2.0

Adjusted Signal

2.0

Raw Pattern Score

100%

Time Factor

2026-10-31

Last Push

2.1K

Stars

TypeScript

Language

141.7K

Lines of Code

481

Files

256

Pattern Hits

2026-10-31

Scan Date

0.00

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 8.4/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 244 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.1/100 · LOW

Are imports declared and package/API names verified? 2 finding(s).

Agent Over-Engineering Ratio 6.8/100 · LOW

Are wrappers, guards, and repeated structures necessary? 206 finding(s).

PR Review Velocity Impact 9.4/100 · LOW

Which changes need focused human review? 256 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 0HIGH 0MEDIUM 12LOW 244

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 256 distinct pattern matches across 10 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers196 hits · 170 pts

Severity	File	Line	Snippet	Context
LOW	deprecated-env.ts	280	export function deprecatedEnvInputFromSources(	CODE
LOW	oauth.ts	56	export function isAuthInvalidTokenResponse(status: number, bodyText: string): boolean {	CODE
LOW	oauth.ts	96	export async function closeSharedOAuthServersAsync(): Promise<void> {	CODE
LOW	oauth.ts	242	async function requestAuthFromExistingServer(port: number, requestId: string): Promise<TokenData> {	CODE
LOW	schemas.ts	5781	function hasExactlyOneWebhookScope(data: { project_id?: string; group_id?: string }): boolean {	CODE
LOW	oauth-proxy.ts	1174	export function createGitLabOAuthProvider(	CODE
LOW⚡	index.ts	2343	function isGitLabUserApiRateLimitBody(errorBody: string): boolean {	CODE
LOW⚡	index.ts	2347	function isGitLabInsufficientUserScopeBody(errorBody: string): boolean {	CODE
LOW⚡	index.ts	2354	async function isInsufficientUserScopeForbiddenAsync(response: UndiciResponse): Promise<boolean> {	CODE
LOW⚡	index.ts	2362	async function throwUserApiScopeErrorUnlessRateLimitedAsync(	CODE
LOW	index.ts	134	function isConstantTimeSecretMatch(	CODE
LOW	index.ts	849	function buildToolUnavailableMessage(toolName: string): string {	CODE
LOW	index.ts	1401	function getMcpDnsRebindingProtection() {	CODE
LOW	index.ts	1710	function configuredGitLabApiUrlErrors(): string[] {	CODE
LOW	index.ts	1717	function emitDeprecatedEnvWarnings(): void {	CODE
LOW	index.ts	1784	function isToolAllowedByPermissionMode(toolName: string): boolean {	CODE
LOW	index.ts	2024	function rejectIfStrictProjectScope(toolName: string): void {	CODE
LOW	index.ts	2077	function isExcludedFromToolsetListing(toolName: string): boolean {	CODE
LOW	index.ts	2122	function parseAllowedGitLabApiUrls(value: string): Array<{ host: string; apiUrl: string }> {	CODE
LOW	index.ts	2129	function resolveTrustedGitLabApiUrl(value: string): string {	CODE
LOW	index.ts	2373	async function authenticateWithJobTokenFallbackAsync(response: UndiciResponse): Promise<boolean> {	CODE
LOW	index.ts	2426	function rejectIfProjectScopedDeployment(toolName: string): void {	CODE
LOW	index.ts	2711	function appendMergeRequestFilters(url: URL, options: Record<string, unknown>): void {	CODE
LOW	index.ts	3277	async function listCustomFieldDefinitions(	CODE
LOW	index.ts	3795	async function updateIncidentEscalationStatus(	CODE
LOW	index.ts	3841	async function resolveProjectOrGroupPath(	CODE
LOW	index.ts	5055	async function listMergeRequestDiscussions(	CODE
LOW	index.ts	5079	async function deleteMergeRequestDiscussionNote(	CODE
LOW	index.ts	5117	async function updateMergeRequestDiscussionNote(	CODE
LOW	index.ts	5264	async function createMergeRequestDiscussionNote(	CODE
LOW	index.ts	5416	async function getMergeRequestDiscussion(	CODE
LOW	index.ts	5853	async function getMergeRequestSourceCommitCount(	CODE
LOW	index.ts	5895	async function listMergeRequestPipelines(	CODE
LOW	index.ts	5937	async function buildMergeRequestCommitAdditionSummary(	CODE
LOW	index.ts	5971	async function buildMergeRequestApprovalSummary(	CODE
LOW	index.ts	6006	async function buildMergeRequestDeploymentSummary(	CODE
LOW	index.ts	6168	async function listMergeRequestChangedFiles(	CODE
LOW	index.ts	6506	async function getMergeRequestRebaseStatus(	CODE
LOW	index.ts	6537	async function getMergeRequestApprovalState(	CODE
LOW	index.ts	6621	async function getMergeRequestApprovalsFallback(	CODE
LOW	index.ts	6946	function healthCheckTransportErrorResult(error: unknown) {	CODE
LOW	index.ts	6969	async function fetchGitLabVersionMetadata(): Promise<GitLabInstanceVersionMetadata \| null> {	CODE
LOW	index.ts	6982	async function fetchGitLabInstanceVersion(): Promise<string \| null> {	CODE
LOW	index.ts	7051	async function resolveMergeRequestThread(	CODE
LOW	index.ts	8134	function restrictRunnerDetailsToAllowlist(	CODE
LOW	index.ts	8163	async function assertRunnerAvailableToProject(projectId: string, runnerId: string): Promise<void> {	CODE
LOW	index.ts	8808	async function listPipelineSchedulePipelines(	CODE
LOW	index.ts	8945	async function takeOwnershipPipelineSchedule(	CODE
LOW	index.ts	8972	async function getPipelineScheduleVariable(	CODE
LOW	index.ts	8999	async function createPipelineScheduleVariable(	CODE
LOW	index.ts	9032	async function updatePipelineScheduleVariable(	CODE
LOW	index.ts	9065	async function deletePipelineScheduleVariable(	CODE
LOW	index.ts	9209	async function getMergeRequestRebaseStatusBeforeDeadline(	CODE
LOW	index.ts	9226	async function waitForMergeRequestRebase(	CODE
LOW	index.ts	9552	async function getMilestoneMergeRequests(	CODE
LOW	index.ts	9604	async function getMilestoneBurndownEvents(	CODE
LOW	index.ts	9773	async function getGroupMilestoneMergeRequests(	CODE
LOW	index.ts	9799	async function getGroupMilestoneBurndownEvents(	CODE
LOW	index.ts	10318	function normalizeIterationLookupId(iterationId: string): {	CODE
LOW	index.ts	10330	function selectGroupIterationMatch(	CODE
136 more matches not shown…

Structural Annotation Overuse27 hits · 46 pts

Severity	File	Line	Snippet	Context
LOW	index.ts	17115	// Step 1: derive the effective auth for this request.	COMMENT
LOW	index.ts	17275	// Step 3: build the AsyncLocalStorage context so buildAuthHeaders and	COMMENT
LOW	index.ts	17287	// Step 4: create a fresh transport per request.	COMMENT
LOW	test/remote-auth-simple-test.ts	303	// Step 1: Connect WITH auth header to establish session	COMMENT
LOW⚡	test/remote-auth-simple-test.ts	329	// Step 2: Wait for timeout WITHOUT making any requests	COMMENT
LOW⚡	test/remote-auth-simple-test.ts	336	// Step 3: A stale stateful session must return the MCP re-initialization signal.	COMMENT
LOW⚡	test/stateless/callback-proxy.test.ts	321	// Step 1: register client on podA (signed client_id → every pod can read it)	COMMENT
LOW⚡	test/stateless/callback-proxy.test.ts	327	// Step 2: authorize on podA — captures the redirect URL to GitLab	COMMENT
LOW	test/stateless/callback-proxy.test.ts	353	// Step 3: GitLab redirects to our /callback — on a DIFFERENT pod (B).	COMMENT
LOW	test/stateless/callback-proxy.test.ts	383	// Step 4: MCP client redeems the proxy code on a THIRD pod (C).	COMMENT
LOW	docs/auth/oauth-setup.md	33	## Step 1: Create a GitLab OAuth Application	COMMENT
LOW	docs/auth/oauth-setup.md	69	## Step 2: Configure the MCP Server	COMMENT
LOW	docs/auth/oauth-setup.md	123	## Step 3: First-Time Authentication	COMMENT
LOW	.github/skills/security-scan/SKILL.md	21	### Step 1: Determine Scope	COMMENT
LOW	.github/skills/security-scan/SKILL.md	29	### Step 2: Secrets Scan	COMMENT
LOW	.github/skills/security-scan/SKILL.md	47	### Step 3: Dependency Audit	COMMENT
LOW	.github/skills/security-scan/SKILL.md	68	### Step 4: Input Validation Spot-Check	COMMENT
LOW	.github/skills/security-scan/SKILL.md	75	### Step 5: Auth/Authz Quick Check	COMMENT
LOW	.github/skills/skill-stocktake/SKILL.md	22	### Step 1: Inventory	COMMENT
LOW	.github/skills/skill-stocktake/SKILL.md	36	### Step 2: Frontmatter Validation (v1.0.5+)	COMMENT
LOW⚡	.github/skills/skill-stocktake/SKILL.md	65	### Step 3: Template Sync Check	COMMENT
LOW⚡	.github/skills/skill-stocktake/SKILL.md	74	### Step 4: Quality Checks	COMMENT
LOW⚡	.github/skills/skill-stocktake/SKILL.md	84	### Step 5: Coverage Analysis	COMMENT
LOW	skills/gitlab-mcp/reference/code-review.md	8	## Step 1: List Changed Files	COMMENT
LOW	skills/gitlab-mcp/reference/code-review.md	27	## Step 2: Batch Diff Retrieval	COMMENT
LOW	skills/gitlab-mcp/reference/code-review.md	43	## Step 3: Leave Comments	COMMENT
LOW	skills/gitlab-mcp/reference/code-review.md	81	## Step 4: Resolve Threads	COMMENT

Decorative Section Separators10 hits · 30 pts

Severity	File	Line	Snippet	Context
MEDIUM	stateless/codec.ts	42	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	45	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	80	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	82	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	101	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	103	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	171	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	173	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	247	// ──────────────────────────────────────────────────────────────────────────	COMMENT
MEDIUM	stateless/codec.ts	249	// ──────────────────────────────────────────────────────────────────────────	COMMENT

Verbosity Indicators10 hits · 18 pts

Severity	File	Line	Snippet	Context
LOW	index.ts	17115	// Step 1: derive the effective auth for this request.	COMMENT
LOW	index.ts	17275	// Step 3: build the AsyncLocalStorage context so buildAuthHeaders and	COMMENT
LOW	index.ts	17287	// Step 4: create a fresh transport per request.	COMMENT
LOW	test/remote-auth-simple-test.ts	303	// Step 1: Connect WITH auth header to establish session	COMMENT
LOW⚡	test/remote-auth-simple-test.ts	329	// Step 2: Wait for timeout WITHOUT making any requests	COMMENT
LOW⚡	test/remote-auth-simple-test.ts	336	// Step 3: A stale stateful session must return the MCP re-initialization signal.	COMMENT
LOW⚡	test/stateless/callback-proxy.test.ts	321	// Step 1: register client on podA (signed client_id → every pod can read it)	COMMENT
LOW⚡	test/stateless/callback-proxy.test.ts	327	// Step 2: authorize on podA — captures the redirect URL to GitLab	COMMENT
LOW	test/stateless/callback-proxy.test.ts	353	// Step 3: GitLab redirects to our /callback — on a DIFFERENT pod (B).	COMMENT
LOW	test/stateless/callback-proxy.test.ts	383	// Step 4: MCP client redeems the proxy code on a THIRD pod (C).	COMMENT

AI Slop Vocabulary2 hits · 6 pts

Severity	File	Line	Snippet	Context
MEDIUM	index.ts	936	// This is a robust workaround for AsyncLocalStorage context loss.	COMMENT
MEDIUM	index.ts	1915	// Use tough-cookie's parse function for robust parsing	COMMENT

Over-Commented Block6 hits · 6 pts

Severity	File	Line	Snippet	Context
LOW	index.ts	17581		COMMENT
LOW	test/stateless/session-id-integration.test.ts	581	// OAuth + stateless — sid-only follow-up across pods	COMMENT
LOW	utils/redact-url.ts	801	lastAt,	COMMENT
LOW	.github/workflows/tool-docs-sync.yml	1	name: Sync Generated Tool Docs	COMMENT
LOW	.github/hooks/pre-tool-use.sh	1	#!/bin/bash	COMMENT
LOW	.github/hooks/post-tool-use.sh	1	#!/bin/bash	COMMENT

Redundant / Tautological Comments2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	scripts/release.sh	22	# Check if gh CLI is available	COMMENT
LOW	scripts/release.sh	546	# Check if the current version tag already exists locally	COMMENT

Fake / Example Data1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	test/schema-tests.ts	1577	email: 'admin@example.com',	CODE

Unused Imports1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	scripts/generate-star-history.py	4		CODE

Deep Nesting1 hit · 1 pts

Severity	File	Line	Snippet	Context
LOW	scripts/generate-star-history.py	51		CODE

zereight/gitlab-mcp

Open-Source Code Quality, Security and Technical Debt Review