FullAgent/fulling

Fulling is an AI-powered Full-stack Engineer Agent. Built with Next.js, Claude, shadcn/ui, and PostgreSQL. Use kubernetes as infra.

https://github.com/FullAgent/fulling · commit f48efced082a · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/FullAgent/fulling
Commit: f48efced082a7de3517816267481c04e058672cb
Generated: 2026-11-14T00:06:30+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	49	explicit	95%	100%
Code quality	75	adequate	90%	100%
Security	67	weak	85%	100%

AI provenance

Explicit AI attribution on 49% of first-party code added; an estimated 49% including velocity signals.

Explicitly attributed share (lower bound): 48.8%
Unattributed share in AI-consistent velocity bursts: 7.1%
Estimated AI-generated share: 48.8%

AI tool	Attributed commits	Lines added
Claude Code	50	19,518
OpenAI Codex	18	4,985
GitHub Copilot coding agent	8	4,780

AI tooling configured in repo: generic-agent

Current source lines last changed by AI-attributed commits: 707 of 2,240.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	9.901	7.175	1.38x
Security	0.0	0.0	n/a

Month	Lines added	Attributed to AI
2025-10	17,138	67%
2025-11	21,511	24%
2025-12	3,305	30%
2026-01	1,992	80%
2026-02	2,138	75%
2026-03	5,942	80%
2026-04	1,617	99%
2026-05	18	0%
2026-06	503	0%
2026-07	2,662	22%

Evidence

OpenAI Codex: PR branch 'codex/issue-183-runtime-dependency-upgrades' (317c0141893e)
OpenAI Codex: on merged branch (e568b4e461) (ad7dce932a63)
OpenAI Codex: PR branch 'codex/issue-181-vercel-deployment' (9ccaab5707f9)
OpenAI Codex: PR branch 'codex/issue-180-npm-migration' (869aaad22046)
OpenAI Codex: PR branch 'codex/issue-178-landing-page' (53b934db1afe)
OpenAI Codex: PR branch 'codex/wiki-docs' (d95060f8421b)
OpenAI Codex: PR branch 'codex/lib-platform-tests' (2365e3a7ead1)
OpenAI Codex: PR branch 'codex/global-skill-uninstall' (5cfc59ad3d3b)
OpenAI Codex: PR branch 'codex/global-skill-enablement' (67c34d3342ce)
OpenAI Codex: PR branch 'codex/import-status-handling' (25c93c35e2da)
OpenAI Codex: PR branch 'codex/import-command-boundary' (7746688fb679)
OpenAI Codex: PR branch 'codex/platform-control-refactor' (61a9026f7807)
OpenAI Codex: PR branch 'codex/landing-single-screen-tune' (51833cb5836d)
OpenAI Codex: PR branch 'codex/project-status-display-rules' (c3840231a2aa)
OpenAI Codex: PR branch 'codex/prepare-deploy' (393b6aaa4910)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.29, CI runs tests; 0% of function code in complex or long functions; 1% duplicated lines. Weakest area: lint.

Area	Score
Complexity (lizard)	100
Duplication	95
Code smells (Opengrep)	12
Tests and CI	73
Documentation	80
Type safety	100
Process (Scorecard review/maintenance)	n/a

Functions: 80; mean complexity 2.8, 90th percentile 6; 0 complex and 0 long functions
Duplicated lines: 0.9% of 1,508 compared
Tests: 647 test lines for 2,240 source lines (ratio 0.29); CI test commands: npm test, npm run test; 10% of recent source commits also change tests
Docs missing or thin: changelog

Security

Security posture is weak: 99 known vulnerabilities in 26 dependencies; 2 high-severity workflow issues. Weakest area: dependencies.

Area	Score
Secrets (gitleaks, tree + history)	97
Static analysis (Opengrep)	100
Vulnerable dependencies (OSV)	6
CI workflows (zizmor)	58
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	n/a

Known vulnerabilities: 99 in 26 packages (critical 6, high 38, medium 47, low 8)
Posture checks passed: dependency updates, signed commits, lockfiles; missing: security policy

Top findings

Severity	Finding	Location
critical	`osv/GHSA-965c-763c-88jm`: [email protected] (npm) is affected by GHSA-965c-763c-88jm	package-lock.json
critical	`osv/GHSA-2464-fhr4-w9xw`: [email protected] (npm) is affected by GHSA-2464-fhr4-w9xw	package-lock.json
critical	`osv/GHSA-2xp9-vwfh-vxw4`: [email protected] (npm) is affected by GHSA-2xp9-vwfh-vxw4	package-lock.json
critical	`osv/GHSA-673q-mjm6-r5xr`: [email protected] (npm) is affected by GHSA-673q-mjm6-r5xr	package-lock.json
critical	`osv/GHSA-p293-qw3h-jr36`: [email protected] (npm) is affected by GHSA-p293-qw3h-jr36	package-lock.json
critical	`osv/GHSA-vcvr-r3jv-pc5j`: [email protected] (npm) is affected by GHSA-vcvr-r3jv-pc5j	package-lock.json
high	`osv/GHSA-q84f-53jg-9ppm`: [email protected] (npm) is affected by GHSA-q84f-53jg-9ppm	package-lock.json
high	`osv/GHSA-r4xp-prcw-77qf`: [email protected] (npm) is affected by GHSA-r4xp-prcw-77qf	package-lock.json
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	package-lock.json
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	package-lock.json
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	package-lock.json
high	`osv/GHSA-6j4f-fj2g-mc7p`: [email protected] (npm) is affected by GHSA-6j4f-fj2g-mc7p	package-lock.json
high	`osv/GHSA-mh99-v99m-4gvg`: [email protected] (npm) is affected by GHSA-mh99-v99m-4gvg	package-lock.json
high	`osv/GHSA-qhr7-859c-m2p7`: [email protected] (npm) is affected by GHSA-qhr7-859c-m2p7	package-lock.json
high	`osv/GHSA-rgw5-rvv9-x895`: [email protected] (npm) is affected by GHSA-rgw5-rvv9-x895	package-lock.json
high	`osv/GHSA-73wf-gq98-2v4g`: [email protected] (npm) is affected by GHSA-73wf-gq98-2v4g	package-lock.json
high	`osv/GHSA-c83g-rgw3-j3cx`: [email protected] (npm) is affected by GHSA-c83g-rgw3-j3cx	package-lock.json
high	`osv/GHSA-ggr8-5vv4-36mx`: [email protected] (npm) is affected by GHSA-ggr8-5vv4-36mx	package-lock.json
high	`osv/GHSA-5jgf-p345-68v8`: [email protected] (npm) is affected by GHSA-5jgf-p345-68v8	package-lock.json
high	`osv/GHSA-7p8r-x3mc-p8w7`: [email protected] (npm) is affected by GHSA-7p8r-x3mc-p8w7	package-lock.json
high	`osv/GHSA-f65p-4m7j-42xc`: [email protected] (npm) is affected by GHSA-f65p-4m7j-42xc	package-lock.json
high	`osv/GHSA-fph4-wmhf-6fwf`: [email protected] (npm) is affected by GHSA-fph4-wmhf-6fwf	package-lock.json
high	`osv/GHSA-jqff-g426-hqxp`: [email protected] (npm) is affected by GHSA-jqff-g426-hqxp	package-lock.json
high	`osv/GHSA-qw65-cvwx-89v3`: [email protected] (npm) is affected by GHSA-qw65-cvwx-89v3	package-lock.json

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 2,240; test lines: 647

Language	Lines
TypeScript	2,714
SQL	94
JavaScript	79

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/FullAgent/fulling/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/FullAgent/fulling/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/FullAgent/fulling/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/FullAgent/fulling/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/FullAgent/fulling/security.svg)](https://repotrust.synapticcyber.com/r/github.com/FullAgent/fulling/)