The execution layer for AI agents. Act across more of your systems with precise controls: safer, faster and more efficient than MCP tools and gateways.
This report summarizes scanner evidence for withcoral/coral, a Rust project with 4,941 GitHub stars. SynthScan examined 516,039 lines of code across 2132 source files, recording 456 pattern matches distributed across 14 syntactic categories. The legacy adjusted pattern signal is 1.1 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 416 finding(s).
Are imports declared and package/API names verified? 24 finding(s).
Are wrappers, guards, and repeated structures necessary? 76 finding(s).
Which changes need focused human review? 456 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 456 distinct pattern matches across 14 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .config/nextest.toml | 1 | # Bound every test so a wedged one fails the run instead of stalling it. | COMMENT |
| LOW | crates/coral-identifier/src/lib.rs | 1 | //! Coral-issued Task and Run identifiers. | COMMENT |
| LOW | crates/coral-identifier/src/lib.rs | 21 | use ring::rand::{SecureRandom as _, SystemRandom}; | COMMENT |
| LOW | crates/coral-telemetry/src/request.rs | 81 | /// Opens a gRPC server span for each call to the routes `router` has so far. | COMMENT |
| LOW | crates/coral-telemetry/src/export.rs | 21 | COMMENT | |
| LOW | crates/coral-telemetry/src/safe.rs | 1 | //! The values a span or event field may carry. | COMMENT |
| LOW | crates/coral-telemetry/src/safe.rs | 21 | use std::fmt; | COMMENT |
| LOW | crates/coral-telemetry/src/field.rs | 1 | //! The safe telemetry fields: the only keys a span, span event, link or log | COMMENT |
| LOW | crates/coral-telemetry/src/run.rs | 21 | /// Begins a Run Trace at `accept`, a span not yet entered: makes it the | COMMENT |
| LOW | crates/coral-telemetry/src/source_scan.rs | 1 | //! Checks every span and event in the workspace's production source. | COMMENT |
| LOW | crates/coral-telemetry/src/metric.rs | 1 | //! The stable `coral.*` metric catalog: each instrument's name, unit and | COMMENT |
| LOW | crates/coral-auth/src/session.rs | 121 | pub const fn access_token_ttl(&self) -> Duration { | COMMENT |
| LOW | crates/coral-auth/src/session.rs | 441 | pub(crate) struct ValidatedSession { | COMMENT |
| LOW | crates/coral-auth/src/lib.rs | 1 | //! Coral User access-token issuance, credential-to-Principal authentication, and | COMMENT |
| LOW | crates/coral-auth/src/lib.rs | 21 | //! # Invariants | COMMENT |
| LOW | crates/coral-auth/src/oauth_clients/mod.rs | 241 | } | COMMENT |
| LOW | crates/coral-auth/src/oauth_clients/mod.rs | 261 | } | COMMENT |
| LOW | crates/coral-auth/src/oauth_clients/mod.rs | 281 | /// CIMD requires HTTP 200. | COMMENT |
| LOW | crates/coral-auth/src/authorization_codes/mod.rs | 1 | //! Authorization codes issued by Coral's OAuth authorization server. | COMMENT |
| LOW | crates/coral-auth/src/authorization_codes/mod.rs | 101 | #[must_use] | COMMENT |
| LOW | crates/coral-auth/src/authorization_codes/mod.rs | 141 | /// | COMMENT |
| LOW | crates/coral-v8/src/runtime.rs | 41 | /// No compiler state or previous Program state enters the isolate. V8 code | COMMENT |
| LOW | crates/coral-v8/src/runtime.rs | 61 | /// | COMMENT |
| LOW | crates/coral-v8/src/compiler.rs | 61 | } | COMMENT |
| LOW | crates/coral-v8/src/compiler.rs | 121 | /// Lowers one TypeScript async-function body into JavaScript and a source map. | COMMENT |
| LOW | crates/coral-v8/src/compiler.rs | 161 | } | COMMENT |
| LOW | crates/coral-v8/src/program_error.rs | 81 | pub frames: Vec<ProgramErrorFrame>, | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 1 | //! Secret-free TypeScript compilation and JavaScript execution for Coral. | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 41 | /// Validates one retained authored source map against the pinned profile rules. | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 141 | /// the host's own rejections do. | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 161 | ) -> ToolFuture; | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 201 | } | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 521 | } | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 661 | #[derive(Debug, thiserror::Error)] | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 681 | /// Blocking diagnostics returned by the official compiler. | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 701 | /// One-based authored source line. | COMMENT |
| LOW | crates/coral-v8/src/lib.rs | 721 | /// A Program output exceeded an accepted finite bound. | COMMENT |
| LOW | crates/coral-credentials/src/lib.rs | 141 | let mut key = Zeroizing::new([0_u8; Self::KEY_LEN]); | COMMENT |
| LOW | crates/coral-mcp/src/prompts.rs | 1 | //! Elicitation of the invoking User's current human actions. | COMMENT |
| LOW | crates/coral-mcp/src/authentication.rs | 21 | COMMENT | |
| LOW | crates/coral-mcp/src/http.rs | 141 | /// Missing credentials map to the implicit local User; a presented credential | COMMENT |
| LOW | crates/coral-mcp/src/projection/diagnostics.rs | 81 | #[schemars(with = "ToolError<'a>")] | COMMENT |
| LOW | crates/coral-mcp/src/projection/discovery.rs | 61 | } | COMMENT |
| LOW | crates/coral-mcp/src/projection/discovery.rs | 81 | guidance_snippet: Option<String>, | COMMENT |
| LOW | crates/coral-provider/src/access.rs | 21 | /// | COMMENT |
| LOW | crates/coral-provider/src/error.rs | 1 | /// Provider Module failure outside a terminal domain Publication outcome. | COMMENT |
| LOW | crates/coral-provider/src/error.rs | 21 | ProviderSetupNotReady, | COMMENT |
| LOW | crates/coral-provider/src/error.rs | 41 | #[error("invalid Provider Account authorization input")] | COMMENT |
| LOW | crates/coral-provider/src/error.rs | 61 | /// The invoking User declined its connection request. | COMMENT |
| LOW | crates/coral-provider/src/error.rs | 81 | ProviderSetupConsumed, | COMMENT |
| LOW | crates/coral-provider/src/error.rs | 101 | #[error("Provider version overflowed")] | COMMENT |
| LOW | crates/coral-provider/src/error.rs | 121 | /// Materialization or response delivery failed before the caller received a result. | COMMENT |
| LOW | crates/coral-provider/src/lib.rs | 1 | //! Workspace-owned Provider publication, configuration, lifecycle and dispatch authority. | COMMENT |
| LOW | crates/coral-provider/src/lib.rs | 941 | /// row as `lock` says: shared in the Policy Enforcement Point, so concurrent | COMMENT |
| LOW | crates/coral-provider/src/configuration.rs | 41 | /// Current confirmation revision; clients return it when confirming an edit. | COMMENT |
| LOW | crates/coral-provider/src/configuration.rs | 61 | pub issuer: Option<String>, | COMMENT |
| LOW | crates/coral-provider/src/reach.rs | 1 | //! Which Tools a Principal reaches, before any credential check. | COMMENT |
| LOW | crates/coral-provider/src/change.rs | 1 | //! The one step that loads an existing Provider for a change and applies its | COMMENT |
| LOW | crates/coral-provider/src/change.rs | 21 | Reconfigure, | COMMENT |
| LOW | crates/coral-provider/src/publication.rs | 1 | //! Synchronous Provider Publication, behind typed creation and regeneration commands. | COMMENT |
| 270 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tes/coral-v8/src/js/compiler/typescript_environment.js | 178 | function configureTypeScriptLibraries(librarySources) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 28 | function forbiddenAmbientReference(program, sourceFile) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 134 | function privateCompilerBindingReference(sourceFile, program) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 157 | function sourceMappingDirectivePosition(sourceFile) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 200 | function unwrapTransparentExpression(node) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 214 | function declarationCreatesRuntimeBinding(declaration, sourceFile) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 240 | function isHostGlobalThisIdentifier(node, checker, sourceFile) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 270 | function globalThisExpressionSegments(node, checker, sourceFile, seen = new Set()) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 410 | function savedFunctionPathAnalysis(sourceFile, program, authoredMappings) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 484 | function analyzeSavedFunctionPaths(body, fileName, targetName) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 501 | function savedFunctionDependencyAnalysis(sourceFile, program) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 522 | function analyzeSavedFunctionDependencies(source, fileName, targetName) { | CODE |
| LOW | …tes/coral-v8/src/js/compiler/authored_source_policy.js | 582 | function analyzeSavedFunctionCallPaths(source, fileName, targetName) { | CODE |
| LOW⚡ | crates/coral-v8/src/js/compiler/bridge.js | 19 | globalThis.__coralPrepareSavedFunction = function prepareVirtualSavedFunction( | CODE |
| LOW⚡ | crates/coral-v8/src/js/compiler/bridge.js | 29 | globalThis.__coralAnalyzeSavedFunctionCallPaths = function analyzeVirtualSavedFunctionCallPaths( | CODE |
| LOW⚡ | crates/coral-v8/src/js/compiler/bridge.js | 36 | globalThis.__coralAnalyzeSavedFunctionPaths = function analyzeVirtualProgramPaths( | CODE |
| LOW⚡ | crates/coral-v8/src/js/compiler/bridge.js | 44 | function analyzeVirtualSavedFunctionDependencies(source, fileName, targetName) { | CODE |
| LOW⚡ | crates/coral-v8/src/js/compiler/bridge.js | 47 | globalThis.__coralCompileLinkedProgram = function compileVirtualLinkedProgram( | CODE |
| LOW | …s/coral-v8/src/js/compiler/saved_function_authoring.js | 259 | function emitSavedFunctionDeclaration(program, fileName, compilerOptions) { | CODE |
| LOW | …s/coral-v8/src/js/compiler/saved_function_authoring.js | 315 | function savedFunctionDeclarationResult(emitted, diagnostics, references) { | CODE |
| LOW | crates/coral-v8/src/js/compiler/authored_source.js | 91 | function authoredReferenceLocation(sourceFile, node, authoredMappings) { | CODE |
| LOW | …ps/reef/app/wax/components/tooltip/tooltip.stories.tsx | 214 | render: function TruncationWithResizeStory() { | CODE |
| LOW | apps/reef/app/wax/components/picker/default-options.ts | 43 | export function buildSeverityPickerOptions( | CODE |
| LOW | apps/reef/app/wax/components/button/icon.tsx | 38 | export function SpinningIconImplementation(props: ImplementationProps) { | CODE |
| LOW | apps/reef/app/wax/components/typography/typography.tsx | 19 | function createTypographyComponent({ | CODE |
| LOW | …mponents/icon/custom-icons/chart-column-increasing.tsx | 3 | export function ChartColumnIncreasingIcon({ | CODE |
| LOW | apps/reef/app/auth/session.server.test.ts | 362 | function representativeSessionToken(): string { | CODE |
| LOW | apps/reef/app/auth/coral-oauth.server.ts | 113 | async function authorizationServerMetadata( | CODE |
| LOW | apps/reef/app/auth/coral-oauth.server.ts | 129 | function validateAuthorizationServerMetadata( | CODE |
| LOW | apps/reef/app/auth/coral-oauth.server.ts | 172 | async function exchangeAuthorizationCode( | CODE |
| LOW | apps/reef/app/auth/coral-oauth.server.ts | 245 | function authorizationServerMetadataUrl(issuer: string): string { | CODE |
| LOW | apps/reef/app/components/sidebar/sidebar-state.ts | 3 | export function readSidebarCollapsedCookiePreference( | CODE |
| LOW | apps/reef/app/components/sidebar/sidebar-state.ts | 22 | export function readSidebarCollapsedCookieValue(cookieHeader: string | null | undefined): boolean { | CODE |
| LOW | apps/reef/app/components/sidebar/sidebar-state.ts | 26 | export function readSidebarCollapsedCookie(request: Request): boolean { | CODE |
| LOW | …vigation-progress-bar/navigation-progress-bar.test.tsx | 92 | async function navigateDeltaWithoutWaiting( | CODE |
| LOW | …ation-progress-bar/navigation-progress-bar.stories.tsx | 67 | function NavigationProgressBarStory() { | CODE |
| LOW | apps/reef/app/lib/provider-consent.server.ts | 10 | export async function redirectToProviderConsent( | CODE |
| LOW | apps/reef/app/lib/organization.server.ts | 11 | export async function enabledOrganizationPeople( | CODE |
| LOW | apps/reef/app/lib/organization.server.ts | 58 | export function organizationWorkspaceView(w: OrganizationWorkspace): OrganizationWorkspaceView { | CODE |
| LOW | apps/reef/app/lib/use-revalidate-while-visible.ts | 7 | export function useRevalidateWhileVisible(intervalMs: number) { | CODE |
| LOW | apps/reef/app/lib/runtime-config.server.ts | 30 | export function readCoralWebRuntimeConfig(): CoralWebRuntimeConfig { | CODE |
| LOW | apps/reef/app/lib/accounts.server.ts | 128 | export function authorizationProgressPath(name: string, returnTo: string) { | CODE |
| LOW | apps/reef/app/lib/accounts.server.ts | 683 | export async function disconnectUserAccountAction( | CODE |
| LOW | apps/reef/app/lib/coral-request.server.ts | 25 | export function managementTransportForRequest( | CODE |
| LOW | apps/reef/app/lib/coral-request.server.ts | 48 | function warnAuthenticatedCleartext(origin: string | null): void { | CODE |
| LOW | apps/reef/app/lib/accounts.server.test.ts | 420 | function loadAuthorizationReturningTo(returnTo: string) { | CODE |
| LOW | apps/reef/app/lib/provider-publication-attempt/model.ts | 322 | export function automaticApplicationAllowed( | CODE |
| LOW | apps/reef/app/views/activity/activity.stories.tsx | 64 | async function expectDecisionBelowEvidence(pane: HTMLElement, names: string[]) { | CODE |
| LOW | apps/reef/app/views/providers/configuration-details.tsx | 106 | export function configurationShortSummary(setup: SetupView) { | CODE |
| LOW | …/reef/app/views/providers/workspace-providers-page.tsx | 160 | function WorkspaceProvidersContent({ | CODE |
| LOW | …eef/app/views/management/organization-members-page.tsx | 63 | function OrganizationMembershipActions({ | CODE |
| LOW | …/app/views/management/organization-workspaces-page.tsx | 33 | export function OrganizationWorkspacesPage({ | CODE |
| LOW | apps/reef/app/routes/_protected.tsx | 82 | function finalizeProtectedResponse(response: Response, csrfSetCookie: string | null): Response { | CODE |
| LOW | apps/reef/app/routes/account-authorization.tsx | 34 | export default function AccountAuthorizationRoute({ loaderData }: Route.ComponentProps) { | CODE |
| LOW | apps/reef/app/routes/organization-workspaces.tsx | 132 | export default function OrganizationWorkspacesRoute({ loaderData }: Route.ComponentProps) { | CODE |
| LOW | apps/reef/e2e/support/providers.ts | 179 | export async function saveConfirmedSettingsChange(page: Page) { | CODE |
| LOW | apps/reef/e2e/support/providers.ts | 1008 | async function confirmFixtureConfiguration( | CODE |
| LOW | apps/reef/e2e/support/offboarding.ts | 11 | export async function assertUserAccountRemainsRetired( | CODE |
| LOW | apps/reef/e2e/support/offboarding.ts | 30 | export async function prepareOffboardingAccount( | CODE |
| LOW | apps/reef/e2e/support/authenticated-target.ts | 37 | export async function prepareAuthenticatedTarget( | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .agents/skills/to-benchmark/run.py | 57 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .agents/skills/to-benchmark/run.py | 59 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .agents/skills/to-benchmark/run.py | 180 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .agents/skills/to-benchmark/run.py | 182 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .agents/skills/to-benchmark/run.py | 384 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .agents/skills/to-benchmark/run.py | 386 | # ---------------------------------------------------------------------------- | COMMENT |
| MEDIUM | .agents/skills/wizard/template.sh | 11 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | .agents/skills/wizard/template.sh | 13 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .agents/skills/wizard/template.sh | 187 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .agents/skills/wizard/template.sh | 190 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | .agents/skills/wizard/template.sh | 196 | # ── Example stage: replace with your real steps ─────────────────────────── | COMMENT |
| MEDIUM | .agents/skills/wizard/template.sh | 207 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev/setup.sh | 11 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev/setup.sh | 13 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev/setup.sh | 182 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/dev/setup.sh | 185 | # ────────────────────────────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | crates/coral-v8/tests/typed_coral_surface.rs | 294 | "export default async function f() {\n const a = await coral.providers.github.repos.get.call(null, {});\n | CODE |
| CRITICAL | crates/coral-provider/src/account/device.rs | 553 | let mut tx = self.lease.module.providers.database.begin().await?; | CODE |
| CRITICAL | crates/coral-provider/src/account/device.rs | 605 | let mut tx = self.lease.module.providers.database.begin().await?; | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …ps/reef/app/wax/components/tooltip/tooltip.stories.tsx | 258 | content="Full text: Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt | CODE |
| LOW | …ps/reef/app/wax/components/tooltip/tooltip.stories.tsx | 258 | content="Full text: Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt | CODE |
| LOW | …ps/reef/app/wax/components/tooltip/tooltip.stories.tsx | 272 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor | CODE |
| LOW | …ps/reef/app/wax/components/tooltip/tooltip.stories.tsx | 272 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor | CODE |
| LOW | apps/reef/app/wax/components/dialog/dialog.stories.tsx | 157 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor | CODE |
| LOW | apps/reef/app/wax/components/dialog/dialog.stories.tsx | 157 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor | CODE |
| LOW | apps/reef/app/wax/components/avatar/avatar.stories.tsx | 22 | name: 'John Doe', | CODE |
| LOW | apps/reef/app/wax/components/avatar/avatar.stories.tsx | 26 | <Avatar name="John Doe" src="https://i.pravatar.cc/150?u=john" /> | CODE |
| LOW | …f/app/wax/components/typography/typography.stories.tsx | 100 | <Typography.Body variant="placeholder">Body - placeholder</Typography.Body> | CODE |
| LOW | apps/reef/app/wax/components/inputs/text/text-input.tsx | 87 | color={disabled ? 'disabled' : 'placeholder'} | CODE |
| LOW | apps/reef/app/components/empty-page/empty-page.tsx | 24 | <Icon color="placeholder" name={iconName} size="30" /> | CODE |
| LOW | apps/reef/app/lib/accounts.server.test.ts | 304 | connectForm('secret', { 'credential.token': 'dummy-token' }), | CODE |
| LOW | apps/reef/app/lib/accounts.server.test.ts | 311 | expect(progress).not.toContain('dummy-token') | CODE |
| LOW | apps/reef/app/lib/accounts.server.test.ts | 330 | connectForm('secret', { 'credential.token': 'dummy-token' }), | CODE |
| LOW | apps/reef/app/lib/accounts.server.test.ts | 533 | form.set('credential.token', 'dummy-token') | CODE |
| LOW | apps/reef/app/lib/accounts.server.test.ts | 576 | form.set('credential.token', 'dummy-token') | CODE |
| LOW⚡ | apps/reef/app/routes/activity-observe.server.test.ts | 47 | const args = authRouteTestArgs(request, {}, 'expired-dummy-token', hostedRuntimeConfig) | CODE |
| LOW⚡ | apps/reef/app/routes/activity-observe.server.test.ts | 50 | accessToken: 'expired-dummy-token', | CODE |
| LOW⚡ | apps/reef/app/routes/activity-observe.server.test.ts | 53 | accessToken: 'expired-dummy-token', | CODE |
| LOW | apps/reef/app/routes/activity-observe.server.test.ts | 79 | accessToken: 'expired-dummy-token', | CODE |
| LOW | apps/reef/app/routes/activity-observe.server.test.ts | 82 | accessToken: 'expired-dummy-token', | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | crates/coral-task/README.md | 1 | # Task orchestration | COMMENT |
| MEDIUM | apps/reef/recipes/freshworks_developer/recipe.yaml | 2 | # Official provider documentation: https://developers.freshworks.com/docs/agentic-dev-tools/mcp-server/ | COMMENT |
| MEDIUM | apps/reef/recipes/freshworks_developer/recipe.yaml | 2 | # Official provider documentation: https://developers.freshworks.com/docs/agentic-dev-tools/mcp-server/ | COMMENT |
| MEDIUM | apps/reef/recipes/freshworks_developer/recipe.yaml | 17 | documentation_url: https://developers.freshworks.com/docs/agentic-dev-tools/mcp-server/ | CODE |
| MEDIUM | apps/reef/recipes/new_relic/recipe.yaml | 2 | # Official provider documentation: https://docs.newrelic.com/docs/agentic-ai/mcp/setup/ | COMMENT |
| MEDIUM | apps/reef/recipes/new_relic/recipe.yaml | 2 | # Official provider documentation: https://docs.newrelic.com/docs/agentic-ai/mcp/setup/ | COMMENT |
| MEDIUM | apps/reef/recipes/new_relic/recipe.yaml | 17 | documentation_url: https://docs.newrelic.com/docs/agentic-ai/mcp/setup/ | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .config/nextest.toml | 19 | # The Run fan-out load harness (`scripts/load.mjs`) runs one ignored test for | COMMENT |
| MEDIUM | crates/coral-grpc/tests/grpc/load/concurrent.rs | 26 | #[ignore = "load harness: run through scripts/load.mjs"] | COMMENT |
| MEDIUM | crates/coral-grpc/tests/grpc/load/fan_out.rs | 17 | #[ignore = "load harness: run through scripts/load.mjs"] | COMMENT |
| MEDIUM | crates/coral-grpc/tests/grpc/load/emit.rs | 135 | #[ignore = "load harness: run through scripts/load.mjs"] | COMMENT |
| MEDIUM | .github/workflows/reel.yml | 61 | # The harness checks itself once per suite, in the first shard. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .agents/skills/triage/SKILL.md | 16 | > *This was generated by AI during triage.* | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | apps/reef/app/views/providers/providers.stories.tsx | 1440 | // Step 2: what can it do? | COMMENT |
| LOW | apps/reef/app/views/providers/providers.stories.tsx | 1572 | // Step 3: whose account does it use? | COMMENT |
| LOW | apps/reef/app/views/providers/providers.stories.tsx | 1685 | // Step 4: check it and add it. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | apps/reef/app/views/providers/providers.stories.tsx | 1440 | // Step 2: what can it do? | COMMENT |
| LOW | apps/reef/app/views/providers/providers.stories.tsx | 1572 | // Step 3: whose account does it use? | COMMENT |
| LOW | apps/reef/app/views/providers/providers.stories.tsx | 1685 | // Step 4: check it and add it. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .agents/skills/to-benchmark/run.py | 130 | CODE | |
| LOW | .agents/skills/to-benchmark/run.py | 211 | CODE | |
| LOW | .agents/skills/to-benchmark/run.py | 256 | CODE | |
| LOW | .agents/skills/to-benchmark/run.py | 297 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | apps/reef/recipes/discord/recipe.yaml | 79 | - webhook.incoming # Create a webhook. | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …s/skills/diagnosing-bugs/scripts/hitl-loop.template.sh | 6 | # Usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | apps/reef/app/entry.server.tsx | 18 | export default function handleRequest( | CODE |