2.4

Adjusted Signal

2.4

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

2.6K

Stars

TypeScript

Language

190.3K

Lines of Code

822

Files

200

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 3.7/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 106 finding(s).

Hallucinated Dependency & Supply Chain Risk 3.1/100 · LOW

Are imports declared and package/API names verified? 32 finding(s).

Agent Over-Engineering Ratio 6.1/100 · LOW

Are wrappers, guards, and repeated structures necessary? 109 finding(s).

PR Review Velocity Impact 10.3/100 · LOW

Which changes need focused human review? 200 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 4HIGH 11MEDIUM 62LOW 123

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 200 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Decorative Section Separators62 hits · 194 pts

Severity	File	Line	Snippet	Context
MEDIUM	frontend/src/components/ServerForm.tsx	340	// ── OpenAPI source analysis (#1082, #1093) ────────────────────────────────	COMMENT
MEDIUM	frontend/src/components/ServerForm.tsx	340	// ── OpenAPI source analysis (#1082, #1093) ────────────────────────────────	COMMENT
MEDIUM	tests/frontend/serverFormPayload.test.ts	252	// ── #F1 OAuth sub-field round-trip ────────────────────────────────────────	COMMENT
MEDIUM	tests/frontend/serverFormPayload.test.ts	252	// ── #F1 OAuth sub-field round-trip ────────────────────────────────────────	COMMENT
MEDIUM	tests/dao/userDaoDbImpl.test.ts	1	// ── Mock UserRepository ───────────────────────────────────────────	COMMENT
MEDIUM	tests/dao/userDaoDbImpl.test.ts	41	// ── findBySsoUserId ──────────────────────────────────────────	COMMENT
MEDIUM	tests/dao/userDaoDbImpl.test.ts	67	// ── toIUser mapping ─────────────────────────────────────────	COMMENT
MEDIUM	tests/dao/userDaoDbImpl.test.ts	111	// ── create with ssoUserId ───────────────────────────────────	COMMENT
MEDIUM	tests/dao/userDaoDbImpl.test.ts	146	// ── createWithHashedPassword with ssoUserId ─────────────────	COMMENT
MEDIUM	tests/dao/userDaoDbImpl.test.ts	165	// ── update with ssoUserId ───────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	17	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	19	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	78	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	80	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	117	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	119	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	161	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	163	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	197	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	199	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/utils/tokenTruncation.test.ts	276	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/utils/tokenTruncation.test.ts	278	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/utils/tokenTruncation.test.ts	288	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM⚡	tests/utils/tokenTruncation.test.ts	290	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	308	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	310	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	470	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	472	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	522	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/utils/tokenTruncation.test.ts	524	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	tests/controllers/userController.test.ts	3	// ── Mock service layer ───────────────────────────────────────────	COMMENT
MEDIUM	tests/controllers/userController.test.ts	55	// ── createUser ───────────────────────────────────────────────	COMMENT
MEDIUM	tests/controllers/userController.test.ts	109	// ── updateExistingUser ───────────────────────────────────────	COMMENT
MEDIUM	tests/controllers/builtinConfigAuth.test.ts	3	// ── Mock DAO layer ───────────────────────────────────────────────	COMMENT
MEDIUM	tests/services/userService.test.ts	1	// ── Mock DAO layer ────────────────────────────────────────────────	COMMENT
MEDIUM	tests/services/userService.test.ts	46	// ── createNewUser ────────────────────────────────────────────	COMMENT
MEDIUM	tests/services/userService.test.ts	95	// ── updateUser ───────────────────────────────────────────────	COMMENT
MEDIUM	tests/services/userService.test.ts	146	// ── deleteUser ───────────────────────────────────────────────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	3	// ── Mock DAO layer ────────────────────────────────────────────────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	20	// ── Mock Better Auth runtime config ──────────────────────────────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	27	// ── Mock Better Auth modules (used by getBetterAuthSession) ──────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	45	// ── Priority 1: ssoUserId match ──────────────────────────────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	104	// ── Priority 2: email match (legacy fallback) ────────────────	COMMENT
MEDIUM⚡	tests/services/betterAuthSession.test.ts	162	// ── Priority 3: username match (backward compat) ─────────────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	219	// ── Priority 4: create new user ──────────────────────────────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	282	// ── Session edge cases ───────────────────────────────────────	COMMENT
MEDIUM	tests/services/betterAuthSession.test.ts	312	// ── Forward-auth identities stay separate ────────────────────	COMMENT
MEDIUM	src/clients/openapi.ts	1140	// ── Declared-security resolution (#1077) ─────────────────────────────────	COMMENT
MEDIUM	src/clients/openapi.ts	1140	// ── Declared-security resolution (#1077) ─────────────────────────────────	COMMENT
MEDIUM	src/types/index.ts	919	// ─── Context Footprint (token cost) feature ───────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	51	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	53	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	78	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	80	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	103	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	105	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	355	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	357	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	420	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	src/utils/tokenTruncation.ts	422	// ─────────────────────────────────────────────────────────────────────────────	COMMENT
2 more matches not shown…

Magic Placeholder Names11 hits · 55 pts

Severity	File	Line	Snippet	Context
HIGH	mcp_settings.json	10	"AMAP_MAPS_API_KEY": "your-api-key"	CODE
HIGH	articals/intro2.md	60	"AMAP_MAPS_API_KEY": "your-api-key"	CODE
HIGH	frontend/src/components/ServerForm.tsx	1052	placeholder="your-api-key"	CODE
HIGH	tests/cli/commands/install.test.ts	34	env: { AMAP_MAPS_API_KEY: '<your-api-key>' },	CODE
HIGH	tests/cli/commands/install.test.ts	38	AMAP_MAPS_API_KEY: { description: 'AMap API key', required: true, example: '<your-api-key>' },	CODE
HIGH	examples/openapi-schema-config.json	13	"value": "your-api-key-here"	CODE
HIGH	examples/openapi-schema-config.json	246	"value": "your-api-key-here"	CODE
HIGH	src/services/vectorSearchService.ts	55	` -H "Authorization: Bearer <YOUR_API_KEY>"`,	CODE
HIGH	src/services/vectorSearchService.ts	55	` -H "Authorization: Bearer <YOUR_API_KEY>"`,	CODE
HIGH	src/services/vectorSearchService.ts	950	`[Embedding] Reproducible curl (copy/paste and replace <YOUR_API_KEY>):\n${buildEmbeddingsDebugCurl(config.b	CODE
HIGH	src/services/vectorSearchService.ts	950	`[Embedding] Reproducible curl (copy/paste and replace <YOUR_API_KEY>):\n${buildEmbeddingsDebugCurl(config.b	CODE

Hyper-Verbose Identifiers47 hits · 47 pts

Severity	File	Line	Snippet	Context
LOW	frontend/src/utils/openApiSourceAnalysis.ts	45	export function shouldAutoAnalyzeOpenApiSource(options: {	CODE
LOW	frontend/src/utils/openApiSecurityPrefill.ts	29	export function isOpenApiSecurityUntouched(formData: ServerFormData, userTouched = false): boolean {	CODE
LOW	frontend/src/utils/openApiSecurityPrefill.ts	52	export function applyDeclaredSecurityPrefill(	CODE
LOW	frontend/src/utils/openApiSecurityPrefill.ts	89	export function securityConfigurationsDiffer(	CODE
LOW	frontend/src/utils/openApiSecurityPrefill.ts	117	export function describeConfiguredSecurity(formData: ServerFormData): string \| null {	CODE
LOW	frontend/src/utils/openApiSecurityPrefill.ts	139	export function buildOpenApiSecurityNotice(	CODE
LOW	frontend/src/pages/SettingsPage.tsx	434	function getDefaultTokenLimitForUI(model: string): number {	CODE
LOW	frontend/src/pages/SettingsPage.tsx	475	function getEmbeddingProviderPresetId(	CODE
LOW	frontend/src/pages/SettingsPage.tsx	504	function parseEmbeddingMaxTokensForUpdate(	CODE
LOW	frontend/src/pages/SettingsPage.tsx	515	function parseEmbeddingDimensionsForUpdate(	CODE
LOW	frontend/src/pages/SettingsPage.tsx	537	function parseOptionalSearchSettingForUpdate(	CODE
LOW	frontend/src/pages/SettingsPage.tsx	569	function parseBasePacingDelayForUpdate(	CODE
LOW	scripts/dev-backend.js	12	function resolvePathFromProjectRoot(value) {	CODE
LOW	src/dao/examples.ts	139	export async function exampleSystemConfigOperations() {	CODE
LOW	src/dao/examples.ts	170	export async function exampleUserConfigOperations() {	CODE
LOW	src/utils/credentialBindingMigration.ts	16	export async function migrateCredentialBindings(): Promise<void> {	CODE
LOW	src/utils/openApiRequestBody.ts	63	export function makeMultipartBodySchemaModelFriendly(schema: unknown): unknown {	CODE
LOW	src/utils/openApiRequestBody.ts	245	function assertValidMultipartContentType(contentType: string): void {	CODE
LOW	src/utils/path.ts	176	function resolveSettingsPathFromEnv(envPath: string, filename: string): string {	CODE
LOW	src/utils/ssrf.ts	233	export function createRedirectValidatingFetch(	CODE
LOW	src/utils/tokenCost.ts	68	export function serializePromptDefinition(	CODE
LOW	src/utils/tokenCost.ts	78	export function serializeResourceDefinition(	CODE
LOW	src/utils/smartRouting.ts	534	export function parseToolDefinitionFields(value: unknown): ToolDefinitionField[] \| undefined {	CODE
LOW	src/utils/processTree.ts	40	export function isProcessTreeKillAvailable(): boolean {	CODE
LOW	src/utils/processTree.ts	50	export function resetProcessTreeKillCache(): void {	CODE
LOW	src/utils/tokenTruncation.ts	35	export function getModelDefaultTokenLimit(model: string): number {	CODE
LOW	src/db/types/postgresVectorType.ts	7	export function registerPostgresVectorType(dataSource: DataSource): void {	CODE
LOW	src/controllers/oauthServerController.ts	44	async function resolveBetterAuthUserForAuthorize(req: Request): Promise<AuthenticatedUser \| null> {	CODE
LOW	src/controllers/oauthServerController.ts	113	async function validateClientRedirectUri(	CODE
LOW	src/services/changelogService.ts	23	export function clearChangelogUpdateCache(): void {	CODE
LOW	src/services/changelogService.ts	70	async function fetchUpdateInfoFromMcphubWeb(	CODE
LOW	src/services/activityLoggingService.ts	164	export function getActivityLoggingService(): ActivityLoggingService {	CODE
LOW	src/services/hostedInternalAuth.ts	58	export function serializeInternalRequestBodyForSignature(body?: unknown): string {	CODE
LOW	src/services/hostedInternalAuth.ts	143	export function verifyInternalExpressRequest(	CODE
LOW	src/services/hostedControlPlaneClient.ts	104	function createSignedControlPlaneHeaders(	CODE
LOW	src/services/hostedControlPlaneClient.ts	116	function createValidateHostedApiKeyAuthHeaders(): InternalRequestAuthHeaders {	CODE
LOW	src/services/vectorSearchService.ts	1016	function generateFallbackEmbedding(text: string): number[] {	CODE
LOW	src/services/vectorSearchService.ts	1920	async function checkDatabaseVectorDimensions(dimensionsNeeded: number): Promise<boolean> {	CODE
LOW	src/services/vectorSearchService.ts	2069	async function clearMismatchedVectorData(expectedDimensions: number): Promise<void> {	CODE
LOW	src/services/toolPolicyDiagnostics.ts	10	export async function warnMissingToolPolicyReferences(): Promise<void> {	CODE
LOW	src/services/openApiGeneratorService.ts	28	function convertToolSchemaToOpenAPI(tool: Tool): {	CODE
LOW	src/services/openApiGeneratorService.ts	91	function generateOperationFromTool(tool: Tool, serverName: string): OpenAPIV3.OperationObject {	CODE
LOW	src/services/hostedEventSubscriber.ts	37	function shouldSubscribeToRedisEvents(): boolean {	CODE
LOW	src/services/hostedEventSubscriber.ts	81	export async function startHostedEventSubscriber(): Promise<void> {	CODE
LOW	src/services/hostedEventSubscriber.ts	219	export async function stopHostedEventSubscriber(): Promise<void> {	CODE
LOW	src/services/templateService.ts	253	function stripOpenApiSecuritySecrets(	CODE
LOW	src/services/mcpService.ts	6409	export async function filterResourceTemplatesByGroup(	CODE

Verbosity Indicators22 hits · 41 pts

Severity	File	Line	Snippet	Context
LOW⚡	src/config/migrationUtils.ts	64	// Step 1: Backup current data	COMMENT
LOW⚡	src/config/migrationUtils.ts	69	// Step 2: Perform migration	COMMENT
LOW⚡	src/config/migrationUtils.ts	78	// Step 3: Validate migration	COMMENT
LOW	src/scripts/dao-demo.ts	130	// Step 1: Show current configuration	COMMENT
LOW	src/scripts/dao-demo.ts	142	// Step 2: Switch to DAO and show same data	COMMENT
LOW	src/scripts/dao-demo.ts	156	// Step 3: Demonstrate CRUD operations	COMMENT
LOW	src/scripts/dao-demo.ts	220	// Step 4: Show benefits	COMMENT
LOW⚡	src/db/connection.ts	286	// Step 1: Drop any existing index on the column	COMMENT
LOW⚡	src/db/connection.ts	293	// Step 2: Ensure embedding column exists and uses vector type	COMMENT
LOW⚡	src/db/connection.ts	301	// Step 3: Try to create appropriate indices	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	178	// Step 1: Parse WWW-Authenticate header to get resource metadata URL	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	186	// Step 2: Fetch protected resource metadata	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	189	// Step 3: Select first authorization server (TODO: implement proper selection logic)	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	196	// Step 4: Determine resource URL (canonical URI of MCP server)	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	199	// Step 5: Extract supported scopes from resource metadata	COMMENT
LOW	src/services/oauthClientRegistration.ts	287	// Step 1: Determine the authorization server URL	COMMENT
LOW	src/services/oauthClientRegistration.ts	303	// Step 2: Prepare client metadata for registration	COMMENT
LOW	src/services/oauthClientRegistration.ts	344	// Step 3: Perform dynamic client registration	COMMENT
LOW	src/services/oauthClientRegistration.ts	360	// Step 4: Store registered client information	COMMENT
LOW	src/services/sseService.ts	305	// Step 1: Try to match as a group (by name or id), since group has higher priority	COMMENT
LOW	src/services/sseService.ts	389	// Step 2: Not a group, try to match as a server name	COMMENT
LOW	src/services/sseService.ts	413	// Step 3: Not a valid group or server, deny access	COMMENT

Structural Annotation Overuse22 hits · 41 pts

Severity	File	Line	Snippet	Context
LOW⚡	src/config/migrationUtils.ts	64	// Step 1: Backup current data	COMMENT
LOW⚡	src/config/migrationUtils.ts	69	// Step 2: Perform migration	COMMENT
LOW⚡	src/config/migrationUtils.ts	78	// Step 3: Validate migration	COMMENT
LOW	src/scripts/dao-demo.ts	130	// Step 1: Show current configuration	COMMENT
LOW	src/scripts/dao-demo.ts	142	// Step 2: Switch to DAO and show same data	COMMENT
LOW	src/scripts/dao-demo.ts	156	// Step 3: Demonstrate CRUD operations	COMMENT
LOW	src/scripts/dao-demo.ts	220	// Step 4: Show benefits	COMMENT
LOW⚡	src/db/connection.ts	286	// Step 1: Drop any existing index on the column	COMMENT
LOW⚡	src/db/connection.ts	293	// Step 2: Ensure embedding column exists and uses vector type	COMMENT
LOW⚡	src/db/connection.ts	301	// Step 3: Try to create appropriate indices	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	178	// Step 1: Parse WWW-Authenticate header to get resource metadata URL	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	186	// Step 2: Fetch protected resource metadata	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	189	// Step 3: Select first authorization server (TODO: implement proper selection logic)	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	196	// Step 4: Determine resource URL (canonical URI of MCP server)	COMMENT
LOW⚡	src/services/oauthClientRegistration.ts	199	// Step 5: Extract supported scopes from resource metadata	COMMENT
LOW	src/services/oauthClientRegistration.ts	287	// Step 1: Determine the authorization server URL	COMMENT
LOW	src/services/oauthClientRegistration.ts	303	// Step 2: Prepare client metadata for registration	COMMENT
LOW	src/services/oauthClientRegistration.ts	344	// Step 3: Perform dynamic client registration	COMMENT
LOW	src/services/oauthClientRegistration.ts	360	// Step 4: Store registered client information	COMMENT
LOW	src/services/sseService.ts	305	// Step 1: Try to match as a group (by name or id), since group has higher priority	COMMENT
LOW	src/services/sseService.ts	389	// Step 2: Not a group, try to match as a server name	COMMENT
LOW	src/services/sseService.ts	413	// Step 3: Not a valid group or server, deny access	COMMENT

Hallucination Indicators4 hits · 40 pts

Severity	File	Line	Snippet	Context
CRITICAL	src/clients/__tests__/openapi-path-params.test.ts	71	const requestConfig = client.httpClient.request.mock.calls.at(-1)[0];	CODE
CRITICAL	src/controllers/serverController.ts	2830	oidcTarget.providerId = auth.betterAuth.providers.oidc.providerId.trim();	CODE
CRITICAL	src/controllers/serverController.ts	2834	oidcTarget.discoveryUrl = auth.betterAuth.providers.oidc.discoveryUrl.trim();	CODE
CRITICAL	src/controllers/serverController.ts	2849	const promptValue = auth.betterAuth.providers.oidc.prompt.trim();	CODE

Fake / Example Data17 hits · 24 pts

Severity	File	Line	Snippet	Context
LOW	tests/frontend/serverFormPayload.test.ts	269	contacts: ['admin@example.com'],	CODE
LOW	tests/utils/parameterConversion.test.ts	139	const params = { name: 'John Doe' };	CODE
LOW	tests/utils/parameterConversion.test.ts	149	expect(result.name).toBe('John Doe');	CODE
LOW	tests/scripts/validate-release-notes.test.ts	177	expect(result.stderr).toContain('placeholder');	CODE
LOW⚡	tests/controllers/userController.test.ts	144	email: 'admin@example.com',	CODE
LOW⚡	tests/controllers/userController.test.ts	150	body: { isAdmin: true, email: 'admin@example.com' },	CODE
LOW⚡	tests/controllers/userController.test.ts	158	email: 'admin@example.com',	CODE
LOW⚡	tests/services/userService.test.ts	119	email: 'admin@example.com',	CODE
LOW⚡	tests/services/userService.test.ts	122	await updateUser('testuser', { isAdmin: true, email: 'admin@example.com' });	CODE
LOW⚡	tests/services/userService.test.ts	125	expect(mockUpdate).toHaveBeenCalledWith('testuser', { email: 'admin@example.com' });	CODE
LOW⚡	tests/services/betterAuthSession.test.ts	129	user: { id: 'ba-456', email: 'user@example.com', name: 'User' },	CODE
LOW⚡	tests/services/betterAuthSession.test.ts	133	username: 'user@example.com',	CODE
LOW⚡	tests/services/betterAuthSession.test.ts	134	email: 'user@example.com',	CODE
LOW⚡	tests/services/betterAuthSession.test.ts	142	expect(mockUpdate).toHaveBeenCalledWith('user@example.com', { ssoUserId: 'ba-456' });	CODE
LOW⚡	tests/services/betterAuthSession.test.ts	147	user: { id: undefined, email: 'user@example.com' },	CODE
LOW⚡	tests/services/betterAuthSession.test.ts	151	username: 'user@example.com',	CODE
LOW⚡	tests/services/betterAuthSession.test.ts	152	email: 'user@example.com',	CODE

Over-Commented Block15 hits · 15 pts

Severity	File	Line	Snippet	Context
LOW	frontend/src/pages/ServersPage.tsx	61		COMMENT
LOW	frontend/src/pages/ServersPage.tsx	81	// only consumer of the 'commit' \| 'stale' wording). Edit has no busy	COMMENT
LOW	frontend/src/pages/ServersPage.tsx	101	// in flight when the user clicks Duplicate on B (the `duplicatingServer`	COMMENT
LOW	scripts/build-release-notes.js	1	import { execFileSync } from 'child_process';	COMMENT
LOW	.github/workflows/ci.yml	61	# steps:	COMMENT
LOW	.github/workflows/ci.yml	81		COMMENT
LOW	.github/workflows/ci.yml	101		COMMENT
LOW	src/clients/openapi.ts	141	private oauth2TokenRequest?: Promise<string \| undefined>;	COMMENT
LOW	src/types/index.ts	581	perSessionClient?: boolean; // Dedicated upstream client per legacy session or explicit modern client state	COMMENT
LOW	src/utils/tokenTruncation.ts	281	model: string,	COMMENT
LOW	src/cli/call-arguments.ts	1	import fs from 'node:fs';	COMMENT
LOW	src/services/vectorSearchService.ts	181	/** Fallback embedding method (used when no API is configured) produces 100-dimensional vectors */	COMMENT
LOW	src/services/vectorSearchService.ts	1141	//	COMMENT
LOW	src/services/personalOAuthService.ts	41	// The declaration, not resolved tokens/client registration, binds a flow to its destination.	COMMENT
LOW	src/services/mcpService.ts	2581	// Gone from the configuration while it waited.	COMMENT

samanhappy/mcphub

Open-Source Code Quality, Security and Technical Debt Review