crspytopgn/openmcm2

Open-source engine for Motocross Madness 2, rewritten from scratch in Rust. Native on macOS, Windows and Linux. Bring your own copy of the game.

https://github.com/crspytopgn/openmcm2 · commit 3a455e528623 · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/crspytopgn/openmcm2
Commit: 3a455e528623201fb9032ae9bdcbdeadd8e4e023
Generated: 2026-11-13T23:56:18+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	100	explicit	84%	100%
Code quality	65	weak	90%	100%
Security	71	adequate	85%	100%

AI provenance

Explicit AI attribution on 100% of first-party code added; an estimated 100% including velocity signals.

Explicitly attributed share (lower bound): 100.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 100.0%

AI tool	Attributed commits	Lines added
Claude Code	57	58,263

Current source lines last changed by AI-attributed commits: 56,467 of 56,467.

Too few lines in one group to compare finding densities.

Month	Lines added	Attributed to AI
2026-10	55,848	100%
2026-11	2,415	100%

Evidence

Claude Code: author email [email protected] (fb08a6aee32c)
Claude Code: author email [email protected] (1d7407a5c3e9)
Claude Code: author email [email protected] (5ade6f1dd116)
Claude Code: author email [email protected] (63adf597fb79)
Claude Code: author email [email protected] (a0e42f592256)
Claude Code: author email [email protected] (6ed40aab741b)
Claude Code: trailer 'Co-authored-by: Claude' (7b192ac47d58)
Claude Code: trailer 'Co-authored-by: Claude' (c2d8f4563cf5)
Claude Code: trailer 'Co-authored-by: Claude' (5ae9b62d7846)
Claude Code: author email [email protected] (f6853685b81b)
Claude Code: committer email [email protected] (a33038a08b16)
Claude Code: committer email [email protected] (639aa4f55a99)
Claude Code: committer email [email protected] (7707988f2112)
Claude Code: committer email [email protected] (2c8ac6d9f643)
Claude Code: committer email [email protected] (0dce22196e0f)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is weak: test-to-source ratio 0.01, CI runs tests; 31% of function code in complex or long functions; 2% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	40
Duplication	87
Code smells (Opengrep)	98
Tests and CI	56
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 1,963; mean complexity 4.6, 90th percentile 10; 105 complex and 43 long functions
Duplicated lines: 2.4% of 43,606 compared
Tests: 399 test lines for 56,467 source lines (ratio 0.01); CI test commands: go test, cargo test; 2% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

Security

Security posture is adequate: 3 known vulnerabilities in 3 dependencies; 17 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	96
Vulnerable dependencies (OSV)	86
CI workflows (zizmor)	3
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Known vulnerabilities: 3 in 3 packages (critical 0, high 0, medium 1, low 0)
Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles

Top findings

Severity	Finding	Location
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:17
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:18
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/ci.yml:23
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:26
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:29
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pages.yml:33
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/publish-release.yml:20
high	`zizmor/excessive-permissions`: overly broad permissions [confidence high]	.github/workflows/release.yml:25
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:39
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:40
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:43
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:84
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:94
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:95
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:108
high	`zizmor/cache-poisoning`: runtime artifacts potentially vulnerable to a cache poisoning attack [confidence low]	.github/workflows/release.yml:43
medium	`osv/RUSTSEC-2026-0486`: [email protected] (crates.io) is affected by RUSTSEC-2026-0486	Cargo.lock
medium	`osv/GHSA-5wjr-9356-4wc8`: [email protected] (crates.io) is affected by RUSTSEC-2026-0384, GHSA-5wjr-9356-4wc8	Cargo.lock
medium	`osv/RUSTSEC-2026-0192`: [email protected] (crates.io) is affected by RUSTSEC-2026-0192	Cargo.lock
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/ci.yml:17
medium	`zizmor/excessive-permissions`: overly broad permissions [confidence medium]	.github/workflows/ci.yml:10
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/pages.yml:25
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/publish-release.yml:20
medium	`zizmor/artipacked`: credential persistence through GitHub Actions artifacts [confidence low]	.github/workflows/release.yml:39

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v0.3.2 ships openmcm2-v0.3.2-linux-x86_64.tar.gz (11 downloads)
binary-release-asset: release v0.3.2 ships openmcm2-v0.3.2-macos-arm64.zip (4 downloads)
binary-release-asset: release v0.3.2 ships openmcm2-v0.3.2-macos-x86_64.zip (2 downloads)
binary-release-asset: release v0.3.2 ships openmcm2-v0.3.2-windows-x86_64.zip (23 downloads)
binary-release-asset: release v0.3.1 ships openmcm2-v0.3.1-linux-x86_64.tar.gz (34 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 56,467; test lines: 399

Language	Lines
Rust	56,473
Java	205
Shell	103
Python	85

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/crspytopgn/openmcm2/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/crspytopgn/openmcm2/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/crspytopgn/openmcm2/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/crspytopgn/openmcm2/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/crspytopgn/openmcm2/security.svg)](https://repotrust.synapticcyber.com/r/github.com/crspytopgn/openmcm2/)