2.6

Adjusted Signal

2.6

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

6.3K

Stars

JavaScript

Language

156.8K

Lines of Code

242

Files

107

Pattern Hits

2026-10-31

Scan Date

0.25

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 0.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 15 finding(s).

Hallucinated Dependency & Supply Chain Risk 11.4/100 · LOW

Are imports declared and package/API names verified? 90 finding(s).

Agent Over-Engineering Ratio 0.2/100 · LOW

Are wrappers, guards, and repeated structures necessary? 4 finding(s).

PR Review Velocity Impact 13.0/100 · LOW

Which changes need focused human review? 107 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 57MEDIUM 5LOW 41

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 107 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Cross-Language Confusion (JS/TS)56 hits · 305 pts

Severity	File	Line	Snippet	Context
HIGH⚡	bin/storage-cli.js	177	print( "\nUsage: bin/storage-cli.js $cmd USERNAME PRIVILEGE\n\n" );	CODE
HIGH⚡	bin/storage-cli.js	181	print( "\nERROR: Username must contain only alphanumerics, dash and period.\n\n" );	CODE
HIGH⚡	bin/storage-cli.js	187	print( "\nUser not found: " + username + "\n");	CODE
HIGH⚡	bin/storage-cli.js	197	print( "\nUser '" + username + "' updated successfully (" + cmd + " " + priv + ").\n" );	CODE
HIGH⚡	bin/storage-cli.js	198	print("\n");	CODE
HIGH⚡	bin/storage-cli.js	283	print("Saving new data back into record: "+key+"\n");	CODE
HIGH⚡	bin/storage-cli.js	292	print("Record successfully saved with your changes: "+key+"\n");	CODE
HIGH⚡	bin/storage-cli.js	299	print("File has not been changed, record was not touched: "+key+"\n");	CODE
HIGH⚡	bin/storage-cli.js	368	print("Got " + items.length + " items.\n");	CODE
HIGH⚡	bin/storage-cli.js	369	print("Items from list: " + key + ": " + JSON.stringify(items, null, "\t") + "\n");	CODE
HIGH⚡	bin/storage-cli.js	370	print("\n");	CODE
HIGH⚡	bin/storage-cli.js	383	print("List Header: " + key + ": " + JSON.stringify(list, null, "\t") + "\n\n");	CODE
HIGH⚡	bin/storage-cli.js	392	print("Page " + Math.floor(page_idx - 1) + ": " + page.items.length + " items\n");	CODE
HIGH⚡	bin/storage-cli.js	399	print("\n");	CODE
HIGH⚡	bin/storage-cli.js	450	print("\n");	CODE
HIGH⚡	bin/storage-cli.js	451	print( "Custom commands completed successfully!\n" );	CODE
HIGH⚡	bin/storage-cli.js	459	print("Unknown command: " + cmd + "\n");	CODE
HIGH	bin/storage-cli.js	70	print( "ERROR: Must be root to use this script.\n" );	CODE
HIGH	bin/storage-cli.js	83	print( "ERROR: Please stop xyOps before running this script.\n" );	CODE
HIGH	bin/storage-cli.js	104	print( "ERROR: Could not determine server's LAN IPv4 address.\n" );	CODE
HIGH	bin/storage-cli.js	137	print( "\nUsage: bin/storage-cli.js admin USERNAME PASSWORD [EMAIL]\n\n" );	CODE
HIGH	bin/storage-cli.js	141	print( "\nERROR: Username must contain only alphanumerics, dash and period.\n\n" );	CODE
HIGH	bin/storage-cli.js	163	print( "\nAdministrator '"+username+"' created successfully.\n" );	CODE
HIGH	bin/storage-cli.js	164	print("\n");	CODE
HIGH	bin/storage-cli.js	219	print("\n");	CODE
HIGH	bin/storage-cli.js	235	print( "Writing record from STDIN: " + key + "\n" );	CODE
HIGH	bin/storage-cli.js	249	print("Record successfully saved: "+key+"\n");	CODE
HIGH	bin/storage-cli.js	267	print("Spawning editor to edit record: " + key + "\n");	CODE
HIGH	bin/storage-cli.js	314	print("Record '"+key+"' deleted successfully.\n");	CODE
HIGH	bin/storage-cli.js	315	print("\n");	CODE
HIGH	bin/storage-cli.js	327	print("List created successfully: " + key + "\n");	CODE
HIGH	bin/storage-cli.js	328	print("\n");	CODE
HIGH	bin/storage-cli.js	340	print("Item popped off list: " + key + ": " + JSON.stringify(item, null, "\t") + "\n");	CODE
HIGH	bin/storage-cli.js	341	print("\n");	CODE
HIGH	bin/storage-cli.js	353	print("Item shifted off list: " + key + ": " + JSON.stringify(item, null, "\t") + "\n");	CODE
HIGH	bin/storage-cli.js	354	print("\n");	CODE
HIGH	bin/storage-cli.js	413	print("List deleted successfully: " + key + "\n");	CODE
HIGH	bin/storage-cli.js	414	print("\n");	CODE
HIGH	bin/storage-cli.js	425	print( "Daily maintenance completed successfully.\n" );	CODE
HIGH	bin/storage-cli.js	426	print("\n");	CODE
HIGH	bin/install.js	76	print(	CODE
HIGH	bin/install.js	132	print( "Fetching release list...\n");	CODE
HIGH	bin/install.js	137	print( stdout.toString() );	CODE
HIGH⚡	bin/install.js	177	print("\nStopping service: " + stop_cmd + "\n");	CODE
HIGH⚡	bin/install.js	180	print("\n");	CODE
HIGH⚡	bin/install.js	189	print( stdout.toString() );	CODE
HIGH⚡	bin/install.js	205	print( is_preinstalled ? "Updating dependencies...\n" : "Installing dependencies...\n");	CODE
HIGH⚡	bin/install.js	213	print( stdout.toString() );	CODE
HIGH⚡	bin/install.js	221	print("Running post-install script...\n");	CODE
HIGH⚡	bin/install.js	229	print( stdout.toString() );	CODE
HIGH⚡	bin/install.js	234	print("Upgrade complete.\n\n");	CODE
HIGH⚡	bin/install.js	237	print( "Starting service: " + start_cmd + "\n" );	CODE
HIGH⚡	bin/install.js	240	print("\n");	CODE
HIGH⚡	bin/install.js	246	print("\n");	CODE
HIGH⚡	bin/install.js	252	print( stdout.toString() );	CODE
HIGH⚡	bin/install.js	259	print("Installation complete.\n\n");	CODE

Hallucination Indicators4 hits · 40 pts

Severity	File	Line	Snippet	Context
CRITICAL	test/suites/test-jobs.js	507	assert.deepEqual(xy.jobDetails.dst.timelines.minute.map(item => item.epoch), expected, 'timeline retains distinct, or	CODE
CRITICAL	test/suites/test-workflow-replay.js	135	assert.ok(f.job.workflow.jobs.worker.every(stub => stub.replay), label + ': all stubs identify replay');	CODE
CRITICAL	lib/maint.js	155	this.stats.cache = this.storage.engine.docEngine.cache.getStats();	CODE
CRITICAL	lib/api/admin.js	612	stats.cache = self.storage.engine.docEngine.cache.getStats();	CODE

Fake / Example Data29 hits · 30 pts

Severity	File	Line	Snippet	Context
LOW⚡	internal/ui.json	415	"placeholder": "Select type for ticket..."	CODE
LOW⚡	internal/ui.json	423	"placeholder": "Select assignees..."	CODE
LOW⚡	internal/ui.json	431	"placeholder": "Select tags to apply..."	CODE
LOW⚡	internal/ui.json	543	"placeholder": "Select icon for workflow..."	CODE
LOW⚡	internal/ui.json	551	"placeholder": "Select category for workflow..."	CODE
LOW⚡	internal/ui.json	559	"placeholder": "Select tags for workflow..."	CODE
LOW⚡	internal/ui.json	893	"placeholder": "Select assignees..."	CODE
LOW⚡	internal/ui.json	901	"placeholder": "Select users to carbon copy..."	CODE
LOW⚡	internal/ui.json	909	"placeholder": "Click to add recipient...",	CODE
LOW	internal/ui.json	511	"placeholder": "(Use event defaults)"	CODE
LOW	internal/ui.json	584	"placeholder": ""	CODE
LOW	internal/ui.json	600	"placeholder": "(None)"	CODE
LOW	internal/ui.json	625	"placeholder": "(Use event defaults)"	CODE
LOW	internal/ui.json	644	"placeholder": "(Use event defaults)"	CODE
LOW	internal/ui.json	664	"placeholder": "Select Plugin for node..."	CODE
LOW	internal/ui.json	676	"placeholder": "Select category for job..."	CODE
LOW	internal/ui.json	684	"placeholder": "Select targets for jobs..."	CODE
LOW	internal/ui.json	696	"placeholder": "Select algorithm for targets..."	CODE
LOW	internal/ui.json	704	"placeholder": "Select tags for jobs..."	CODE
LOW	internal/ui.json	813	"placeholder": "Select targets for upgrade..."	CODE
LOW	internal/ui.json	833	"placeholder": "Select conductors for upgrade..."	CODE
LOW	internal/ui.json	863	"placeholder": "Select type for ticket..."	CODE
LOW	internal/ui.json	871	"placeholder": "Select status for ticket..."	CODE
LOW	internal/ui.json	923	"placeholder": "Select tags to apply..."	CODE
LOW	internal/ui.json	939	"placeholder": "(Use event defaults)"	CODE
LOW	internal/ui.json	951	"placeholder": "(Use event defaults)"	CODE
LOW	docs/actions.md	23	"email": "admin@example.com"	CODE
LOW	docs/ui.md	25	"company": "Acme Corp",	CODE
LOW	docs/ui.md	37	XYOPS_client__company="Acme Corp"	CODE

Over-Commented Block7 hits · 7 pts

Severity	File	Line	Snippet	Context
LOW	bin/control.sh	1	#!/bin/bash	COMMENT
LOW	bin/control.sh	21	# add some common path locations	COMMENT
LOW	bin/control.sh	181	## 1. Redistributions of source code must retain the above copyright	COMMENT
LOW	bin/control.sh	201	## 5. Products derived from this software may not be called "Apache",	COMMENT
LOW	bin/control.sh	221	## information on the Apache Software Foundation, please see	COMMENT
LOW	htdocs/js/pages/Base.class.js	3601	}	COMMENT
LOW	htdocs/js/pages/admin/System.class.js	121	// reset stats	COMMENT

Decorative Section Separators2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	bin/control.sh	171	## ====================================================================	COMMENT
MEDIUM	bin/control.sh	217	## ====================================================================	COMMENT

Magic Placeholder Names1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	docs/hosting.md	193	Configure your MCP client to use Streamable HTTP at, for example, `https://xyops.example.com/mcp`, with `Authorizati	CODE

Slop Phrases2 hits · 4 pts

Severity	File	Line	Snippet	Context
MEDIUM	internal/setup.json	436	"notes": "An example web hook for demonstration purposes.",	CODE
MEDIUM	lib/util.js	772	addHook({ "id": "example_hook", "title": "Example Hook", "url": "https://httpbin.org/post", "notes": "An example we	CODE

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	internal/sat-install.sh	12	# Check if satellite is already installed	COMMENT
LOW	internal/sat-upgrade.sh	13	# Check if satellite is installed (required for upgrade)	COMMENT

Self-Referential Comments1 hit · 3 pts

Severity	File	Line	Snippet	Context
MEDIUM	.github/workflows/release.yml	38	# Create the release and capture the output	COMMENT

Hyper-Verbose Identifiers2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	test/suites/test-workflows.js	30	async function waitForActiveWorkflowNode(ctx, workflow_job_id, node_id, opts = {}) {	CODE
LOW	test/suites/test-events.js	78	function createWorkflowNodeValidationFixture(type, fields) {	CODE

Structural Annotation Overuse1 hit · 2 pts

Severity	File	Line	Snippet	Context
LOW	docs/welcome.md	10	## Step 1: Add a Server	COMMENT

pixlcore/xyops

Open-Source Code Quality, Security and Technical Debt Review