kaitranntt/ccs
Switch between Claude accounts, Gemini, Copilot, OpenRouter (300+ models) via CLIProxyAPI OAuth proxy. Visual dashboard, remote proxy support, WebSearch fallback. Zero-config to production-ready.
- Repository: https://github.com/kaitranntt/ccs
- Commit:
cd2e02288675cbb9fcda620b44ec84d7d4a94919 - Generated: 2026-11-14T00:10:56+00:00
- Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2
Scores
| Pillar | Score | Signal | Confidence | Coverage |
|---|---|---|---|---|
| AI provenance (estimated AI-generated share) | 7 | explicit | 95% | 100% |
| Code quality | 70 | adequate | 90% | 100% |
| Security | 34 | poor | 85% | 100% |
AI provenance
Explicit AI attribution on 7% of first-party code added; an estimated 7% including velocity signals.
- Explicitly attributed share (lower bound): 6.9%
- Unattributed share in AI-consistent velocity bursts: 48.6%
- Estimated AI-generated share: 6.9%
| AI tool | Attributed commits | Lines added |
|---|---|---|
| OpenAI Codex | 150 | 10,529 |
| Claude Code | 111 | 34,087 |
| Cursor agent | 1 | 15 |
| GitHub Copilot coding agent | 1 | 1 |
- AI tooling configured in repo: claude-code, generic-agent
Current source lines last changed by AI-attributed commits: 15,525 of 276,070.
| Findings per 1,000 lines | AI-attributed | Other | Ratio |
|---|---|---|---|
| Quality | 0.064 | 0.764 | 0.08x |
| Security | 0.902 | 1.09 | 0.83x |
- Stylometry index: 0.11 per 1,000 lines (narrated steps 17, placeholders 0, assistant phrasing 3, emoji 11). Reported as a signal, not scored.
| Month | Lines added | Attributed to AI |
|---|---|---|
| 2025-12 | 121,393 | 0% |
| 2026-01 | 33,573 | 9% |
| 2026-02 | 84,166 | 1% |
| 2026-03 | 82,922 | 1% |
| 2026-04 | 134,011 | 12% |
| 2026-05 | 54,507 | 15% |
| 2026-06 | 54,170 | 6% |
| 2026-07 | 13,204 | 25% |
| 2026-08 | 8,934 | 14% |
| 2026-09 | 2,972 | 6% |
| 2026-10 | 5,391 | 17% |
| 2026-11 | 7,069 | 0% |
Evidence
- Claude Code: message 'claude.ai/code' (2f5de185f030)
- Claude Code: message 'claude.ai/code' (132fb49406ce)
- Claude Code: on merged branch (43b7885351) (717ab103c7f7)
- Claude Code: trailer 'Co-Authored-By: Claude' (6d7bccb333f4)
- Claude Code: trailer 'Co-Authored-By: Claude' (0f70bb925e0f)
- Claude Code: trailer 'Co-Authored-By: Claude' (102c389574a8)
- Claude Code: trailer 'Co-Authored-By: Claude' (d9033e49a412)
- Claude Code: trailer 'Co-Authored-By: Claude' (8bdd4fa49a71)
- Claude Code: trailer 'Co-Authored-By: Claude' (c7274d430b7c)
- Claude Code: message 'claude.ai/code' (2b780ceae3bc)
- Claude Code: trailer 'Co-Authored-By: Claude' (fe3447f4871c)
- Claude Code: trailer 'Co-Authored-By: Claude' (ea7906b97580)
- Claude Code: trailer 'Co-Authored-By: Claude' (c30e9ca6179d)
- Claude Code: trailer 'Co-Authored-By: Claude' (d27b53f235fa)
- Claude Code: trailer 'Co-Authored-By: Claude' (833473c5f61f)
AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.
Code quality
Code quality is adequate: test-to-source ratio 0.65, no CI test run detected; 27% of function code in complex or long functions; 8% duplicated lines. Weakest area: complexity.
| Area | Score |
|---|---|
| Complexity (lizard) | 44 |
| Duplication | 64 |
| Code smells (Opengrep) | 79 |
| Tests and CI | 70 |
| Documentation | 100 |
| Type safety | 100 |
| Process (Scorecard review/maintenance) | n/a |
- Functions: 11,956; mean complexity 3.5, 90th percentile 8; 353 complex and 175 long functions
- Duplicated lines: 7.5% of 198,751 compared
- Tests: 178,495 test lines for 276,070 source lines (ratio 0.65); CI test commands: none detected; 87% of recent source commits also change tests
- Docs missing or thin: none
Most complex functions:
- mergeWithDefaults in src/config/loader/defaults-merger.ts: complexity 110, 272 lines
- ClaudeExtensionPage in ui/src/pages/claude-extension.tsx: complexity 89, 551 lines
- triggerOAuth in src/cliproxy/auth/oauth-handler.ts: complexity 88, 309 lines
- ProxyStatusWidget in ui/src/components/monitoring/proxy-status-widget.tsx: complexity 82, 390 lines
- runSettingsFlow in src/dispatcher/flows/settings-flow.ts: complexity 76, 333 lines
Security
Security posture is poor: 207 known vulnerabilities in 52 dependencies; 59 high-severity SAST findings; 68 high-severity workflow issues. Weakest area: ci actions.
| Area | Score |
|---|---|
| Secrets (gitleaks, tree + history) | 63 |
| Static analysis (Opengrep) | 55 |
| Vulnerable dependencies (OSV) | 0 |
| CI workflows (zizmor) | 0 |
| Posture (policy, updates, signing, lockfiles) | 40 |
| OpenSSF Scorecard | n/a |
-
Known vulnerabilities: 207 in 52 packages (critical 6, high 94, medium 89, low 18)
-
Posture checks passed: security policy, lockfiles; missing: dependency updates, signed commits
Top findings
| Severity | Finding | Location |
|---|---|---|
| critical | osv/GHSA-2w6w-674q-4c4q: [email protected] (npm) is affected by GHSA-2w6w-674q-4c4q |
bun.lock |
| critical | osv/GHSA-8r5x-fm3f-whwj: [email protected] (npm) is affected by GHSA-8r5x-fm3f-whwj |
bun.lock |
| critical | osv/GHSA-p8wg-vrv2-v86f: [email protected] (npm) is affected by GHSA-p8wg-vrv2-v86f |
bun.lock |
| critical | osv/GHSA-jqcg-44mw-7w3h: [email protected] (npm) is affected by GHSA-jqcg-44mw-7w3h |
bun.lock |
| critical | osv/GHSA-23hp-3jrh-7fpw: [email protected] (npm) is affected by GHSA-23hp-3jrh-7fpw |
bun.lock |
| critical | osv/GHSA-5xrq-8626-4rwp: [email protected] (npm) is affected by GHSA-5xrq-8626-4rwp |
ui/bun.lock |
| high | opengrep/dockerfile.security.missing-user-entrypoint: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
docker/Dockerfile:87 |
| high | opengrep/dockerfile.security.missing-user: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium] |
docker/Dockerfile:89 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: process.platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
scripts/run-test-bucket.js:222 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: process.platform === 'win32'}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
scripts/run-test-bucket.js:232 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: getWindowsEscapedCommandShell()}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' inste [confidence low] |
src/auth/commands/create-command.ts:266 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument port. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/auth/environment-detector.ts:66 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument port. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/auth/environment-detector.ts:75 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument port. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/auth/environment-detector.ts:82 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument port. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/auth/environment-detector.ts:88 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument verbose. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/auth/kiro-import.ts:44 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument binaryPath. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/auth/oauth-cli-capabilities.ts:82 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument options. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/auth/oauth-process.ts:746 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: getWindowsEscapedCommandShell()}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' inste [confidence low] |
src/cliproxy/executor/claude-launcher.ts:175 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument context. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/executor/claude-launcher.ts:175 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument context. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/executor/claude-launcher.ts:182 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument binaryPath. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/executor/lifecycle-manager.ts:75 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument deps. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/service-manager.ts:266 |
| high | opengrep/javascript.lang.security.detect-child-process: Detected calls to child_process from a function argument verbose. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed. [confidence low] |
src/cliproxy/service-manager.ts:266 |
| high | opengrep/javascript.lang.security.audit.spawn-shell-true: Found '$SPAWN' with '{shell: true}'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use '{shell: false}' instead. [confidence low] |
src/commands/update-command.ts:318 |
Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.
Repository profile
- Source lines: 276,070; test lines: 178,495
| Language | Lines |
|---|---|
| TypeScript | 407,879 |
| JavaScript | 31,629 |
| Swift | 7,483 |
| Shell | 4,791 |
| PowerShell | 2,783 |