charlesvestal/schwung

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

17 of your 72 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Upstream (GitHub) caused delay on this scan — not Repobility.

GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
Clone from GitHub took 39.74s for a 79.2 MB repo slow.
Repobility's analysis ran in 3.5s after the clone landed.

https://github.com/charlesvestal/schwung · scanned 2026-06-05 20:40 UTC (4 days, 13 hours ago) · 10 languages

153 raw signals (69 security + 84 graph) 11/13 scanners ran 62nd percentile · C · large (100-500K LoC) System graph score 84 (lower by 16)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 13 hours ago · v2 · 72 actionable findings from 2 signal sources. 39 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 40 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	65.0	0.15	9.75
`security_score`	100.0	0.25	25.00
`testing_score`	31.0	0.20	6.20
`documentation_score`	70.0	0.15	10.50
`practices_score`	75.0	0.15	11.25
`code_quality`	46.0	0.10	4.60
Overall		1.00	67.3

security_score may be inflated — optional security scanners were skipped on this fast scan

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 6 Medium 11 Low 33 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 32 System graph 40 Crowd 0 Layer: Quality 31 Cicd 6 Software 6 Security 6 Api 1 Frontend 19 Hardware 3

Exclude dismissed / FP Exclude test files

All 1842 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

Label	Layer	Status	Path
`convert_param`	software	healthy	`scripts/migrate-module-params.py:16`
`migrate_module`	software	healthy	`scripts/migrate-module-params.py:58`
`parse_bdf`	software	healthy	`scripts/generate_font.py:957`
`generate_from_bdf`	software	healthy	`scripts/generate_font.py:1043`
`generate_c_array`	software	healthy	`scripts/generate_font.py:1079`
`generate_png`	software	healthy	`scripts/generate_font.py:1108`
`generate_deployment_png`	software	healthy	`scripts/generate_font.py:1146`
`ffprobe_stream`	software	healthy	`scripts/analyze_wavs.py:12`
`decode_stereo_f32`	software	healthy	`scripts/analyze_wavs.py:34`
`audio_metrics`	software	healthy	`scripts/analyze_wavs.py:56`
`print_summary`	software	healthy	`scripts/analyze_wavs.py:127`
`parse_args`	software	healthy	`scripts/analyze_wavs.py:138`
`resolve_inputs`	software	healthy	`scripts/analyze_wavs.py:164`
`main`	software	healthy	`scripts/analyze_wavs.py:186`
`e`	software	healthy	`schwung-manager/static/htmx.min.js:e`
`ue`	software	healthy	`schwung-manager/static/htmx.min.js:ue`
`me`	software	healthy	`schwung-manager/static/htmx.min.js:me`
`Ye`	software	healthy	`schwung-manager/static/htmx.min.js:Ye`
`nt`	software	healthy	`schwung-manager/static/htmx.min.js:nt`
`gt`	software	healthy	`schwung-manager/static/htmx.min.js:gt`
`or`	software	healthy	`schwung-manager/static/htmx.min.js:or`
`Zt`	software	healthy	`schwung-manager/static/htmx.min.js:Zt`
`Dr`	software	healthy	`schwung-manager/static/htmx.min.js:Dr`
`jr`	software	healthy	`schwung-manager/static/htmx.min.js:jr`
`makeComponent`	software	healthy	`schwung-manager/static/remote-ui.js:makeComponent`
`makeSlot`	software	healthy	`schwung-manager/static/remote-ui.js:makeSlot`
`connect`	software	healthy	`schwung-manager/static/remote-ui.js:connect`
`scheduleReconnect`	software	healthy	`schwung-manager/static/remote-ui.js:scheduleReconnect`
`send`	software	healthy	`schwung-manager/static/remote-ui.js:send`
`subscribe`	software	healthy	`schwung-manager/static/remote-ui.js:subscribe`
`unsubscribe`	software	healthy	`schwung-manager/static/remote-ui.js:unsubscribe`
`dispatch`	software	healthy	`schwung-manager/static/remote-ui.js:dispatch`
`handleSlotInfo`	software	healthy	`schwung-manager/static/remote-ui.js:handleSlotInfo`
`handleCustomUI`	software	healthy	`schwung-manager/static/remote-ui.js:handleCustomUI`
`reconcileNavStack`	software	healthy	`schwung-manager/static/remote-ui.js:reconcileNavStack`
`hierarchyStructureKey`	software	healthy	`schwung-manager/static/remote-ui.js:hierarchyStructureKey`
`handleHierarchy`	software	healthy	`schwung-manager/static/remote-ui.js:handleHierarchy`
`handleChainParamsMsg`	software	healthy	`schwung-manager/static/remote-ui.js:handleChainParamsMsg`
`handleParamUpdate`	software	healthy	`schwung-manager/static/remote-ui.js:handleParamUpdate`
`handleMasterFxInfo`	software	healthy	`schwung-manager/static/remote-ui.js:handleMasterFxInfo`
`handleMasterFxHierarchy`	software	healthy	`schwung-manager/static/remote-ui.js:handleMasterFxHierarchy`
`handleMasterFxChainParams`	software	healthy	`schwung-manager/static/remote-ui.js:handleMasterFxChainPara…`
`handleMasterFxParamUpdate`	software	healthy	`schwung-manager/static/remote-ui.js:handleMasterFxParamUpda…`
`splitMasterFxPrefix`	software	healthy	`schwung-manager/static/remote-ui.js:splitMasterFxPrefix`
`splitPrefix`	software	healthy	`schwung-manager/static/remote-ui.js:splitPrefix`
`switchSlot`	software	healthy	`schwung-manager/static/remote-ui.js:switchSlot`
`match`	software	healthy	`schwung-manager/static/remote-ui.js:match`
`escapeHtml`	software	healthy	`schwung-manager/static/remote-ui.js:escapeHtml`
`findParamMeta`	software	healthy	`schwung-manager/static/remote-ui.js:findParamMeta`
`getCompParamValue`	software	healthy	`schwung-manager/static/remote-ui.js:getCompParamValue`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`BUILDING.md`	software	healthy	`BUILDING.md`
`README.md`	software	healthy	`README.md`
`CLAUDE.md`	software	healthy	`CLAUDE.md`
`Dockerfile`	software	healthy	`Dockerfile`
`SCREEN_READER_TEST.md`	software	healthy	`SCREEN_READER_TEST.md`
`TESTING_SCREEN_READER.md`	software	healthy	`TESTING_SCREEN_READER.md`
`AGENTS.md`	software	healthy	`AGENTS.md`
`module-catalog.json`	software	healthy	`module-catalog.json`
`THIRD_PARTY_LICENSES.md`	software	healthy	`THIRD_PARTY_LICENSES.md`
`release.json`	software	healthy	`release.json`
`test_chain_modulated_suffix_hooks.sh`	software	healthy	`tests/host/test_chain_modulated_suffix_hooks.sh`
`test_clock_mode_mapping.sh`	software	healthy	`tests/host/test_clock_mode_mapping.sh`
`test_chain_mod_multi_source_sum_hooks.sh`	software	healthy	`tests/host/test_chain_mod_multi_source_sum_hooks.sh`
`test_chain_mod_host_api_surface.sh`	software	healthy	`tests/host/test_chain_mod_host_api_surface.sh`
`test_chain_lfo_float_parse_hooks.sh`	software	healthy	`tests/host/test_chain_lfo_float_parse_hooks.sh`
`test_chain_mod_slot_agnostic_wiring.sh`	software	healthy	`tests/host/test_chain_mod_slot_agnostic_wiring.sh`
`test_chain_mod_module_swap_invalidation_hooks.sh`	software	healthy	`tests/host/test_chain_mod_module_swap_invalidation_hooks.sh`
`test_chain_debug_logs_not_in_root_tmp.sh`	software	healthy	`tests/host/test_chain_debug_logs_not_in_root_tmp.sh`
`test_lfo_sync_divisions_full_order_hooks.sh`	software	healthy	`tests/host/test_lfo_sync_divisions_full_order_hooks.sh`
`test_host_transpose_raw_ui_passthrough.sh`	software	healthy	`tests/host/test_host_transpose_raw_ui_passthrough.sh`
`test_mfx_lfo_chain_params_range_lookup_hooks.sh`	software	healthy	`tests/host/test_mfx_lfo_chain_params_range_lookup_hooks.sh`
`test_chain_mod_dynamic_param_lookup.sh`	software	healthy	`tests/host/test_chain_mod_dynamic_param_lookup.sh`
`test_arp_clock_status.sh`	software	healthy	`tests/host/test_arp_clock_status.sh`
`test_chain_v2_midi_fx_host_api.sh`	software	healthy	`tests/host/test_chain_v2_midi_fx_host_api.sh`
`test_song_mode_continue_and_length_override.sh`	software	healthy	`tests/host/test_song_mode_continue_and_length_override.sh`
`test_mfx_lfo_runtime_chain_params_hooks.sh`	software	healthy	`tests/host/test_mfx_lfo_runtime_chain_params_hooks.sh`
`test_runtime_logs_not_in_root_tmp.sh`	software	healthy	`tests/host/test_runtime_logs_not_in_root_tmp.sh`
`test_chain_lfo_polarity_hooks.sh`	software	healthy	`tests/host/test_chain_lfo_polarity_hooks.sh`
`test_chain_mod_base_effective_semantics.sh`	software	healthy	`tests/host/test_chain_mod_base_effective_semantics.sh`
`test_chain_mod_runtime_state.sh`	software	healthy	`tests/host/test_chain_mod_runtime_state.sh`
`test_chain_mod_int_enum_safeguard_hooks.sh`	software	healthy	`tests/host/test_chain_mod_int_enum_safeguard_hooks.sh`
`test_mfx_modulated_suffix_hooks.sh`	software	healthy	`tests/host/test_mfx_modulated_suffix_hooks.sh`
`test_chain_mod_time_gate_hooks.sh`	software	healthy	`tests/host/test_chain_mod_time_gate_hooks.sh`
`test_arp_clock_status.c`	software	healthy	`tests/host/test_arp_clock_status.c`
`test_chain_mod_range_scaled_depth.sh`	software	healthy	`tests/host/test_chain_mod_range_scaled_depth.sh`
`test_mfx_lfo_polarity_hooks.sh`	software	healthy	`tests/host/test_mfx_lfo_polarity_hooks.sh`
`test_mfx_lfo_base_fallback_hooks.sh`	software	healthy	`tests/host/test_mfx_lfo_base_fallback_hooks.sh`
`test_mfx_lfo_mix_from_buffer_tick_hooks.sh`	software	healthy	`tests/host/test_mfx_lfo_mix_from_buffer_tick_hooks.sh`
`test_chain_mod_child_prefix_lookup_hooks.sh`	software	healthy	`tests/host/test_chain_mod_child_prefix_lookup_hooks.sh`
`test_shadow_overtake_menu_volume_passthrough.sh`	software	healthy	`tests/shadow/test_shadow_overtake_menu_volume_passthrough.sh`
`test_native_resample_bridge_persistence.sh`	software	healthy	`tests/shadow/test_native_resample_bridge_persistence.sh`
`test_shadow_volume_capture_in_shadow_mode.sh`	software	healthy	`tests/shadow/test_shadow_volume_capture_in_shadow_mode.sh`
`test_set_page_shortcut_requires_volume_touch.sh`	software	healthy	`tests/shadow/test_set_page_shortcut_requires_volume_touch.sh`
`test_shadow_filepath_live_preview.sh`	software	healthy	`tests/shadow/test_shadow_filepath_live_preview.sh`
`test_set_switch_song_index_retry.sh`	software	healthy	`tests/shadow/test_set_switch_song_index_retry.sh`
`test_sampler_back_resume_behavior.sh`	software	healthy	`tests/shadow/test_sampler_back_resume_behavior.sh`
`test_shadow_param_type_expansion.sh`	software	healthy	`tests/shadow/test_shadow_param_type_expansion.sh`
`test_sampler_skipback_dated_paths.sh`	software	healthy	`tests/shadow/test_sampler_skipback_dated_paths.sh`
`test_shadow_hierarchy_child_prefix.sh`	software	healthy	`tests/shadow/test_shadow_hierarchy_child_prefix.sh`
`test_shadow_uses_param_format.sh`	software	healthy	`tests/shadow/test_shadow_uses_param_format.sh`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`tests`	software	healthy	`tests`
`host`	software	healthy	`tests/host`
`shadow`	software	healthy	`tests/shadow`
`store`	software	healthy	`tests/store`
`test`	software	healthy	`test`
`docs`	software	healthy	`docs`
`plans`	software	healthy	`docs/plans`
`scripts`	software	healthy	`scripts`
`lib`	software	healthy	`scripts/lib`
`schwung-manager`	software	healthy	`schwung-manager`
`middleware`	software	healthy	`schwung-manager/middleware`
`static`	software	healthy	`schwung-manager/static`
`scripts`	software	healthy	`schwung-manager/scripts`
`templates`	software	healthy	`schwung-manager/templates`
`partials`	software	healthy	`schwung-manager/templates/partials`
`templates`	software	healthy	`templates`
`libs`	software	healthy	`libs`
`curl`	software	healthy	`libs/curl`
`quickjs`	software	healthy	`libs/quickjs`
`quickjs-2025-04-26`	software	healthy	`libs/quickjs/quickjs-2025-04-26`
`tests`	software	healthy	`libs/quickjs/quickjs-2025-04-26/tests`
`doc`	software	healthy	`libs/quickjs/quickjs-2025-04-26/doc`
`examples`	software	healthy	`libs/quickjs/quickjs-2025-04-26/examples`
`libsamplerate`	software	healthy	`libs/libsamplerate`
`examples`	software	healthy	`examples`
`.github`	software	healthy	`.github`
`workflows`	software	healthy	`.github/workflows`
`src`	software	healthy	`src`
`presets`	software	healthy	`src/presets`
`track_presets`	software	healthy	`src/presets/track_presets`
`host`	software	healthy	`src/host`
`shared`	software	healthy	`src/shared`
`lib`	software	healthy	`src/lib`
`jack2`	software	healthy	`src/lib/jack2`
`common`	software	healthy	`src/lib/jack2/common`
`jack`	software	healthy	`src/lib/jack2/common/jack`
`linux`	software	healthy	`src/lib/jack2/linux`
`shadow`	software	healthy	`src/lib/jack2/shadow`
`posix`	software	healthy	`src/lib/jack2/posix`
`shadow`	software	healthy	`src/shadow`
`modules`	software	healthy	`src/modules`
`midi_fx`	software	healthy	`src/modules/midi_fx`
`velocity_scale`	software	healthy	`src/modules/midi_fx/velocity_scale`
`dsp`	software	healthy	`src/modules/midi_fx/velocity_scale/dsp`
`chord`	software	healthy	`src/modules/midi_fx/chord`
`dsp`	software	healthy	`src/modules/midi_fx/chord/dsp`
`arp`	software	healthy	`src/modules/midi_fx/arp`
`dsp`	software	healthy	`src/modules/midi_fx/arp/dsp`
`audio_fx`	software	healthy	`src/modules/audio_fx`
`freeverb`	software	healthy	`src/modules/audio_fx/freeverb`

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

Label	Layer	Status	Path
`C`	software	healthy	`libs/quickjs/quickjs-2025-04-26/tests/test_language.js:C`
`D`	software	healthy	`libs/quickjs/quickjs-2025-04-26/tests/test_language.js:D`
`name`	software	healthy	`libs/quickjs/quickjs-2025-04-26/tests/test_language.js:name`
`E`	software	healthy	`libs/quickjs/quickjs-2025-04-26/tests/test_language.js:E`
`S`	software	healthy	`libs/quickjs/quickjs-2025-04-26/tests/test_language.js:S`
`P`	software	healthy	`libs/quickjs/quickjs-2025-04-26/tests/test_language.js:P`
`ColorPoint`	software	healthy	`libs/quickjs/quickjs-2025-04-26/examples/test_point.js:Colo…`

Label	Layer	Status	Path
`192.168.1.50`	network	healthy	`scripts/uninstall.sh`
`127.0.0.1`	network	healthy	`schwung-manager/main.go`

Label	Layer	Status	Path
`repobility-clone-k84cecbo`	software	healthy	`/tmp/repobility-clone-k84cecbo`

Label	Layer	Status	Path
`port:7700`	network	healthy	`schwung-manager/main.go`

Label	Layer	Status	Path
`image::Dockerfile`	hardware	healthy	`Dockerfile`

Label	Layer	Status	Path
`gha::release`	cicd	healthy	`.github/workflows/release.yml`

Label	Layer	Status	Path
`build`	cicd	healthy	`.github/workflows/release.yml`

Label	Layer	Status	Path
`GITHUB_TOKEN`	cicd	healthy	`—`

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/3e1c4285-0bca-4ba4-9c2b-65cfa56d6ae4/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/3e1c4285-0bca-4ba4-9c2b-65cfa56d6ae4/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.

charlesvestal/schwung

Complete repo analysis

function 50+

file 50+

directory 50+

class 7

service 2

repo 1

port 1

container 1

pipeline 1

job 1

env_var 1