Leaderboard github.com
Cossey/mqtt-ai-tool
Node.js service that processes MQTT tasks, gathers context, runs AI prompts, and publishes outputs.
AI provenance
0%
possible
- Confidence
- 49%
- Coverage
- 100%
Estimated share of AI-generated code. Explicit attribution is a lower bound.
Code quality
74/100
adequate
- Confidence
- 90%
- Coverage
- 100%
Complexity, duplication, lint density, tests, CI, docs and review process.
Security
51/100
weak
- Confidence
- 85%
- Coverage
- 100%
Secrets, static analysis, vulnerable dependencies, CI and supply-chain posture.
AI provenance
0% possible
Weak signals consistent with AI-assisted development.
How the score is built
- Explicitly attributed share0%
- Unattributed share in AI-pace bursts0%
- Estimated AI-generated share0%
- AI tool configuration files1
- Work sessions at AI pace0
- Releases at AI pacenot measured
- Coding-style index (1.0+ means possible)0.00
Lines added per month all AI-attributed share
- 2026-012,735 · 0% AI
- 2026-021,942 · 0% AI
- 2026-04514 · 0% AI
- 2026-052,384 · 0% AI
Evidence by analyzer
Explicit AI attributionok
- attributed_commit_share
- 0.0%
- attributed_commits
- 0
- attributed_loc
- 0
- attributed_loc_share
- 0.0%
- commits
- 37
- effective_loc
- 7,575
- tools_detected
- 0
AI tool configurationok1 item
- artifacts
- 1
- earliest_adoption
- 2026-05-04
- tools_configured
- 1
- workflow_agents
- 0
Commit velocityok
- excluded_import_loc
- 0
- flagged_loc
- 0
- flagged_loc_share
- 0.0%
- flagged_units
- 0
- max_loc_per_hour
- 494.01
- measured_loc
- 7,575
- median_loc_per_hour
- 128.50
- pr_timed_units
- 0
- pre_ai_era_burst_loc
- 0
- pre_ai_era_bursts
- 0
- pre_ai_era_measured_loc
- 0
- work_units
- 19
Release velocityskipped
Coding styleok
- count:assistant_voice
- 0
- count:emoji_in_code
- 0
- count:narrated_steps
- 0
- count:placeholder
- 0
- files:assistant_voice
- 0
- files:emoji_in_code
- 0
- files:narrated_steps
- 0
- files:placeholder
- 0
- index
- 0
- lines_scanned
- 4,123
- per_kloc:assistant_voice
- 0
- per_kloc:emoji_in_code
- 0
- per_kloc:narrated_steps
- 0
- per_kloc:placeholder
- 0
Code quality
74 adequate
Code quality is adequate: test-to-source ratio 0.59, CI runs tests; 43% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.
How the score is built
- Complexity27
- Duplication98
- Lint and smells94
- Tests and CI90
- Documentation65
- Type safety60
- Review processnot measured
Evidence by analyzer
Complexity (lizard)ok10 items
- processPayload in src/app.ts: complexity 89, 266 lines
- processLoaderItem in src/app.ts: complexity 82, 279 lines
- processPromptsConfig in src/config/config.ts: complexity 68, 117 lines
- loadConfigFromPath in src/config/config.ts: complexity 54, 120 lines
- publishEntityForPath in src/app.ts: complexity 27, 83 lines
- extractStructuredFromAiResponse in src/utils/promptUtils.ts: complexity 25, 36 lines
- parseJsonControlCommand in src/app.ts: complexity 24, 47 lines
- enqueueInput in src/app.ts: complexity 24, 49 lines
- parseTextControlCommand in src/app.ts: complexity 24, 52 lines
- publishHaDiscovery in src/app.ts: complexity 23, 94 lines
- complex_functions
- 13
- function_nloc
- 3,045
- functions
- 211
- long_functions
- 4
- many_param_functions
- 0
- mean_ccn
- 5.44
- p90_ccn
- 12
- risky_nloc_share
- 43.1%
Duplication (jscpd)ok1 item
- compared_lines
- 2,792
- duplicated_lines
- 12
- duplicated_share
- 0.4%
- files
- 11
Lintok
- category:correctness
- 4
- findings
- 4
- scanned_lines
- 4,123
- weighted_findings
- 1
Tests and CIok3 items
- CI config: .github/workflows/docker.build.yml
.github/workflows/docker.build.yml - CI config: .github/workflows/node.build.yml
.github/workflows/node.build.yml - CI runs tests (npm test)
- check:ci_present
- yes
- check:ci_runs_lint
- no
- check:ci_runs_tests
- yes
- check:has_tests
- yes
- check:test_ratio
- yes
- check:tests_cochange
- yes
- ci_files
- 2
- cochange_commits
- 26
- cochange_share
- 65.4%
- source_lines
- 4,123
- test_lines
- 2,447
- test_ratio
- 0.59
Documentationok2 items
- README.md
README.md - LICENSE
LICENSE
- check:changelog
- no
- check:contributing
- no
- check:license
- yes
- check:readme
- yes
- readme_lines
- 532
Type safetyok1 item
- TypeScript strict type checking: tsconfig.json
tsconfig.json
- check:low_escape_density
- no
- check:strict_config
- yes
- escapes
- 63
- escapes_per_kloc
- 15.30
Security
51 weak
Security posture is weak: 61 known vulnerabilities in 14 dependencies; 6 high-severity workflow issues. Weakest area: dependencies.
How the score is built
- Secrets100
- Static analysis (SAST)58
- Vulnerable dependencies18
- CI workflows27
- Security posture20
- OpenSSF Scorecardnot measured
Evidence by analyzer
OpenSSF Scorecardskipped
no published OpenSSF Scorecard result for this repo
Package registriesok
- checked
- 15
- declared
- 15
- lookup_errors
- 0
- missing
- 0
- recent
- 0
Secrets (gitleaks)ok
- secrets_current
- 0
- secrets_history
- 0
- secrets_low_confidence
- 0
- secrets_nonprod
- 0
Static analysis (opengrep)ok
- findings
- 26
- findings_high
- 0
- findings_low
- 0
- findings_medium
- 26
- parse_errors
- 0
- scanned_lines
- 4,123
- weighted_findings
- 6.50
Dependencies (osv-scanner)ok
- penalty
- 102
- vulnerabilities
- 61
- vulnerable_packages
- 14
- vulns_critical
- 2
- vulns_high
- 29
- vulns_low
- 1
- vulns_medium
- 29
- vulns_unknown
- 0
CI workflows (zizmor)ok
- findings
- 10
- findings_high
- 6
- findings_low
- 0
- findings_medium
- 4
- penalty
- 79.20
- workflows
- 2
Security postureok
- check:dependency_updates
- no
- check:lockfiles
- yes
- check:security_policy
- no
- check:signed_commits
- yes
- signed_commit_share
- 100.0%
- unpinned_manifests
- 0
Release downloadsok
- binary_assets
- 0
- signals
- 0
- suspicious
- 0
Findings
2 critical35 high59 medium5 low
101 findings
| Severity | Rule | Location | Message | Tool |
|---|---|---|---|---|
| critical | osv/GHSA-8r5x-fm3f-whwj |
package-lock.json | [email protected] (npm) is affected by GHSA-8r5x-fm3f-whwj | Dependencies (osv-scanner) |
| critical | osv/GHSA-p8wg-vrv2-v86f |
package-lock.json | [email protected] (npm) is affected by GHSA-p8wg-vrv2-v86f | Dependencies (osv-scanner) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.build.yml:16 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.build.yml:19 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.build.yml:22 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/docker.build.yml:25 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/node.build.yml:21 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | zizmor/unpinned-uses |
.github/workflows/node.build.yml:23 | unpinned action reference [confidence high] | CI workflows (zizmor) |
| high | osv/GHSA-2883-xcg3-v3hh |
package-lock.json | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-2883-xcg3-v3hh |
package-lock.json | [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh | Dependencies (osv-scanner) |
| high | osv/GHSA-3jxr-9vmj-r5cp |
package-lock.json | [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp | Dependencies (osv-scanner) |
| high | osv/GHSA-3pq3-5fj3-cg6v |
package-lock.json | [email protected] (npm) is affected by GHSA-3pq3-5fj3-cg6v | Dependencies (osv-scanner) |
| high | osv/GHSA-48qf-xh34-q73r |
package-lock.json | [email protected] (npm) is affected by GHSA-48qf-xh34-q73r | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
package-lock.json | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-52cp-r559-cp3m |
package-lock.json | [email protected] (npm) is affected by GHSA-52cp-r559-cp3m | Dependencies (osv-scanner) |
| high | osv/GHSA-542g-h47m-68v8 |
package-lock.json | [email protected] (npm) is affected by GHSA-542g-h47m-68v8 | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
package-lock.json | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-5p4m-2wfm-xmqj |
package-lock.json | [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj | Dependencies (osv-scanner) |
| high | osv/GHSA-6j4f-fj2g-mc7p |
package-lock.json | [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p | Dependencies (osv-scanner) |
| high | osv/GHSA-73wf-gq98-2v4g |
package-lock.json | [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g | Dependencies (osv-scanner) |
| high | osv/GHSA-8r9p-f939-6h3c |
package-lock.json | [email protected] (npm) is affected by GHSA-8r9p-f939-6h3c | Dependencies (osv-scanner) |
| high | osv/GHSA-96hv-2xvq-fx4p |
package-lock.json | [email protected] (npm) is affected by GHSA-96hv-2xvq-fx4p | Dependencies (osv-scanner) |
| high | osv/GHSA-c83g-rgw3-j3cx |
package-lock.json | [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx | Dependencies (osv-scanner) |
| high | osv/GHSA-cqhc-2h57-wpxf |
package-lock.json | [email protected] (npm) is affected by GHSA-cqhc-2h57-wpxf | Dependencies (osv-scanner) |
| high | osv/GHSA-gcfj-64vw-6mp9 |
package-lock.json | [email protected] (npm) is affected by GHSA-gcfj-64vw-6mp9 | Dependencies (osv-scanner) |
| high | osv/GHSA-hmw2-7cc7-3qxx |
package-lock.json | [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx | Dependencies (osv-scanner) |
| high | osv/GHSA-m8m8-qj5v-23w3 |
package-lock.json | [email protected] (npm) is affected by GHSA-m8m8-qj5v-23w3 | Dependencies (osv-scanner) |
| high | osv/GHSA-mghh-pgcx-3jjj |
package-lock.json | [email protected] (npm) is affected by GHSA-mghh-pgcx-3jjj | Dependencies (osv-scanner) |
| high | osv/GHSA-mh99-v99m-4gvg |
package-lock.json | [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg | Dependencies (osv-scanner) |
| high | osv/GHSA-mrwp-f3q8-3g9p |
package-lock.json | [email protected] (npm) is affected by GHSA-mrwp-f3q8-3g9p | Dependencies (osv-scanner) |
| high | osv/GHSA-mwp4-54f8-5fhr |
package-lock.json | [email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr | Dependencies (osv-scanner) |
| high | osv/GHSA-q3jh-wrc6-jgq8 |
package-lock.json | [email protected] (npm) is affected by GHSA-q3jh-wrc6-jgq8 | Dependencies (osv-scanner) |
| high | osv/GHSA-qhr7-859c-m2p7 |
package-lock.json | [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 | Dependencies (osv-scanner) |
| high | osv/GHSA-r3rv-jm3r-62q2 |
package-lock.json | [email protected] (npm) is affected by GHSA-r3rv-jm3r-62q2 | Dependencies (osv-scanner) |
| high | osv/GHSA-rgw5-rvv9-x895 |
package-lock.json | [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 | Dependencies (osv-scanner) |
| high | osv/GHSA-v6pj-gxxw-phfw |
package-lock.json | [email protected] (npm) is affected by GHSA-v6pj-gxxw-phfw | Dependencies (osv-scanner) |
| high | osv/GHSA-x97p-jq2g-jp4f |
package-lock.json | [email protected] (npm) is affected by GHSA-x97p-jq2g-jp4f | Dependencies (osv-scanner) |
| medium | zizmor/excessive-permissions |
.github/workflows/docker.build.yml:10 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/docker.build.yml:15 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | zizmor/excessive-permissions |
.github/workflows/node.build.yml:13 | overly broad permissions [confidence medium] | CI workflows (zizmor) |
| medium | zizmor/artipacked |
.github/workflows/node.build.yml:21 | credential persistence through GitHub Actions artifacts [confidence low] | CI workflows (zizmor) |
| medium | osv/GHSA-42h9-826w-cgv3 |
package-lock.json | [email protected] (npm) is affected by GHSA-42h9-826w-cgv3 | Dependencies (osv-scanner) |
| medium | osv/GHSA-42r5-vhpq-m858 |
package-lock.json | [email protected] (npm) is affected by GHSA-42r5-vhpq-m858 | Dependencies (osv-scanner) |
| medium | osv/GHSA-44g4-m2mj-wpvx |
package-lock.json | [email protected] (npm) is affected by GHSA-44g4-m2mj-wpvx | Dependencies (osv-scanner) |
| medium | osv/GHSA-4hqw-qxg8-jxx2 |
package-lock.json | [email protected] (npm) is affected by GHSA-4hqw-qxg8-jxx2 | Dependencies (osv-scanner) |
| medium | osv/GHSA-58qx-3vcg-4xpx |
package-lock.json | [email protected] (npm) is affected by GHSA-58qx-3vcg-4xpx | Dependencies (osv-scanner) |
| medium | osv/GHSA-7q8q-rj6j-mhjq |
package-lock.json | [email protected] (npm) is affected by GHSA-7q8q-rj6j-mhjq | Dependencies (osv-scanner) |
| medium | osv/GHSA-9fr6-4gfg-395g |
package-lock.json | [email protected] (npm) is affected by GHSA-9fr6-4gfg-395g | Dependencies (osv-scanner) |
| medium | osv/GHSA-cx2f-j9fh-8g68 |
package-lock.json | [email protected] (npm) is affected by GHSA-cx2f-j9fh-8g68 | Dependencies (osv-scanner) |
| medium | osv/GHSA-f4gw-2p7v-4548 |
package-lock.json | [email protected] (npm) is affected by GHSA-f4gw-2p7v-4548 | Dependencies (osv-scanner) |
| medium | osv/GHSA-g5xc-5w98-jfvm |
package-lock.json | [email protected] (npm) is affected by GHSA-g5xc-5w98-jfvm | Dependencies (osv-scanner) |
| medium | osv/GHSA-gcqx-w48m-w2h4 |
package-lock.json | [email protected] (npm) is affected by GHSA-gcqx-w48m-w2h4 | Dependencies (osv-scanner) |
| medium | osv/GHSA-h3mg-xc3c-68pw |
package-lock.json | [email protected] (npm) is affected by GHSA-h3mg-xc3c-68pw | Dependencies (osv-scanner) |
| medium | osv/GHSA-h67p-54hq-rp68 |
package-lock.json | [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 | Dependencies (osv-scanner) |
| medium | osv/GHSA-h67p-54hq-rp68 |
package-lock.json | [email protected] (npm) is affected by GHSA-h67p-54hq-rp68 | Dependencies (osv-scanner) |
| medium | osv/GHSA-hcpx-6fm6-wx23 |
package-lock.json | [email protected] (npm) is affected by GHSA-hcpx-6fm6-wx23 | Dependencies (osv-scanner) |
| medium | osv/GHSA-j6r3-76f7-8jcv |
package-lock.json | [email protected] (npm) is affected by GHSA-j6r3-76f7-8jcv | Dependencies (osv-scanner) |
| medium | osv/GHSA-j8rh-479h-cp32 |
package-lock.json | [email protected] (npm) is affected by GHSA-j8rh-479h-cp32 | Dependencies (osv-scanner) |
| medium | osv/GHSA-jqh4-m9w3-8hp9 |
package-lock.json | [email protected] (npm) is affected by GHSA-jqh4-m9w3-8hp9 | Dependencies (osv-scanner) |
| medium | osv/GHSA-mmx7-hfxf-jppx |
package-lock.json | [email protected] (npm) is affected by GHSA-mmx7-hfxf-jppx | Dependencies (osv-scanner) |
| medium | osv/GHSA-mwf2-3pr3-8698 |
package-lock.json | [email protected] (npm) is affected by GHSA-mwf2-3pr3-8698 | Dependencies (osv-scanner) |
| medium | osv/GHSA-pmv8-rq9r-6j72 |
package-lock.json | [email protected] (npm) is affected by GHSA-pmv8-rq9r-6j72 | Dependencies (osv-scanner) |
| medium | osv/GHSA-q2hr-2g5m-vwhr |
package-lock.json | [email protected] (npm) is affected by GHSA-q2hr-2g5m-vwhr | Dependencies (osv-scanner) |
| medium | osv/GHSA-rpw4-54j3-4h4q |
package-lock.json | [email protected] (npm) is affected by GHSA-rpw4-54j3-4h4q | Dependencies (osv-scanner) |
| medium | osv/GHSA-rxp7-6hxx-x8q5 |
package-lock.json | [email protected] (npm) is affected by GHSA-rxp7-6hxx-x8q5 | Dependencies (osv-scanner) |
| medium | osv/GHSA-v2v4-37r5-5v8g |
package-lock.json | [email protected] (npm) is affected by GHSA-v2v4-37r5-5v8g | Dependencies (osv-scanner) |
| medium | osv/GHSA-vh66-26gq-q6x8 |
package-lock.json | [email protected] (npm) is affected by GHSA-vh66-26gq-q6x8 | Dependencies (osv-scanner) |
| medium | osv/GHSA-w5vr-8v7q-w6rv |
package-lock.json | [email protected] (npm) is affected by GHSA-w5vr-8v7q-w6rv | Dependencies (osv-scanner) |
| medium | osv/GHSA-xj6q-8x83-jv6g |
package-lock.json | [email protected] (npm) is affected by GHSA-xj6q-8x83-jv6g | Dependencies (osv-scanner) |
| medium | osv/GHSA-xw65-4hp5-5hc7 |
package-lock.json | [email protected] (npm) is affected by GHSA-xw65-4hp5-5hc7 | Dependencies (osv-scanner) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1065 | Detected that function argument `loader` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1065 | Detected that function argument `loader` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1112 | Detected that function argument `loader` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1207 | Detected that function argument `loader` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1278 | Detected that function argument `loaderTypeIndex` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1278 | Detected that function argument `loader` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1557 | Detected that function argument `payload` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1630 | Detected that function argument `fp` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1630 | Detected that function argument `fp` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1960 | Detected that function argument `mime` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1960 | Detected that function argument `topic` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:1975 | Detected that function argument `url` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/app.ts:900 | Detected that function argument `configPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/config/config.ts:169 | Detected that function argument `configPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/config/config.ts:173 | Detected that function argument `configPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/config/config.ts:257 | Detected that function argument `configPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/config/config.ts:258 | Detected that function argument `configPath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/aiService.ts:104 | Detected that function argument `filePaths` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/aiService.ts:28 | Detected that function argument `aiName` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/aiService.ts:29 | Detected that function argument `aiName` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/cameraService.ts:148 | Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/cameraService.ts:161 | Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/cameraService.ts:162 | Detected that function argument `options` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/cameraService.ts:224 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.audit.detect-non-literal-fs-filename |
src/services/cameraService.ts:225 | Detected that function argument `filePath` has entered the fs module. An attacker could potentially control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled... | Static analysis (opengrep) |
| medium | opengrep/javascript.lang.security.html-in-template-string |
src/services/mqttService.ts:19 | This template literal looks like HTML and has interpolated variables. These variables are not HTML-encoded by default. If the variables contain HTML tags, these may be interpreted by the browser, resulting in cross-site scripting (XSS).... | Static analysis (opengrep) |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
src/app.ts:254 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
src/app.ts:254 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
src/app.ts:255 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | opengrep/javascript.lang.correctness.missing-template-string-indicator |
src/app.ts:255 | This looks like a JavaScript template string. Are you missing a '$' in front of '{...}'? | Lint |
| low | osv/GHSA-4x5r-pxfx-6jf8 |
package-lock.json | @babel/[email protected] (npm) is affected by GHSA-4x5r-pxfx-6jf8 | Dependencies (osv-scanner) |
Tools and coverage
Every analyzer that ran on this commit. A failed or skipped tool is a coverage gap: its share of the score is left out and the coverage figure drops.
| Analyzer | Pillar | Status | Version | Findings | Note |
|---|---|---|---|---|---|
| AI tool configuration | AI provenance | ok | signatures-v1 | 0 | |
| Explicit AI attribution | AI provenance | ok | signatures-v1 | 0 | |
| Release velocity | AI provenance | skipped | — | 0 | |
| Coding style | AI provenance | ok | — | 0 | |
| Commit velocity | AI provenance | ok | prov-4 | 0 | |
| Complexity (lizard) | Code quality | ok | lizard 1.25.1 | 0 | |
| Documentation | Code quality | ok | — | 0 | |
| Duplication (jscpd) | Code quality | ok | repotrust-dup-w6 | 0 | |
| Lint | Code quality | ok | opengrep 1.33.1; rules f1d2b562b414 | 4 | |
| Tests and CI | Code quality | ok | — | 0 | |
| Type safety | Code quality | ok | — | 0 | |
| CI workflows (zizmor) | Security | ok | zizmor 1.32.0 | 10 | |
| Dependencies (osv-scanner) | Security | ok | osv-scanner version: 2.7.1 | 61 | |
| Release downloads | Security | ok | — | 0 | |
| Security posture | Security | ok | — | 0 | |
| Package registries | Security | ok | — | 0 | |
| Static analysis (opengrep) | Security | ok | opengrep 1.33.1; rules f1d2b562b414 | 26 | |
| OpenSSF Scorecard | Security | skipped | — | 0 | no published OpenSSF Scorecard result for this repo |
| Secrets (gitleaks) | Security | ok | gitleaks 8.30.1 | 0 |
Score history
Scores from different scoring versions aren't directly comparable.
| Scored | Commit | Scoring | AI provenance | Quality | Security |
|---|---|---|---|---|---|
| 2026-11-14 | b319da8f0a1c | prov-5+qual-2+sec-2 | 0% | 74 | 51 |
| 2026-11-14 | b319da8f0a1c | prov-4+qual-2+sec-2 | 0% | 74 | 51 |
Full text report
- Repository: https://github.com/Cossey/mqtt-ai-tool
- Commit:
b319da8f0a1ca67ac7cc0f87b99ce087dd1eb0a2 - Generated: 2026-11-14T14:52:00+00:00
- Scorer 0.1.0, scoring prov-5+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 0 | possible | 49% | 100% |
| Code quality | 74 | adequate | 90% | 100% |
| Security | 51 | weak | 85% | 100% |
AI provenance
Weak signals consistent with AI-assisted development.
-
Explicitly attributed share (lower bound): 0.0%
-
Unattributed share in AI-consistent velocity bursts: 0.0%
-
Estimated AI-generated share: 0.0%
-
AI tooling configured in repo: generic-agent
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-01 | 2,735 | 0% |
| 2026-02 | 1,942 | 0% |
| 2026-04 | 514 | 0% |
| 2026-05 | 2,384 | 0% |
Evidence
- AGENTS.md (generic-agent configuration) (AGENTS.md)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.59, CI runs tests; 43% of function code in complex or long functions; 0% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 27 |
| Duplication | 98 |
| Code smells (Opengrep) | 94 |
| Tests and CI | 90 |
| Documentation | 65 |
| Type safety | 60 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 211; mean complexity 5.4, 90th percentile 12; 13 complex and 4 long functions
- Duplicated lines: 0.4% of 2,792 compared
- Tests: 2,447 test lines for 4,123 source lines (ratio 0.59); CI test commands: npm test; 65% of recent source commits also change tests
- Docs missing or thin: contributing, changelog
Most complex functions:
- processPayload in src/app.ts: complexity 89, 266 lines
- processLoaderItem in src/app.ts: complexity 82, 279 lines
- processPromptsConfig in src/config/config.ts: complexity 68, 117 lines
- loadConfigFromPath in src/config/config.ts: complexity 54, 120 lines
- publishEntityForPath in src/app.ts: complexity 27, 83 lines
Security
Security posture is weak: 61 known vulnerabilities in 14 dependencies; 6 high-severity workflow issues. Weakest area: dependencies.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 58 |
| Vulnerable dependencies (OSV) | 18 |
| CI workflows (zizmor) | 27 |
| Posture (policy, updates, signing, lockfiles) | 20 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 61 in 14 packages (critical 2, high 29, medium 29, low 1)
-
Posture checks passed: signed commits, lockfiles; missing: security policy, dependency updates
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-8r5x-fm3f-whwj: [email protected] (npm) is affected by GHSA-8r5x-fm3f-whwj |
package-lock.json |
| critical | osv/GHSA-p8wg-vrv2-v86f: [email protected] (npm) is affected by GHSA-p8wg-vrv2-v86f |
package-lock.json |
| high | osv/GHSA-3pq3-5fj3-cg6v: [email protected] (npm) is affected by GHSA-3pq3-5fj3-cg6v |
package-lock.json |
| high | osv/GHSA-542g-h47m-68v8: [email protected] (npm) is affected by GHSA-542g-h47m-68v8 |
package-lock.json |
| high | osv/GHSA-gcfj-64vw-6mp9: [email protected] (npm) is affected by GHSA-gcfj-64vw-6mp9 |
package-lock.json |
| high | osv/GHSA-m8m8-qj5v-23w3: [email protected] (npm) is affected by GHSA-m8m8-qj5v-23w3 |
package-lock.json |
| high | osv/GHSA-mghh-pgcx-3jjj: [email protected] (npm) is affected by GHSA-mghh-pgcx-3jjj |
package-lock.json |
| high | osv/GHSA-x97p-jq2g-jp4f: [email protected] (npm) is affected by GHSA-x97p-jq2g-jp4f |
package-lock.json |
| high | osv/GHSA-3jxr-9vmj-r5cp: [email protected] (npm) is affected by GHSA-3jxr-9vmj-r5cp |
package-lock.json |
| high | osv/GHSA-6j4f-fj2g-mc7p: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p |
package-lock.json |
| high | osv/GHSA-mh99-v99m-4gvg: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg |
package-lock.json |
| high | osv/GHSA-qhr7-859c-m2p7: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7 |
package-lock.json |
| high | osv/GHSA-rgw5-rvv9-x895: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895 |
package-lock.json |
| high | osv/GHSA-73wf-gq98-2v4g: [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g |
package-lock.json |
| high | osv/GHSA-c83g-rgw3-j3cx: [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx |
package-lock.json |
| high | osv/GHSA-8r9p-f939-6h3c: [email protected] (npm) is affected by GHSA-8r9p-f939-6h3c |
package-lock.json |
| high | osv/GHSA-mrwp-f3q8-3g9p: [email protected] (npm) is affected by GHSA-mrwp-f3q8-3g9p |
package-lock.json |
| high | osv/GHSA-q3jh-wrc6-jgq8: [email protected] (npm) is affected by GHSA-q3jh-wrc6-jgq8 |
package-lock.json |
| high | osv/GHSA-hmw2-7cc7-3qxx: [email protected] (npm) is affected by GHSA-hmw2-7cc7-3qxx |
package-lock.json |
| high | osv/GHSA-mwp4-54f8-5fhr: [email protected] (npm) is affected by GHSA-mwp4-54f8-5fhr |
package-lock.json |
| high | osv/GHSA-2883-xcg3-v3hh: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh |
package-lock.json |
| high | osv/GHSA-52cp-r559-cp3m: [email protected] (npm) is affected by GHSA-52cp-r559-cp3m |
package-lock.json |
| high | osv/GHSA-5p4m-2wfm-xmqj: [email protected] (npm) is affected by GHSA-5p4m-2wfm-xmqj |
package-lock.json |
| high | osv/GHSA-2883-xcg3-v3hh: [email protected] (npm) is affected by GHSA-2883-xcg3-v3hh |
package-lock.json |
| high | osv/GHSA-52cp-r559-cp3m: [email protected] (npm) is affected by GHSA-52cp-r559-cp3m |
package-lock.json |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 4,123; test lines: 2,447
| Language | Lines |
|---|---|
| TypeScript | 6,565 |
| JavaScript | 5 |