cocoindex-io/cocoindex-code
A super light-weight embedded code search engine CLI (AST based) that just works - improves speed and efficiency for coding agent 馃専 Star if you like it!
- Repository: https://github.com/cocoindex-io/cocoindex-code
- Commit:
5676897a169fe1d46cf1e4d2eaf323c9d91c8587 - Generated: 2026-11-14T00:03:50+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 38 | explicit | 95% | 100% |
| Code quality | 75 | adequate | 90% | 100% |
| Security | 61 | weak | 85% | 100% |
AI provenance
Explicit AI attribution on 38% of first-party code added; an estimated 38% including velocity signals.
- Explicitly attributed share (lower bound): 37.6%
- Unattributed share in AI-consistent velocity bursts: 14.2%
- Estimated AI-generated share: 37.6%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| Claude Code | 72 | 7,435 |
- AI tooling configured in repo: claude-code
Current source lines last changed by AI-attributed commits: 2,677 of 7,124.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 1.121 | 2.474 | 0.45x |
| Security | 0.374 | 0.899 | 0.42x |
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2026-01 | 904 | 0% |
| 2026-02 | 1,225 | 47% |
| 2026-03 | 7,958 | 17% |
| 2026-04 | 3,417 | 37% |
| 2026-05 | 41 | 0% |
| 2026-06 | 1,600 | 99% |
| 2026-07 | 1,731 | 84% |
| 2026-08 | 1,250 | 28% |
| 2026-10 | 1,671 | 49% |
Evidence
- Claude Code: trailer 'Co-authored-by: Claude' (5676897a169f)
- Claude Code: trailer 'Co-authored-by: Claude' (b3834e634c98)
- Claude Code: trailer 'Co-authored-by: Claude' (b883be0b5d76)
- Claude Code: trailer 'Co-authored-by: Claude' (3aa066e0e7e7)
- Claude Code: trailer 'Co-authored-by: Claude' (fbe3adb1e70a)
- Claude Code: trailer 'Co-authored-by: Claude' (9feb04f867e3)
- Claude Code: trailer 'Co-Authored-By: Claude' (519ce97363d0)
- Claude Code: trailer 'Co-authored-by: Claude' (9fd2e7470a8b)
- Claude Code: trailer 'Co-authored-by: Claude' (68298cc8d266)
- Claude Code: PR description attribution (0c18fe33c3d2)
- Claude Code: trailer 'Co-authored-by: Claude' (66bbb422fe93)
- Claude Code: trailer 'Co-authored-by: Claude' (fd99851cd5e4)
- Claude Code: trailer 'Co-Authored-By: Claude' (df021fbb6832)
- Claude Code: trailer 'Co-Authored-By: Claude' (f8411fa6775e)
- Claude Code: trailer 'Co-Authored-By: Claude' (3ce9fb5dc92f)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 1.08, CI runs tests; 16% of function code in complex or long functions; 2% duplicated lines. Weakest area: lint.
| Area | Score |
|---|---|
| Complexity (lizard) | 62 |
| Duplication | 89 |
| Code smells (Opengrep) | 40 |
| Tests and CI | 100 |
| Documentation | 80 |
| Type safety | 59 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 259; mean complexity 3.8, 90th percentile 8; 6 complex and 3 long functions
- Duplicated lines: 2.0% of 5,251 compared
- Tests: 7,683 test lines for 7,124 source lines (ratio 1.08); CI test commands: pytest; 61% of recent source commits also change tests
- Docs missing or thin: changelog
Most complex functions:
- main in src/cocoindex_code/server.py: complexity 25, 112 lines
- doctor in src/cocoindex_code/cli.py: complexity 23, 95 lines
- reset in src/cocoindex_code/cli.py: complexity 19, 57 lines
- main in scripts/find_best_models.py: complexity 17, 191 lines
- run_daemon in src/cocoindex_code/daemon.py: complexity 16, 110 lines
Security
Security posture is weak: 21 known vulnerabilities in 9 dependencies; 4 high-severity SAST findings; 24 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 100 |
| Static analysis (Opengrep) | 79 |
| Vulnerable dependencies (OSV) | 39 |
| CI workflows (zizmor) | 1 |
| Posture (policy, updates, signing, lockfiles) | 60 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 21 in 9 packages (critical 1, high 6, medium 12, low 2)
-
Posture checks passed: security policy, signed commits; missing: dependency updates, lockfiles
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-6q48-6c7w-9gw2: [email protected] (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2 |
uv.lock |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
docker/Dockerfile:82 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
src/cocoindex_code/client.py:564 |
| high | opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] |
src/cocoindex_code/client.py:572 |
| high | opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] |
src/cocoindex_code/query.py:105 |
| high | osv/GHSA-2g87-pp6c-29x5: [email protected] (PyPI) is affected by GHSA-2g87-pp6c-29x5 |
uv.lock |
| high | osv/GHSA-5wr8-gcqf-gqf3: [email protected] (PyPI) is affected by GHSA-5wr8-gcqf-gqf3 |
uv.lock |
| high | osv/GHSA-9xw5-w5jj-pvcg: [email protected] (PyPI) is affected by GHSA-9xw5-w5jj-pvcg |
uv.lock |
| high | osv/GHSA-27vj-qcqg-25rc: [email protected] (PyPI) is affected by PYSEC-2026-4217, GHSA-27vj-qcqg-25rc |
uv.lock |
| high | osv/GHSA-g5ff-637f-6q2m: [email protected] (PyPI) is affected by GHSA-g5ff-637f-6q2m |
uv.lock |
| high | osv/GHSA-84m7-p3x7-pcfv: [email protected] (PyPI) is affected by GHSA-84m7-p3x7-pcfv |
uv.lock |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pre-commit.yml:45 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pre-commit.yml:53 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pre-commit.yml:56 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pre-commit.yml:92 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/pre-commit.yml:95 |
| high | zizmor/template-injection: code injection via template expansion [confidence high] |
.github/workflows/release.yml:116 |
| high | zizmor/template-injection: code injection via template expansion [confidence high] |
.github/workflows/release.yml:297 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:32 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:37 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:42 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:48 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:66 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:72 |
| high | zizmor/unpinned-uses: unpinned action reference [confidence high] |
.github/workflows/release.yml:89 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Distribution signals
- binary-release-asset: release v0.2.43 ships cocoindex_code-0.2.43.tar.gz (1 downloads)
- binary-release-asset: release v0.2.42 ships cocoindex_code-0.2.42.tar.gz (13 downloads)
- binary-release-asset: release v0.2.41 ships cocoindex_code-0.2.41.tar.gz (9 downloads)
- binary-release-asset: release v0.2.40 ships cocoindex_code-0.2.40.tar.gz (10 downloads)
- binary-release-asset: release v0.2.39 ships cocoindex_code-0.2.39.tar.gz (7 downloads)
Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.
Repository profile
- Source lines: 7,124; test lines: 7,683
| Language | Lines |
|---|---|
| Python | 14,598 |
| TypeScript | 159 |
| Shell | 50 |