Open-source auth gateway connecting 1000+ SaaS providers to AI agents through SDK, CLI, MCP, HTTP, and OpenAPI.
This report presents the forensic synthetic code analysis of oomol-lab/open-connector, a TypeScript project with 4,465 GitHub stars. SynthScan v2.0 examined 1,087,471 lines of code across 5065 source files, recording 4110 pattern matches distributed across 7 syntactic categories. The overall adjusted score of 3.9 places this repository in the Likely human-written band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
Longitudinal tracking requires multiple scan runs. Once this repository is re-scanned after new commits land, this chart will visualise how the synthetic code signal evolves over time — enabling you to detect whether AI authorship is growing, stabilising, or being actively corrected by human engineers.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 4110 distinct pattern matches across 7 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | web/src/model.ts | 298 | export function resolveProviderConnectionStatus( | CODE |
| LOW⚡ | web/src/model.ts | 316 | export function usableConnectionsForService(connections: ConnectionRecord[], service: string): ConnectionRecord[] { | CODE |
| LOW⚡ | web/src/model.ts | 325 | function pickUsableCredentialConnection(connections: ConnectionRecord[]): ConnectionRecord | undefined { | CODE |
| LOW⚡ | web/src/model.ts | 330 | function isUsableCredentialConnection(connection: ConnectionRecord | undefined): connection is ConnectionRecord { | CODE |
| LOW | web/src/model.ts | 378 | export function filterProvidersByCategory(providers: ProviderDefinition[], category: string): ProviderDefinition[] { | CODE |
| LOW | web/src/model.ts | 418 | function getRecommendedProviderServiceRank(service: string): number { | CODE |
| LOW | web/src/model.ts | 430 | export function firstProviderByConnectionStatus( | CODE |
| LOW | web/src/providers-page.tsx | 305 | function useProgressiveProviderLimit( | CODE |
| LOW⚡ | web/src/providers-page.tsx | 843 | export function isProviderLocallyAvailable(provider: ProviderDefinition): boolean { | CODE |
| LOW⚡ | web/src/providers-page.tsx | 847 | export function shouldShowConnectionActions(auth: AuthDefinition): boolean { | CODE |
| LOW⚡ | web/src/providers-page.tsx | 851 | export function shouldShowDisconnectAction(connection: AppData["connections"][number] | undefined): boolean { | CODE |
| LOW⚡ | web/src/providers-page.tsx | 855 | export function shouldEnableConnectionSubmit( | CODE |
| LOW | web/src/providers-page.tsx | 946 | export function configurableConnectionsForProvider( | CODE |
| LOW | web/src/providers-page.tsx | 963 | export function validateNewConnectionName( | CODE |
| LOW | web/src/providers-page.tsx | 986 | export function credentialConnectionRequestBody( | CODE |
| LOW | web/src/providers-page.tsx | 994 | export function oauthAuthorizationRequestBody( | CODE |
| LOW | web/src/providers-page.tsx | 1100 | function UnavailableProviderConnection(props: { | CODE |
| LOW⚡ | web/src/actions-page.tsx | 557 | export function shouldResetRunActionModal(currentActionId: string, nextActionId: string): boolean { | CODE |
| LOW⚡ | web/src/actions-page.tsx | 561 | export function initialActionConnectionName(connections: ConnectionRecord[]): string | undefined { | CODE |
| LOW⚡ | web/src/actions-page.tsx | 566 | export function reconcileActionConnectionName( | CODE |
| LOW | web/src/policy.ts | 49 | export function policyRulesFromEditorDraft(draft: PolicyEditorDraft): PolicyRules { | CODE |
| LOW | web/src/policy.ts | 66 | export function validatePolicyEditorDraft(draft: PolicyEditorDraft, includeProxies: boolean): PolicyDraftIssue[] { | CODE |
| LOW | web/src/policy.ts | 173 | export function filterPolicyRuleCandidates(candidates: string[], query: string, limit = 12): string[] { | CODE |
| LOW | web/src/oauth-app-form.tsx | 159 | export function initialClientConfigFieldValues( | CODE |
| LOW | web/src/oauth-app-form.tsx | 175 | export function splitClientConfigFieldValues( | CODE |
| LOW | web/src/runs-page.tsx | 357 | export function runFiltersFromSearchParams(searchParams: URLSearchParams): RunFilters { | CODE |
| LOW | web/src/ui.tsx | 78 | export function subscribeToOAuthCompletions(onComplete: (message: OAuthCompletionMessage) => void): () => void { | CODE |
| LOW | scripts/generate-provider-registry.ts | 12 | export async function generateProviderRegistries(providerSources: ProviderSource[]): Promise<void> { | CODE |
| LOW | scripts/provider-source.ts | 39 | function readProviderDirectoryName(name: string): string { | CODE |
| LOW | scripts/provider-source.ts | 44 | function assertProviderDefinitionService(directoryName: string, service: string): void { | CODE |
| LOW | src/catalog-store.ts | 165 | export function resolveExecutableActionIds( | CODE |
| LOW | src/catalog-store.ts | 181 | function createActionExecutionStatus( | CODE |
| LOW | src/mcp.test.ts | 519 | async function withAuthenticatedMcpClient( | CODE |
| LOW | src/mcp.ts | 385 | async function describeActionMarkdownContext( | CODE |
| LOW | src/mcp.ts | 405 | async function getSelectedConnectionSummary( | CODE |
| LOW | src/oauth/oauth-client-config-service.ts | 198 | export function readOAuthClientConfigMetadata( | CODE |
| LOW | src/oauth/oauth-client-config-service.ts | 236 | function pickClientConfigFieldValues( | CODE |
| LOW | src/oauth/oauth-client-config-service.ts | 248 | function assertNoUnexpectedClientConfigFields( | CODE |
| LOW | src/oauth/oauth-client-config-service.ts | 261 | function normalizeStoredOAuthClientConfig(config: OAuthClientConfig | undefined): OAuthClientConfig | undefined { | CODE |
| LOW | src/oauth/oauth-token.ts | 43 | export async function requestAuthorizationCodeToken( | CODE |
| LOW⚡ | src/oauth/oauth-token.ts | 231 | function isSensitiveTokenResponseField(key: string): boolean { | CODE |
| LOW⚡ | src/oauth/oauth-token.ts | 236 | function encodeOAuthBasicCredential(value: string): string { | CODE |
| LOW⚡ | src/oauth/oauth-token.ts | 240 | function createAuthorizationCodeFields(input: AuthorizationCodeTokenRequest): Record<string, string> { | CODE |
| LOW | src/core/guarded-fetch.ts | 117 | export function setDefaultGuardedFetchDnsLookup(lookup: GuardedFetchDnsLookup | null | undefined): void { | CODE |
| LOW | src/core/guarded-fetch.ts | 306 | export async function resolveGuardedEgressTarget( | CODE |
| LOW | src/core/guarded-fetch.ts | 333 | async function assertResolvedAddressesAllowed( | CODE |
| LOW | src/core/guarded-fetch-default-lookup.test.ts | 32 | async function loadGuardedFetchWithNodeDns(): Promise<typeof import("./guarded-fetch.ts")> { | CODE |
| LOW | src/core/guarded-websocket.ts | 202 | function globalWebSocketConstructor(): WebSocketConstructor | undefined { | CODE |
| LOW⚡ | src/core/request.ts | 228 | export function setPrivateNetworkAccessAllowed(allowed: boolean): void { | CODE |
| LOW⚡ | src/core/request.ts | 233 | export function isPrivateNetworkAccessAllowed(): boolean { | CODE |
| LOW⚡ | src/core/request.ts | 238 | export function parsePrivateNetworkAccessFlag(value: string | undefined): boolean { | CODE |
| LOW | src/core/request.ts | 307 | function normalizeTrustedHostEntry(value: string): string { | CODE |
| LOW | src/core/action-search.ts | 216 | export function createActionSearchIndexProvider(actions: Iterable<ActionDefinition>): ActionSearchIndexProvider { | CODE |
| LOW | src/core/credential-fields.ts | 26 | export function normalizeCredentialValues(options: NormalizeCredentialValuesOptions): Record<string, string> { | CODE |
| LOW | src/mail/imap-smtp/runtime.ts | 104 | export function createMailProviderRuntime(config: MailRuntimeConfig): MailProviderRuntime { | CODE |
| LOW | src/mail/imap-smtp/runtime.ts | 187 | function isCloudflareWorkerRuntime(): boolean { | CODE |
| LOW | src/mail/imap-smtp/runtime.ts | 253 | function describeMailValidationError(error: unknown): Record<string, unknown> { | CODE |
| LOW | src/mail/imap-smtp/runtime.ts | 521 | async function resolveOutgoingAttachments(attachments: ParsedOutgoingAttachment[], context: MailActionContext) { | CODE |
| LOW | src/mail/imap-smtp/protocol.ts | 804 | function normalizeEnvelopeAddresses(value: unknown, key: "from" | "to" | "cc" | "replyTo"): MailAddress[] { | CODE |
| LOW | src/mail/imap-smtp/protocol.ts | 854 | function collectAttachmentMetadata(bodyStructure: unknown): MailAttachment[] { | CODE |
| 4015 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/providers/freshdesk/definition.ts | 21 | "Freshdesk API key used as the Basic Auth username. Find it in Profile Settings > View API key: https://support. | CODE |
| HIGH | src/providers/screenshot_fyi/definition.ts | 16 | placeholder: "YOUR_API_KEY", | CODE |
| HIGH | src/providers/geckoboard/definition.ts | 21 | "Geckoboard API key used as the HTTP Basic username. Find it in Geckoboard Account details under API Key: https: | CODE |
| HIGH | src/providers/alt_text_generator_ai/definition.ts | 14 | placeholder: "YOUR_API_KEY", | CODE |
| HIGH | src/providers/kadoa/definition.ts | 14 | placeholder: "tk-your-api-key", | CODE |
| HIGH | src/providers/tapfiliate/definition.ts | 18 | "Tapfiliate API key sent in the X-Api-Key header. Find and manage it in Tapfiliate account settings: https://sup | CODE |
| HIGH | src/providers/lightspeed_vt/definition.ts | 14 | placeholder: "YOUR_API_KEY", | CODE |
| HIGH | src/providers/megaventory/definition.ts | 13 | placeholder: "YOUR_API_KEY", | CODE |
| HIGH | src/providers/detrack/definition.ts | 18 | "Detrack API key sent with the X-API-KEY header. Generate or view it under Integrations > API Key: https://help. | CODE |
| HIGH | src/providers/mailgun/definition.ts | 18 | "Mailgun private API key used with HTTP Basic auth as api:YOUR_API_KEY. Create or view API keys in Mailgun secur | CODE |
| HIGH | src/providers/html_to_image/definition.ts | 19 | placeholder: "your_api_key", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | src/providers/winston_ai/actions.ts | 41 | "Detect whether text, a public document URL, or a public website URL was likely generated by AI with Winston AI.", | CODE |
| HIGH | src/providers/winston_ai/actions.ts | 49 | "Input for detecting whether content was likely generated by AI with Winston AI. Provide one of text, fileUrl, or | CODE |
| HIGH | src/providers/gptzero/actions.ts | 54 | "Detect whether a plain text document was generated by AI with GPTZero and return document, paragraph, and sentenc | CODE |
| HIGH | src/providers/gptzero/actions.ts | 56 | "The input payload for detecting whether text was generated by AI with GPTZero.", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/mail/imap-smtp/host-pinning.test.ts | 12 | email: "user@example.com", | CODE |
| LOW | src/providers/zlibrary/definition.ts | 22 | placeholder: "user@example.com", | CODE |
| LOW | src/providers/gamma/actions.ts | 106 | "placeholder", | CODE |
| LOW | src/providers/guru/definition.ts | 29 | placeholder: "admin@example.com", | CODE |
| LOW | src/providers/memos/actions.ts | 31 | { optional: ["placeholder", "latitude", "longitude"] }, | CODE |
| LOW | src/providers/paperform/actions.ts | 93 | required: ["key", "title", "description", "type", "required", "custom_key", "placeholder", "raw"], | CODE |
| LOW | …c/providers/doppler_marketing_automation/definition.ts | 24 | placeholder: "user@example.com", | CODE |
| LOW | src/providers/nethunt/definition.ts | 29 | placeholder: "user@example.com", | CODE |
| LOW | src/providers/adyntel/definition.ts | 26 | placeholder: "user@example.com", | CODE |
| LOW | src/providers/generic_imap/definition.ts | 24 | placeholder: "user@example.com", | CODE |
| LOW | src/providers/generic_imap/network-access.test.ts | 11 | email: "user@example.com", | CODE |
| LOW | src/providers/generic_imap/network-access.test.ts | 95 | email: "user@example.com", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.build.yml | 1 | # Build overlay for local development. | COMMENT |
| LOW | .github/workflows/publish-docker.yml | 1 | name: Publish Docker Image | COMMENT |
| LOW | .github/workflows/pr-maintainer-edits.yml | 1 | name: PR Maintainer Edits | COMMENT |
| LOW | src/core/guarded-fetch.ts | 401 | return defaultLookupOverride; | COMMENT |
| LOW | src/core/request.ts | 121 | } | COMMENT |
| LOW | src/providers/baidu_maps/runtime.ts | 121 | // Baidu's SN check is an AK-level toggle configured per key in the console | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | docker-compose.build.yml | 6 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/providers/dovetail/runtime.ts | 100 | async function getData(input: Record<string, unknown>, context: ApiKeyProviderContext) { | CODE |