{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:52:16.256722Z","repo":{"ref":{"host":"github.com","owner":"snowmead","name":"rust-docs-mcp"},"default_branch":"main","clone_url":"https://github.com/snowmead/rust-docs-mcp.git","html_url":"https://github.com/snowmead/rust-docs-mcp","description":"MCP server for agents to explore rust docs, analyze source code, and build with confidence","stars":142,"forks":13,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":3909,"primary_language":"Rust","license_spdx":"MIT","created_at":"2025-06-13T02:39:50Z","pushed_at":"2026-09-21T13:37:30Z","security_policy_url":null,"distribution":{"owner_created_at":"2021-11-21T03:56:20Z","owner_type":"User","release_assets":[]}},"commit_sha":"8c89df058f3be23db74435569c63fa8d08601767","profile":{"lines_by_language":{"Rust":25966,"Shell":261},"files_by_category":{"source":72,"config":13,"docs":10,"other":6,"test":6,"binary":3,"generated":2},"source_lines":22820,"test_lines":3407},"pillars":{"ai_provenance":{"score":55.4,"confidence":0.95,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.5543,"suspected_share":0.0,"estimated_share":0.5543,"ai_artifacts":5.0,"flagged_work_units":1.0,"flagged_releases":null},"summary":"Explicit AI attribution on 55% of first-party code added; an estimated 55% including velocity signals."},"quality":{"score":76.3,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":53.1,"duplication":58.8,"lint":100.0,"testing":81.5,"docs":100.0,"type_safety":null,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.15, CI runs tests; 21% of function code in complex or long functions; 9% duplicated lines. Weakest area: complexity."},"security":{"score":54.8,"confidence":0.85,"coverage":1.0,"label":"weak","breakdown":{"secrets":100.0,"sast":96.6,"dependencies":12.5,"ci_actions":3.2,"posture":20.0,"scorecard":null},"summary":"Security posture is weak: 65 known vulnerabilities in 29 dependencies; 17 high-severity workflow issues. Weakest area: ci actions."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"ok","tool_version":null,"metrics":{"declared":75.0,"checked":75.0,"missing":0.0,"recent":0.0,"lookup_errors":0.0},"findings":[],"evidence":[],"data":{"phantom":false},"error":null},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":112.0,"attributed_commits":52.0,"attributed_commit_share":0.4642857142857143,"effective_loc":36918.0,"attributed_loc":20464.0,"attributed_loc_share":0.5543095508965816,"tools_detected":5.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 49 attributed commits, 18,094 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"OpenAI Codex: 3 attributed commits, 2,874 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"GitHub Copilot coding agent: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Devin: 1 attributed commits, 1,225 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attribution-summary","description":"Cursor agent: 1 attributed commits, 0 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"8c89df058f3be23db74435569c63fa8d08601767","url":"https://github.com/snowmead/rust-docs-mcp/commit/8c89df058f3be23db74435569c63fa8d08601767","weight":0.9},{"kind":"attributed-commit","description":"OpenAI Codex: PR branch 'codex/address-open-issues'","ref":"a3b5abf5c839406322e1423e9628bdd6190286f2","url":"https://github.com/snowmead/rust-docs-mcp/commit/a3b5abf5c839406322e1423e9628bdd6190286f2","weight":0.9},{"kind":"attributed-commit","description":"Cursor agent: trailer 'Co-authored-by: Cursor Agent'","ref":"ad81bd3c966f1f154c3c901018d1c037a64a10cf","url":"https://github.com/snowmead/rust-docs-mcp/commit/ad81bd3c966f1f154c3c901018d1c037a64a10cf","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"c8ad7890c06e09277b9eec328640bebd11f0b557","url":"https://github.com/snowmead/rust-docs-mcp/commit/c8ad7890c06e09277b9eec328640bebd11f0b557","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"42f0744a2f67c075b8fb8ac1bca753c6f3fd9b44","url":"https://github.com/snowmead/rust-docs-mcp/commit/42f0744a2f67c075b8fb8ac1bca753c6f3fd9b44","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"59369680a5ecc01d2b80f5feae4e6f14759b812c","url":"https://github.com/snowmead/rust-docs-mcp/commit/59369680a5ecc01d2b80f5feae4e6f14759b812c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"edd9ce870546539a74a7f0e921c92ae346c99008","url":"https://github.com/snowmead/rust-docs-mcp/commit/edd9ce870546539a74a7f0e921c92ae346c99008","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"a175ca4fc1d643aec4c4198b543e9b8f0d66b27a","url":"https://github.com/snowmead/rust-docs-mcp/commit/a175ca4fc1d643aec4c4198b543e9b8f0d66b27a","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"1f38a2f649aec18aca8c008aaf1b81200b53362e","url":"https://github.com/snowmead/rust-docs-mcp/commit/1f38a2f649aec18aca8c008aaf1b81200b53362e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"b61a4d4ca535041fe1467f002099392ef1a64f79","url":"https://github.com/snowmead/rust-docs-mcp/commit/b61a4d4ca535041fe1467f002099392ef1a64f79","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d42f8dd70bfcf94058873ac2b9b8f0aa0231dc81","url":"https://github.com/snowmead/rust-docs-mcp/commit/d42f8dd70bfcf94058873ac2b9b8f0aa0231dc81","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"db97a77dc21dd5a2f031c2b5263b466e9d64b147","url":"https://github.com/snowmead/rust-docs-mcp/commit/db97a77dc21dd5a2f031c2b5263b466e9d64b147","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"6ed7472ab64abc426ac0f49fce71db0369e898eb","url":"https://github.com/snowmead/rust-docs-mcp/commit/6ed7472ab64abc426ac0f49fce71db0369e898eb","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"606b82f0ffbca24819f0b8438cd3ad87e2cc905c","url":"https://github.com/snowmead/rust-docs-mcp/commit/606b82f0ffbca24819f0b8438cd3ad87e2cc905c","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"1b0bc28315e7c3f88735aab4e528c88f9eab76e0","url":"https://github.com/snowmead/rust-docs-mcp/commit/1b0bc28315e7c3f88735aab4e528c88f9eab76e0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"f545129484c65e178b9fffd89600d42173086d98","url":"https://github.com/snowmead/rust-docs-mcp/commit/f545129484c65e178b9fffd89600d42173086d98","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"09d2ad6d367cee4370a4e9631f2fb362c61fad45","url":"https://github.com/snowmead/rust-docs-mcp/commit/09d2ad6d367cee4370a4e9631f2fb362c61fad45","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"51083ad500dfcf8769b6e1b4a1a37e43e69f58ec","url":"https://github.com/snowmead/rust-docs-mcp/commit/51083ad500dfcf8769b6e1b4a1a37e43e69f58ec","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"348a0906ee9b9d26dfcf54e623953e458bb24ced","url":"https://github.com/snowmead/rust-docs-mcp/commit/348a0906ee9b9d26dfcf54e623953e458bb24ced","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"af6fc3654d7d6454611e25d388ffc13835d29fc7","url":"https://github.com/snowmead/rust-docs-mcp/commit/af6fc3654d7d6454611e25d388ffc13835d29fc7","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"4a080de0b900f0838987eb6e1e22cca46e7b089e","url":"https://github.com/snowmead/rust-docs-mcp/commit/4a080de0b900f0838987eb6e1e22cca46e7b089e","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"d7304871d8ec8427d811089229a3104cb559f223","url":"https://github.com/snowmead/rust-docs-mcp/commit/d7304871d8ec8427d811089229a3104cb559f223","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"328cd388a7e84ec06e68109417efead203e53061","url":"https://github.com/snowmead/rust-docs-mcp/commit/328cd388a7e84ec06e68109417efead203e53061","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7fc11120c24f23b60cd3c15c7b309cf1e4e7fabc","url":"https://github.com/snowmead/rust-docs-mcp/commit/7fc11120c24f23b60cd3c15c7b309cf1e4e7fabc","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-authored-by: Claude'","ref":"0d50a12584b64199f734d97b22c738463274631a","url":"https://github.com/snowmead/rust-docs-mcp/commit/0d50a12584b64199f734d97b22c738463274631a","weight":0.9}],"data":{"attributed_loc_by_commit":{"e053fcea8785a8a28f8d81d4978b07572877a581":119,"ffc08c275969d96a9f2fa532aa1d76bb878b12d6":160,"340bf098ca8050050718c55870d43d525e3d3d96":55,"73d1f537b6cc12de6f55d5978b946360c5dd1e5a":419,"56d75f8969e1db212d5a300a11711d4e21fffa74":41,"2ae0674d8cf883164cc92a94670fbc105012ea79":397,"d7a1cd35cac38f318dfd3bb6c9ba5d72b37336ee":1887,"237af76a3ea3cd36efca8d78f7716a67e921ae8d":0,"4edefa7c9572710c883461a47a1479d6afdfd5b0":30,"486dafec14085b2214747695c2a2575673f8d9c8":2344,"b7f99ecc8459a8f6807989a3cecdc04a9e6d20a7":27,"64eeaa66cc3fa1dcdb611746dd74bf857c1ed87a":13,"d041e3c24d387b5572672bbbcc670362d31d86cb":22,"978f19ef32f77d9ac7bc6b68789bd8a5986a644a":50,"ae7ac0c10596477ea3f9afc7103aeac7bee919b1":24,"5650165bd5c3fd3a0b9537c5da1801214966e418":0,"8b6d78c38d2ce3b00e0d7349ddb251f2a290ac8e":0,"9e983a2429d7fb9ed54896bf596a7ba70807a9e6":152,"d81a08f79d601f9a6111ecb8baef367c1c87e634":271,"897cb95a866e48383635444fc3627e22aea5a48d":1,"8479d3348ee2283de1d66e399acff0d64048e6e2":832,"e440227ebefc8e10fc77aa8f14ff038452ad1be8":21,"f145626c4d12f5b332c4f92363dc662a3011849d":0,"717dd3a6bc53fae0da115b3c0640a49eceadc115":2060,"d10ea6a2a3c9483d66fbf6107c232411e2fee0ba":1,"a704553d14b130e5c5291104b9c0c9b2f7bda199":0,"9fb86f54b68310f677b56a4befeacd6490318df5":213,"0d50a12584b64199f734d97b22c738463274631a":45,"7fc11120c24f23b60cd3c15c7b309cf1e4e7fabc":75,"328cd388a7e84ec06e68109417efead203e53061":48,"d7304871d8ec8427d811089229a3104cb559f223":68,"4a080de0b900f0838987eb6e1e22cca46e7b089e":3292,"af6fc3654d7d6454611e25d388ffc13835d29fc7":6,"348a0906ee9b9d26dfcf54e623953e458bb24ced":10,"51083ad500dfcf8769b6e1b4a1a37e43e69f58ec":1,"09d2ad6d367cee4370a4e9631f2fb362c61fad45":41,"f545129484c65e178b9fffd89600d42173086d98":467,"1b0bc28315e7c3f88735aab4e528c88f9eab76e0":300,"606b82f0ffbca24819f0b8438cd3ad87e2cc905c":1691,"6ed7472ab64abc426ac0f49fce71db0369e898eb":1,"db97a77dc21dd5a2f031c2b5263b466e9d64b147":0,"d42f8dd70bfcf94058873ac2b9b8f0aa0231dc81":222,"b61a4d4ca535041fe1467f002099392ef1a64f79":19,"1f38a2f649aec18aca8c008aaf1b81200b53362e":0,"a175ca4fc1d643aec4c4198b543e9b8f0d66b27a":236,"edd9ce870546539a74a7f0e921c92ae346c99008":0,"59369680a5ecc01d2b80f5feae4e6f14759b812c":268,"42f0744a2f67c075b8fb8ac1bca753c6f3fd9b44":322,"c8ad7890c06e09277b9eec328640bebd11f0b557":1225,"ad81bd3c966f1f154c3c901018d1c037a64a10cf":0,"a3b5abf5c839406322e1423e9628bdd6190286f2":2370,"8c89df058f3be23db74435569c63fa8d08601767":618},"tools":{"claude-code":{"name":"Claude Code","commits":49,"loc":18094,"first_seen":1749810993,"last_seen":1789997849},"github-copilot":{"name":"GitHub Copilot coding agent","commits":1,"loc":0,"first_seen":1750441013,"last_seen":1750441013},"openai-codex":{"name":"OpenAI Codex","commits":3,"loc":2874,"first_seen":1775881680,"last_seen":1789994831},"devin":{"name":"Devin","commits":1,"loc":1225,"first_seen":1776050228,"last_seen":1776050228},"cursor":{"name":"Cursor agent","commits":1,"loc":0,"first_seen":1783346047,"last_seen":1783346047}},"monthly":{"2025-06":{"loc":15554,"attributed_loc":6012},"2025-07":{"loc":3129,"attributed_loc":3127},"2025-08":{"loc":3557,"attributed_loc":3534},"2025-09":{"loc":41,"attributed_loc":0},"2025-10":{"loc":819,"attributed_loc":819},"2025-11":{"loc":1965,"attributed_loc":1933},"2026-01":{"loc":0,"attributed_loc":0},"2026-03":{"loc":0,"attributed_loc":0},"2026-04":{"loc":2622,"attributed_loc":2051},"2026-07":{"loc":6243,"attributed_loc":0},"2026-09":{"loc":2988,"attributed_loc":2988}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":3.0,"workflow_agents":2.0,"tools_configured":1.0,"earliest_adoption":1750281960.0},"findings":[],"evidence":[{"kind":"ai-artifact","description":".claude/commands/test_mcp.md (claude-code configuration)","ref":".claude/commands/test_mcp.md","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/.claude/commands/test_mcp.md","weight":0.5},{"kind":"ai-artifact","description":".claude/commands/update_mcp_tools_list.md (claude-code configuration)","ref":".claude/commands/update_mcp_tools_list.md","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/.claude/commands/update_mcp_tools_list.md","weight":0.5},{"kind":"ai-artifact","description":"CLAUDE.md (claude-code configuration)","ref":"CLAUDE.md","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/CLAUDE.md","weight":0.5},{"kind":"ai-workflow","description":".github/workflows/claude-code-review.yml runs anthropics/claude-code-action","ref":".github/workflows/claude-code-review.yml","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/.github/workflows/claude-code-review.yml","weight":0.6},{"kind":"ai-workflow","description":".github/workflows/claude.yml runs anthropics/claude-code-action","ref":".github/workflows/claude.yml","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/.github/workflows/claude.yml","weight":0.6}],"data":{"artifacts":[{"tool":"claude-code","path":".claude/commands/test_mcp.md","added_at":1755888694},{"tool":"claude-code","path":".claude/commands/update_mcp_tools_list.md","added_at":1750281960},{"tool":"claude-code","path":"CLAUDE.md","added_at":1750281960}],"workflows":[{"tool":"claude-code","path":".github/workflows/claude-code-review.yml","action":"anthropics/claude-code-action"},{"tool":"claude-code","path":".github/workflows/claude.yml","action":"anthropics/claude-code-action"}],"tools":["claude-code"]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":59.0,"flagged_units":1.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":29939.0,"flagged_loc":2344.0,"flagged_loc_share":0.07829252814055246,"max_loc_per_hour":897.9887198041929,"median_loc_per_hour":30.324327541061653,"pr_timed_units":24.0,"excluded_import_loc":6979.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"2,344 lines of first-party code in ~2.6h (898 lines/hour, 1 commit session)","ref":"486dafec14085b2214747695c2a2575673f8d9c8","url":"https://github.com/snowmead/rust-docs-mcp/commit/486dafec14085b2214747695c2a2575673f8d9c8","weight":0.26939661594125786}],"data":{"flagged_loc_by_commit":{"486dafec14085b2214747695c2a2575673f8d9c8":2344},"excluded_import_commits":["e48431ce1ae9245d36fa7564ff681b466943ae9b"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":22820.0,"index":0.679,"count:narrated_steps":3.0,"per_kloc:narrated_steps":0.131,"files:narrated_steps":2.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":21.0,"per_kloc:emoji_in_code":0.92,"files:emoji_in_code":3.0,"count:assistant_voice":1.0,"per_kloc:assistant_voice":0.044,"files:assistant_voice":1.0},"findings":[],"evidence":[{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Then, we need to hide the graph behind the queries such that most queries look only at the proper crate graph, and fa","ref":"patches/ra_ap_project_model/src/workspace.rs:94","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/workspace.rs#L94","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // Next, create crates for each package, target pair","ref":"patches/ra_ap_project_model/src/workspace.rs:1173","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/workspace.rs#L1173","weight":0.0},{"kind":"stylometry:narrated_steps","description":"step-by-step narration comment: // First, download the crate if not already cached","ref":"rust-docs-mcp/src/cache/service.rs:1033","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/service.rs#L1033","weight":0.0},{"kind":"stylometry:assistant_voice","description":"assistant-style phrasing left in code: // Skip examples for now as requested","ref":"rust-docs-mcp/src/cache/workspace.rs:70","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/workspace.rs#L70","weight":0.0}],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":9.0,"findings_high":0.0,"findings_medium":0.0,"findings_low":9.0,"weighted_findings":2.25,"scanned_lines":22820.0,"parse_errors":1.0},"findings":[{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"patches/ra_ap_project_model/src/build_dependencies.rs","line":475,"fingerprint":"rust.lang.security.current-exe:patches/ra_ap_project_model/src/build_dependencies.rs:475"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"rust-docs-mcp/src/cache/docgen.rs","line":47,"fingerprint":"rust.lang.security.unsafe-usage:rust-docs-mcp/src/cache/docgen.rs:47"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"rust-docs-mcp/src/cache/docgen.rs","line":65,"fingerprint":"rust.lang.security.unsafe-usage:rust-docs-mcp/src/cache/docgen.rs:65"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"rust-docs-mcp/src/cache/downloader.rs","line":308,"fingerprint":"rust.lang.security.temp-dir:rust-docs-mcp/src/cache/downloader.rs:308"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"rust-docs-mcp/src/cache/downloader.rs","line":473,"fingerprint":"rust.lang.security.temp-dir:rust-docs-mcp/src/cache/downloader.rs:473"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"rust-docs-mcp/src/cache/downloader.rs","line":787,"fingerprint":"rust.lang.security.unsafe-usage:rust-docs-mcp/src/cache/downloader.rs:787"},{"rule_id":"opengrep/rust.lang.security.unsafe-usage","severity":"low","message":"Detected 'unsafe' usage, please audit for secure usage [confidence high]","path":"rust-docs-mcp/src/cache/downloader.rs","line":793,"fingerprint":"rust.lang.security.unsafe-usage:rust-docs-mcp/src/cache/downloader.rs:793"},{"rule_id":"opengrep/rust.lang.security.temp-dir","severity":"low","message":"temp_dir should not be used for security operations. From the docs: 'The temporary directory may be shared among users, or between processes with different privileges; thus, the creation of any files or directories in the temporary directory must use a secure method to create a uniquely named file.  [confidence high]","path":"rust-docs-mcp/src/cache/storage.rs","line":525,"fingerprint":"rust.lang.security.temp-dir:rust-docs-mcp/src/cache/storage.rs:525"},{"rule_id":"opengrep/rust.lang.security.current-exe","severity":"low","message":"current_exe should not be used for security operations. From the docs: \"The output of this function should not be trusted for anything that might have security implications. Basically, if users can run the executable, they can change the output arbitrarily.\" [confidence high]","path":"rust-docs-mcp/src/main.rs","line":190,"fingerprint":"rust.lang.security.current-exe:rust-docs-mcp/src/main.rs:190"}],"evidence":[],"data":{"rulesets":["rust","bash"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"ok","tool_version":"osv-scanner version: 2.7.1","metrics":{"vulnerable_packages":29.0,"vulnerabilities":65.0,"vulns_critical":0.0,"vulns_high":15.0,"vulns_medium":11.0,"vulns_low":8.0,"vulns_unknown":31.0,"penalty":125.0},"findings":[{"rule_id":"osv/GHSA-vvp9-7p8x-rfvv","severity":"high","message":"lz4_flex@0.11.5 (crates.io) is affected by RUSTSEC-2026-0041, GHSA-vvp9-7p8x-rfvv","path":"Cargo.lock","line":null,"fingerprint":"lz4_flex@0.11.5 (crates.io):GHSA-vvp9-7p8x-rfvv"},{"rule_id":"osv/GHSA-rvr2-r3pv-5m4p","severity":"high","message":"oneshot@0.1.11 (crates.io) is affected by RUSTSEC-2026-0005, GHSA-rvr2-r3pv-5m4p","path":"Cargo.lock","line":null,"fingerprint":"oneshot@0.1.11 (crates.io):GHSA-rvr2-r3pv-5m4p"},{"rule_id":"osv/GHSA-8c75-8mhr-p7r9","severity":"high","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0463, GHSA-8c75-8mhr-p7r9","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-8c75-8mhr-p7r9"},{"rule_id":"osv/GHSA-pqf5-4pqq-29f5","severity":"high","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0473, GHSA-pqf5-4pqq-29f5","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-pqf5-4pqq-29f5"},{"rule_id":"osv/GHSA-xp3w-r5p5-63rr","severity":"high","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0474, GHSA-xp3w-r5p5-63rr","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-xp3w-r5p5-63rr"},{"rule_id":"osv/GHSA-ghm9-cr32-g9qj","severity":"high","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0475, GHSA-ghm9-cr32-g9qj","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-ghm9-cr32-g9qj"},{"rule_id":"osv/GHSA-hppc-g8h3-xhp3","severity":"high","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0478, GHSA-hppc-g8h3-xhp3","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-hppc-g8h3-xhp3"},{"rule_id":"osv/RUSTSEC-2026-0414","severity":"high","message":"pulldown-cmark@0.13.0 (crates.io) is affected by RUSTSEC-2026-0414; also in cargo-modules/Cargo.lock","path":"Cargo.lock","line":null,"fingerprint":"pulldown-cmark@0.13.0 (crates.io):RUSTSEC-2026-0414"},{"rule_id":"osv/RUSTSEC-2026-0433","severity":"high","message":"pulldown-cmark@0.13.0 (crates.io) is affected by RUSTSEC-2026-0433; also in cargo-modules/Cargo.lock","path":"Cargo.lock","line":null,"fingerprint":"pulldown-cmark@0.13.0 (crates.io):RUSTSEC-2026-0433"},{"rule_id":"osv/GHSA-89vp-x53w-74fx","severity":"high","message":"rmcp@0.8.0 (crates.io) is affected by RUSTSEC-2026-0189, GHSA-89vp-x53w-74fx","path":"Cargo.lock","line":null,"fingerprint":"rmcp@0.8.0 (crates.io):GHSA-89vp-x53w-74fx"},{"rule_id":"osv/GHSA-33f5-2c5q-wgwj","severity":"high","message":"rmcp@0.8.0 (crates.io) is affected by GHSA-33f5-2c5q-wgwj","path":"Cargo.lock","line":null,"fingerprint":"rmcp@0.8.0 (crates.io):GHSA-33f5-2c5q-wgwj"},{"rule_id":"osv/GHSA-9pj6-vhgr-3mwh","severity":"high","message":"rmcp@0.8.0 (crates.io) is affected by GHSA-9pj6-vhgr-3mwh","path":"Cargo.lock","line":null,"fingerprint":"rmcp@0.8.0 (crates.io):GHSA-9pj6-vhgr-3mwh"},{"rule_id":"osv/GHSA-82j2-j2ch-gfr8","severity":"high","message":"rustls-webpki@0.103.6 (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.6 (crates.io):GHSA-82j2-j2ch-gfr8"},{"rule_id":"osv/GHSA-gchp-q4r4-x4ff","severity":"high","message":"tar@0.4.44 (crates.io) is affected by RUSTSEC-2026-0068, GHSA-gchp-q4r4-x4ff","path":"Cargo.lock","line":null,"fingerprint":"tar@0.4.44 (crates.io):GHSA-gchp-q4r4-x4ff"},{"rule_id":"osv/GHSA-xphw-cqx3-667j","severity":"high","message":"thin-vec@0.2.14 (crates.io) is affected by RUSTSEC-2026-0103, GHSA-xphw-cqx3-667j","path":"cargo-modules/Cargo.lock","line":null,"fingerprint":"thin-vec@0.2.14 (crates.io):GHSA-xphw-cqx3-667j"},{"rule_id":"osv/RUSTSEC-2026-0190","severity":"medium","message":"anyhow@1.0.100 (crates.io) is affected by RUSTSEC-2026-0190","path":"Cargo.lock","line":null,"fingerprint":"anyhow@1.0.100 (crates.io):RUSTSEC-2026-0190"},{"rule_id":"osv/GHSA-434x-w66g-qw3r","severity":"medium","message":"bytes@1.10.1 (crates.io) is affected by RUSTSEC-2026-0007, GHSA-434x-w66g-qw3r","path":"Cargo.lock","line":null,"fingerprint":"bytes@1.10.1 (crates.io):GHSA-434x-w66g-qw3r"},{"rule_id":"osv/RUSTSEC-2026-0204","severity":"medium","message":"crossbeam-epoch@0.9.18 (crates.io) is affected by RUSTSEC-2026-0204; also in cargo-modules/Cargo.lock","path":"Cargo.lock","line":null,"fingerprint":"crossbeam-epoch@0.9.18 (crates.io):RUSTSEC-2026-0204"},{"rule_id":"osv/RUSTSEC-2026-0183","severity":"medium","message":"git2@0.20.2 (crates.io) is affected by RUSTSEC-2026-0183","path":"Cargo.lock","line":null,"fingerprint":"git2@0.20.2 (crates.io):RUSTSEC-2026-0183"},{"rule_id":"osv/RUSTSEC-2026-0184","severity":"medium","message":"git2@0.20.2 (crates.io) is affected by RUSTSEC-2026-0184","path":"Cargo.lock","line":null,"fingerprint":"git2@0.20.2 (crates.io):RUSTSEC-2026-0184"},{"rule_id":"osv/RUSTSEC-2026-0258","severity":"medium","message":"h2@0.4.12 (crates.io) is affected by RUSTSEC-2026-0258","path":"Cargo.lock","line":null,"fingerprint":"h2@0.4.12 (crates.io):RUSTSEC-2026-0258"},{"rule_id":"osv/RUSTSEC-2022-0081","severity":"medium","message":"json@0.12.4 (crates.io) is affected by RUSTSEC-2022-0081; also in cargo-modules/Cargo.lock","path":"Cargo.lock","line":null,"fingerprint":"json@0.12.4 (crates.io):RUSTSEC-2022-0081"},{"rule_id":"osv/RUSTSEC-2026-0418","severity":"medium","message":"libz-sys@1.1.22 (crates.io) is affected by RUSTSEC-2026-0418","path":"Cargo.lock","line":null,"fingerprint":"libz-sys@1.1.22 (crates.io):RUSTSEC-2026-0418"},{"rule_id":"osv/RUSTSEC-2026-0253","severity":"medium","message":"lru@0.12.5 (crates.io) is affected by RUSTSEC-2026-0253","path":"Cargo.lock","line":null,"fingerprint":"lru@0.12.5 (crates.io):RUSTSEC-2026-0253"},{"rule_id":"osv/RUSTSEC-2026-0186","severity":"medium","message":"memmap2@0.9.8 (crates.io) is affected by RUSTSEC-2026-0186","path":"Cargo.lock","line":null,"fingerprint":"memmap2@0.9.8 (crates.io):RUSTSEC-2026-0186"},{"rule_id":"osv/GHSA-xv59-967r-8726","severity":"medium","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0476, GHSA-xv59-967r-8726","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-xv59-967r-8726"},{"rule_id":"osv/GHSA-phqj-4mhp-q6mq","severity":"medium","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0477, GHSA-phqj-4mhp-q6mq","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-phqj-4mhp-q6mq"},{"rule_id":"osv/RUSTSEC-2024-0436","severity":"medium","message":"paste@1.0.15 (crates.io) is affected by RUSTSEC-2024-0436","path":"Cargo.lock","line":null,"fingerprint":"paste@1.0.15 (crates.io):RUSTSEC-2024-0436"},{"rule_id":"osv/RUSTSEC-2026-0441","severity":"medium","message":"pin-utils@0.1.0 (crates.io) is affected by RUSTSEC-2026-0441","path":"Cargo.lock","line":null,"fingerprint":"pin-utils@0.1.0 (crates.io):RUSTSEC-2026-0441"},{"rule_id":"osv/GHSA-cq8v-f236-94qc","severity":"medium","message":"rand@0.8.5 (crates.io) is affected by RUSTSEC-2026-0097, GHSA-cq8v-f236-94qc","path":"Cargo.lock","line":null,"fingerprint":"rand@0.8.5 (crates.io):GHSA-cq8v-f236-94qc"},{"rule_id":"osv/RUSTSEC-2026-0462","severity":"medium","message":"rmcp@0.8.0 (crates.io) is affected by RUSTSEC-2026-0462","path":"Cargo.lock","line":null,"fingerprint":"rmcp@0.8.0 (crates.io):RUSTSEC-2026-0462"},{"rule_id":"osv/GHSA-9g45-5xwm-f3wc","severity":"medium","message":"rmcp@0.8.0 (crates.io) is affected by GHSA-9g45-5xwm-f3wc","path":"Cargo.lock","line":null,"fingerprint":"rmcp@0.8.0 (crates.io):GHSA-9g45-5xwm-f3wc"},{"rule_id":"osv/GHSA-c9xm-49cp-xcr9","severity":"medium","message":"rmcp@0.8.0 (crates.io) is affected by GHSA-c9xm-49cp-xcr9","path":"Cargo.lock","line":null,"fingerprint":"rmcp@0.8.0 (crates.io):GHSA-c9xm-49cp-xcr9"},{"rule_id":"osv/RUSTSEC-2026-0486","severity":"medium","message":"rustix@1.1.2 (crates.io) is affected by RUSTSEC-2026-0486","path":"Cargo.lock","line":null,"fingerprint":"rustix@1.1.2 (crates.io):RUSTSEC-2026-0486"},{"rule_id":"osv/GHSA-2mjx-qc3c-rqvc","severity":"medium","message":"rustls@0.23.32 (crates.io) is affected by RUSTSEC-2026-0285, GHSA-2mjx-qc3c-rqvc","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.32 (crates.io):GHSA-2mjx-qc3c-rqvc"},{"rule_id":"osv/GHSA-c8m5-c952-6cm4","severity":"medium","message":"rustls@0.23.32 (crates.io) is affected by RUSTSEC-2026-0346, GHSA-c8m5-c952-6cm4","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.32 (crates.io):GHSA-c8m5-c952-6cm4"},{"rule_id":"osv/GHSA-pwjx-qhcg-rvj4","severity":"medium","message":"rustls-webpki@0.103.6 (crates.io) is affected by RUSTSEC-2026-0049, GHSA-pwjx-qhcg-rvj4","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.6 (crates.io):GHSA-pwjx-qhcg-rvj4"},{"rule_id":"osv/RUSTSEC-2026-0382","severity":"medium","message":"rustls-webpki@0.103.6 (crates.io) is affected by RUSTSEC-2026-0382","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.6 (crates.io):RUSTSEC-2026-0382"},{"rule_id":"osv/GHSA-j4xf-2g29-59ph","severity":"medium","message":"tar@0.4.44 (crates.io) is affected by RUSTSEC-2026-0067, GHSA-j4xf-2g29-59ph","path":"Cargo.lock","line":null,"fingerprint":"tar@0.4.44 (crates.io):GHSA-j4xf-2g29-59ph"},{"rule_id":"osv/GHSA-3pv8-6f4r-ffg2","severity":"medium","message":"tar@0.4.44 (crates.io) is affected by GHSA-3pv8-6f4r-ffg2","path":"Cargo.lock","line":null,"fingerprint":"tar@0.4.44 (crates.io):GHSA-3pv8-6f4r-ffg2"},{"rule_id":"osv/GHSA-r6v5-fh4h-64xc","severity":"medium","message":"time@0.3.44 (crates.io) is affected by RUSTSEC-2026-0009, GHSA-r6v5-fh4h-64xc","path":"Cargo.lock","line":null,"fingerprint":"time@0.3.44 (crates.io):GHSA-r6v5-fh4h-64xc"},{"rule_id":"osv/RUSTSEC-2026-0386","severity":"medium","message":"tokio@1.47.1 (crates.io) is affected by RUSTSEC-2026-0386","path":"Cargo.lock","line":null,"fingerprint":"tokio@1.47.1 (crates.io):RUSTSEC-2026-0386"},{"rule_id":"osv/RUSTSEC-2026-0391","severity":"medium","message":"zstd@0.13.3 (crates.io) is affected by RUSTSEC-2026-0391","path":"Cargo.lock","line":null,"fingerprint":"zstd@0.13.3 (crates.io):RUSTSEC-2026-0391"},{"rule_id":"osv/RUSTSEC-2026-0395","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0395","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0395"},{"rule_id":"osv/RUSTSEC-2026-0396","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0396","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0396"},{"rule_id":"osv/RUSTSEC-2026-0397","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0397","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0397"},{"rule_id":"osv/RUSTSEC-2026-0398","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0398","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0398"},{"rule_id":"osv/RUSTSEC-2026-0399","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0399","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0399"},{"rule_id":"osv/RUSTSEC-2026-0400","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0400","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0400"},{"rule_id":"osv/RUSTSEC-2026-0401","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0401","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0401"},{"rule_id":"osv/RUSTSEC-2026-0402","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0402","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0402"},{"rule_id":"osv/RUSTSEC-2026-0403","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0403","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0403"},{"rule_id":"osv/RUSTSEC-2026-0404","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0404","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0404"},{"rule_id":"osv/RUSTSEC-2026-0405","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0405","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0405"},{"rule_id":"osv/RUSTSEC-2026-0406","severity":"medium","message":"zstd-safe@7.2.4 (crates.io) is affected by RUSTSEC-2026-0406","path":"Cargo.lock","line":null,"fingerprint":"zstd-safe@7.2.4 (crates.io):RUSTSEC-2026-0406"},{"rule_id":"osv/RUSTSEC-2026-0410","severity":"medium","message":"zstd-sys@2.0.16+zstd.1.5.7 (crates.io) is affected by RUSTSEC-2026-0410","path":"Cargo.lock","line":null,"fingerprint":"zstd-sys@2.0.16+zstd.1.5.7 (crates.io):RUSTSEC-2026-0410"},{"rule_id":"osv/RUSTSEC-2026-0190","severity":"medium","message":"anyhow@1.0.97 (crates.io) is affected by RUSTSEC-2026-0190","path":"cargo-modules/Cargo.lock","line":null,"fingerprint":"anyhow@1.0.97 (crates.io):RUSTSEC-2026-0190"},{"rule_id":"osv/GHSA-j39j-6gw9-jw6h","severity":"low","message":"git2@0.20.2 (crates.io) is affected by RUSTSEC-2026-0008, GHSA-j39j-6gw9-jw6h","path":"Cargo.lock","line":null,"fingerprint":"git2@0.20.2 (crates.io):GHSA-j39j-6gw9-jw6h"},{"rule_id":"osv/GHSA-rhfx-m35p-ff5j","severity":"low","message":"lru@0.12.5 (crates.io) is affected by RUSTSEC-2026-0002, GHSA-rhfx-m35p-ff5j","path":"Cargo.lock","line":null,"fingerprint":"lru@0.12.5 (crates.io):GHSA-rhfx-m35p-ff5j"},{"rule_id":"osv/GHSA-xmgf-hq76-4vx2","severity":"low","message":"openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0479, GHSA-xmgf-hq76-4vx2","path":"Cargo.lock","line":null,"fingerprint":"openssl@0.10.73 (crates.io):GHSA-xmgf-hq76-4vx2"},{"rule_id":"osv/GHSA-h2v8-394m-p7vv","severity":"low","message":"rustls@0.23.32 (crates.io) is affected by RUSTSEC-2026-0348, GHSA-h2v8-394m-p7vv","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.32 (crates.io):GHSA-h2v8-394m-p7vv"},{"rule_id":"osv/GHSA-w44r-93j7-qv28","severity":"low","message":"rustls@0.23.32 (crates.io) is affected by RUSTSEC-2026-0349, GHSA-w44r-93j7-qv28","path":"Cargo.lock","line":null,"fingerprint":"rustls@0.23.32 (crates.io):GHSA-w44r-93j7-qv28"},{"rule_id":"osv/GHSA-965h-392x-2mh5","severity":"low","message":"rustls-webpki@0.103.6 (crates.io) is affected by RUSTSEC-2026-0098, GHSA-965h-392x-2mh5","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.6 (crates.io):GHSA-965h-392x-2mh5"},{"rule_id":"osv/GHSA-xgp8-3hg3-c2mh","severity":"low","message":"rustls-webpki@0.103.6 (crates.io) is affected by RUSTSEC-2026-0099, GHSA-xgp8-3hg3-c2mh","path":"Cargo.lock","line":null,"fingerprint":"rustls-webpki@0.103.6 (crates.io):GHSA-xgp8-3hg3-c2mh"},{"rule_id":"osv/GHSA-xwfj-jgwm-7wp5","severity":"low","message":"tracing-subscriber@0.3.19 (crates.io) is affected by RUSTSEC-2025-0055, GHSA-xwfj-jgwm-7wp5","path":"cargo-modules/Cargo.lock","line":null,"fingerprint":"tracing-subscriber@0.3.19 (crates.io):GHSA-xwfj-jgwm-7wp5"}],"evidence":[],"data":{"ecosystems":["crates.io"]},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":4.0,"findings":23.0,"findings_high":17.0,"findings_medium":6.0,"findings_low":0.0,"penalty":206.4},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-code-review.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/claude-code-review.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude-code-review.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/claude-code-review.yml:33"},{"rule_id":"zizmor/dangerous-triggers","severity":"high","message":"use of fundamentally insecure workflow trigger [confidence medium]","path":".github/workflows/claude.yml","line":4,"fingerprint":"dangerous-triggers:.github/workflows/claude.yml:4"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude.yml","line":32,"fingerprint":"unpinned-uses:.github/workflows/claude.yml:32"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/claude.yml","line":38,"fingerprint":"unpinned-uses:.github/workflows/claude.yml:38"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/nix.yml","line":19,"fingerprint":"unpinned-uses:.github/workflows/nix.yml:19"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/nix.yml","line":21,"fingerprint":"unpinned-uses:.github/workflows/nix.yml:21"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/nix.yml","line":23,"fingerprint":"unpinned-uses:.github/workflows/nix.yml:23"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":24,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:24"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":27,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:27"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":33,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:33"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":61,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:61"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":64,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:64"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":69,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:69"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":94,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:94"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":97,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:97"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/rust.yml","line":102,"fingerprint":"unpinned-uses:.github/workflows/rust.yml:102"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/claude-code-review.yml","line":26,"fingerprint":"artipacked:.github/workflows/claude-code-review.yml:26"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/claude.yml","line":31,"fingerprint":"artipacked:.github/workflows/claude.yml:31"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/nix.yml","line":19,"fingerprint":"artipacked:.github/workflows/nix.yml:19"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/rust.yml","line":24,"fingerprint":"artipacked:.github/workflows/rust.yml:24"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/rust.yml","line":61,"fingerprint":"artipacked:.github/workflows/rust.yml:61"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/rust.yml","line":94,"fingerprint":"artipacked:.github/workflows/rust.yml:94"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":1.0,"check:lockfiles":0.0,"signed_commit_share":0.5357,"unpinned_manifests":2.0},"findings":[],"evidence":[{"kind":"posture","description":"patches/ra_ap_project_model/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"patches/ra_ap_project_model/Cargo.toml","url":null,"weight":0.3},{"kind":"posture","description":"rust-docs-mcp/Cargo.toml has no lockfile alongside it (unpinned dependencies)","ref":"rust-docs-mcp/Cargo.toml","url":null,"weight":0.3}],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":808.0,"function_nloc":14932.0,"mean_ccn":3.43,"p90_ccn":8.0,"complex_functions":25.0,"long_functions":15.0,"many_param_functions":4.0,"risky_nloc_share":0.2111},"findings":[],"evidence":[{"kind":"complex-function","description":"download_crate in rust-docs-mcp/src/cache/downloader.rs: complexity 42, 170 lines","ref":"rust-docs-mcp/src/cache/downloader.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/downloader.rs#L190","weight":0.7},{"kind":"complex-function","description":"download_from_github in rust-docs-mcp/src/cache/downloader.rs: complexity 34, 134 lines","ref":"rust-docs-mcp/src/cache/downloader.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/downloader.rs#L416","weight":0.5666666666666667},{"kind":"complex-function","description":"cargo_to_crate_graph in patches/ra_ap_project_model/src/workspace.rs: complexity 33, 156 lines","ref":"patches/ra_ap_project_model/src/workspace.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/workspace.rs#L1142","weight":0.55},{"kind":"complex-function","description":"generate in rust-docs-mcp/src/cache/docgen.rs: complexity 33, 78 lines","ref":"rust-docs-mcp/src/cache/docgen.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/docgen.rs#L124","weight":0.55},{"kind":"complex-function","description":"fetch_metadata_ in patches/ra_ap_project_model/src/cargo_workspace.rs: complexity 30, 141 lines","ref":"patches/ra_ap_project_model/src/cargo_workspace.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/cargo_workspace.rs#L363","weight":0.5},{"kind":"complex-function","description":"format_task_list in rust-docs-mcp/src/cache/task_formatter.rs: complexity 26, 86 lines","ref":"rust-docs-mcp/src/cache/task_formatter.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/task_formatter.rs#L250","weight":0.43333333333333335},{"kind":"complex-function","description":"run in rust-docs-mcp/src/cache_cli.rs: complexity 26, 95 lines","ref":"rust-docs-mcp/src/cache_cli.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache_cli.rs#L182","weight":0.43333333333333335},{"kind":"complex-function","description":"call_output in rust-docs-mcp/src/cli.rs: complexity 25, 57 lines","ref":"rust-docs-mcp/src/cli.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cli.rs#L85","weight":0.4166666666666667},{"kind":"complex-function","description":"walk_and_push_ty in cargo-modules/src/graph/builder.rs: complexity 24, 118 lines","ref":"cargo-modules/src/graph/builder.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/cargo-modules/src/graph/builder.rs#L600","weight":0.4},{"kind":"complex-function","description":"run_cargo_rustdoc_json_with_options in rust-docs-mcp/src/rustdoc.rs: complexity 24, 124 lines","ref":"rust-docs-mcp/src/rustdoc.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/rustdoc.rs#L424","weight":0.4}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":16204.0,"duplicated_lines":1436.0,"duplicated_share":0.0886,"files":72.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: cargo-modules/src/analyzer.rs:745 and cargo-modules/src/analyzer.rs:769","ref":"cargo-modules/src/analyzer.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/cargo-modules/src/analyzer.rs#L745","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cargo-modules/src/graph/builder.rs:64 and cargo-modules/src/tree/builder.rs:34","ref":"cargo-modules/src/graph/builder.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/cargo-modules/src/graph/builder.rs#L64","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: cargo-modules/src/graph/builder.rs:328 and cargo-modules/src/graph/builder.rs:355","ref":"cargo-modules/src/graph/builder.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/cargo-modules/src/graph/builder.rs#L328","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: patches/ra_ap_project_model/src/cargo_workspace.rs:336 and patches/ra_ap_project_model/src/cargo_workspace.rs:364","ref":"patches/ra_ap_project_model/src/cargo_workspace.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/cargo_workspace.rs#L336","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: patches/ra_ap_project_model/src/toolchain_info/rustc_cfg.rs:98 and patches/ra_ap_project_model/src/toolchain_info/target_data_layout.rs:55","ref":"patches/ra_ap_project_model/src/toolchain_info/rustc_cfg.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/toolchain_info/rustc_cfg.rs#L98","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: patches/ra_ap_project_model/src/toolchain_info/target_data_layout.rs:65 and patches/ra_ap_project_model/src/toolchain_info/target_tuple.rs:89","ref":"patches/ra_ap_project_model/src/toolchain_info/target_data_layout.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/toolchain_info/target_data_layout.rs#L65","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: patches/ra_ap_project_model/src/workspace.rs:258 and patches/ra_ap_project_model/src/workspace.rs:428","ref":"patches/ra_ap_project_model/src/workspace.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/patches/ra_ap_project_model/src/workspace.rs#L258","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust-docs-mcp/src/analysis/outputs.rs:30 and rust-docs-mcp/src/cache/outputs.rs:81","ref":"rust-docs-mcp/src/analysis/outputs.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/analysis/outputs.rs#L30","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust-docs-mcp/src/cache/downloader.rs:202 and rust-docs-mcp/src/cache/downloader.rs:426","ref":"rust-docs-mcp/src/cache/downloader.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/downloader.rs#L202","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: rust-docs-mcp/src/cache/service.rs:95 and rust-docs-mcp/src/cache/service.rs:108","ref":"rust-docs-mcp/src/cache/service.rs","url":"https://github.com/snowmead/rust-docs-mcp/blob/8c89df058f3be23db74435569c63fa8d08601767/rust-docs-mcp/src/cache/service.rs#L95","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":0.0,"weighted_findings":0.0,"scanned_lines":22820.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.2986,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":0.9067,"test_lines":3407.0,"source_lines":22820.0,"test_ratio":0.1493,"ci_files":4.0,"cochange_share":0.2267,"cochange_commits":75.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/claude-code-review.yml","ref":".github/workflows/claude-code-review.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/claude.yml","ref":".github/workflows/claude.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/nix.yml","ref":".github/workflows/nix.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI config: .github/workflows/rust.yml","ref":".github/workflows/rust.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (go test, cargo test)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (clippy, rustfmt, cargo fmt)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["go test","cargo test"],"lint_commands":["clippy","rustfmt","cargo fmt"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":1.0,"check:changelog":1.0,"readme_lines":285.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0},{"kind":"docs","description":"docs/CONTRIBUTING.md","ref":"docs/CONTRIBUTING.md","url":null,"weight":0.0},{"kind":"docs","description":"CHANGELOG.md","ref":"CHANGELOG.md","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":13144.0,"other_lines":9676.0,"files_blamed":72.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:ai_per_kloc":0.0,"quality:other_findings":0.0,"quality:other_per_kloc":0.0,"security:ai_findings":7.0,"security:ai_per_kloc":0.533,"security:other_findings":2.0,"security:other_per_kloc":0.207,"security:ratio":2.57},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":true},"error":null}],"flags":[]}