── | COMMENT |
| MEDIUM | util/dns_resolver_test.go | 74 | // ── DoT 成功时不走 fallback ────────────────────────── | COMMENT |
| MEDIUM | util/dns_resolver_test.go | 97 | // ── 未配置 DoT 时直接走系统 DNS ────────────────────── | COMMENT |
| MEDIUM | util/dns_resolver_test.go | 120 | // ── DoT 失败后回退系统 DNS ─────────────────────────── | COMMENT |
| MEDIUM | util/dns_resolver_test.go | 153 | // ── DoT 失败且 fallback=false 时返回错误 ───────────── | COMMENT |
| MEDIUM | ipgeo/ipfilter_test.go | 10 | // ──────── cidrRangeContains ──────── | COMMENT |
| MEDIUM | ipgeo/ipfilter_test.go | 29 | // ──────── Filter: IPv4 RFC ranges ──────── | COMMENT |
| MEDIUM | ipgeo/ipfilter_test.go | 107 | // ──────── Filter: IPv6 ranges ──────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | server/web/assets/mtr_agg.js | 108 | function mergeUnknownIntoSingleKnown(rows) { | CODE |
| LOW | server/web/assets/mtr_agg.js | 151 | function normalizeRenderableMTRStats(stats) { | CODE |
| LOW | scripts/test_mtr_snapshot_pty.py | 244 | def check_incomplete_recording(binary, directory, records, final, log): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 20 | def test_docs_do_not_trigger_checks(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 29 | def test_printer_selects_go_and_pty_without_packet_acceptance(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 35 | def test_probe_backend_selects_packet_and_integration_checks(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 41 | def test_acceptance_runtime_dependencies_are_not_skipped(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 68 | def test_shared_inputs_and_test_workflow_enable_complete_test_suite(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 75 | def test_cli_changes_trigger_binary_performance_evidence(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 81 | def test_native_filters_are_synchronized(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 84 | def test_own_workflow_does_not_trigger_other_workflows(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 91 | def test_manual_and_failure_enable_all_checks(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 99 | def test_git_error_fails_open(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 105 | def test_zero_and_invalid_refs_fail_open(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 109 | def test_globs_match_root_and_nested_files_without_crossing_single_star(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 117 | def test_only_needed_platforms_start(self): | CODE |
| LOW⚡ | scripts/ci/test_select_checks.py | 127 | def test_cli_writes_flags_and_fallback_reason(self): | CODE |
| LOW | scripts/ci/test_select_checks.py | 140 | def test_shared_rules_trigger_every_native_workflow(self): | CODE |
| LOW | scripts/ci/test_select_checks.py | 172 | def test_complete_pr_diff_includes_earlier_commits_not_base_only_changes(self): | CODE |
| LOW | scripts/ci/test_select_checks.py | 186 | def test_push_includes_added_deleted_and_both_rename_paths(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 44 | def test_repeated_tcp_rounds_in_distinct_port_sessions(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 52 | def test_each_report_session_must_be_captured(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 72 | def test_rebuild_requires_both_generations_on_wire(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 87 | def test_udp_session_excludes_unrelated_loopback_traffic(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 100 | def test_all_eight_bits_checked(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 105 | def test_loopback_duplicates_are_not_multiple_probes(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 116 | def test_each_udp_fragment_is_checked(self): | CODE |
| LOW | scripts/regression/test_tos_capture.py | 138 | def test_incomplete_capture_fails(self): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README_zh_CN.md | 401 | COMMENT | |
| LOW | README_zh_CN.md | 581 | nexttrace --no-rdns www.bbix.net | COMMENT |
| LOW | README_zh_CN.md | 801 | `LeoMoeAPI` 是本项目官方 API 已停止使用的旧名称,现统一称为 **NextTrace API**,其机器可读的 `data_provider` 规范值为 `NextTrace-API`。为兼容现有脚本,旧值 `LeoMoeA | COMMENT |
| LOW | cmd/cmd.go | 261 | usage = usage[:idx] + "TARGET" + usage[end:] | COMMENT |
| LOW | cmd/mtr_ui.go | 461 | // | COMMENT |
| LOW | trace/mtr_scheduler_test.go | 3121 | // Old provisional final (TTL 8) should have NO data (cleared, not migrated) | COMMENT |
| LOW | trace/mtr_runner.go | 21 | // MTR 长驻运行器 | COMMENT |
| LOW | trace/mtr_runner.go | 41 | // ProgressThrottle 流式预览最小刷新间隔(默认 200ms)。 | COMMENT |
| LOW | trace/mtr_raw.go | 21 | // Legacy round-based mode only. | COMMENT |
| LOW | printer/printer_test.go | 161 | } | COMMENT |
| LOW | printer/printer_test.go | 181 | // Success: true, | COMMENT |
| LOW | printer/printer_test.go | 201 | // Success: false, | COMMENT |
| LOW | printer/printer_test.go | 221 | // Success: true, | COMMENT |
| LOW | printer/printer_test.go | 241 | COMMENT | |
| LOW | printer/mtr_tui.go | 121 | } | COMMENT |
| LOW | printer/mtr_table.go | 221 | } | COMMENT |
| LOW | printer/mtr_table.go | 441 | // MTRReportPrint 以 mtr -rzw 风格将最终统计一次性输出到 stdout。 | COMMENT |
| LOW | fast_trace/fast_trace_test.go | 21 | ) | COMMENT |
| LOW | fast_trace/fast_trace_test.go | 41 | //}() | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | scripts/test_mtr_session_pty.py | 152 | CODE | |
| LOW | scripts/test_mtr_session_pty.py | 46 | CODE | |
| LOW | scripts/test_mtr_columns_pty.py | 27 | CODE | |
| LOW | scripts/test_mtr_columns_pty.py | 42 | CODE | |
| LOW | scripts/test_mtr_snapshot_pty.py | 268 | CODE | |
| LOW | scripts/test_mtr_snapshot_pty.py | 296 | CODE | |
| LOW | scripts/mtr_pty_screen.py | 27 | CODE | |
| LOW | scripts/mtr_pty_screen.py | 73 | CODE | |
| LOW | scripts/regression/tos_capture.py | 19 | CODE | |
| LOW | scripts/regression/tos_capture.py | 84 | CODE | |
| LOW | scripts/regression/tos_capture.py | 199 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | scripts/test_mtr_session_pty.py | 169 | except FileNotFoundError: | CODE |
| HIGH | scripts/test_mtr_snapshot_pty.py | 61 | except UnicodeDecodeError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | nt_install.sh | 3 | # This file is also served at https://nxtrace.org/nt . | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .cross_compile.sh | 43 | # -------- Build metadata (robust) -------- | COMMENT |