openops-cloud/openops

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

https://github.com/openops-cloud/openops · scanned 2026-05-16 12:50 UTC (1 day, 9 hours ago) · 10 languages

259 findings (9 legacy + 250 scanner) 2/10 scanners ran 95th percentile · Typescript · large (100-500K LoC) Scanner says 56 (higher by 29)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 days, 1 hour ago · v1 · 253 findings from 2 sources. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON

100.0% cov · 250 gaps

{# ── 2026-05-17 R27 #5: score breakdown panel ────────────────────── Surfaces the score_breakdown JSON that's been silently stored on Repository for months. Turns hidden math into a trust signal. #}

Severity distribution — click a segment to filter

Active filters: layer: api × excluding tests × Reset all

Scan summary Repository scanned at 55.8/100 with 100.0% coverage. It contains 7818 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 250 findings — concentrated in frontend (82), software (50), api (50). Risk profile is high: 0 critical, 7 high, 34 medium. Recommended next step: open the frontend layer findings first — that's where the highest-impact wins live.

Showing 50 of 253 findings. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

low 9-layer api wiring conf 1.00 Unused endpoint: ALL /:id/requests/:executionCorrelationId

`packages/server/api/src/app/flows/flow-run/flow-run-controller.ts` declares `ALL /:id/requests/:executionCorrelationId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — conside…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /

`packages/server/api/src/app/store-entry/store-entry.controller.ts` declares `DELETE /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who con…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /:chatId

`packages/server/api/src/app/ai/chat/ai-mcp-chat.controller.ts` declares `DELETE /:chatId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: DELETE /:id

`packages/server/api/src/app/flows/folder/folder.module.ts` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /

`packages/server/api/src/app/flow-template/flow-template.controller.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /:connectionName

`packages/server/api/src/app/app-connection/app-connection-worker-controller.ts` declares `GET /:connectionName` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removi…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /:flowId

`packages/server/api/src/app/flows/flow/form/form.controller.ts` declares `GET /:flowId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /:flowVersionId/test-output

`packages/server/api/src/app/flows/flow/flow-version.controller.ts` declares `GET /:flowVersionId/test-output` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /:id

`packages/server/api/src/app/flow-template/flow-template.controller.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /:id/template

`packages/server/api/src/app/flows/flow/flow.controller.ts` declares `GET /:id/template` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /:id/versions

`packages/server/api/src/app/flows/flow/flow.controller.ts` declares `GET /:id/versions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /:provider

`packages/server/api/src/app/ai/providers/ai-providers.controller.ts` declares `GET /:provider` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /active

`packages/server/api/src/app/ai/config/ai-config.controller.ts` declares `GET /active` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /all-chats

`packages/server/api/src/app/ai/chat/ai-mcp-chat.controller.ts` declares `GET /all-chats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who c…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /analytics-embed-id

`packages/server/api/src/app/authentication/authentication.controller.ts` declares `GET /analytics-embed-id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing o…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /analytics-guest-token

`packages/server/api/src/app/authentication/authentication.controller.ts` declares `GET /analytics-guest-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removin…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /count

`packages/server/api/src/app/flows/flow/flow.controller.ts` declares `GET /count` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /environment-id

`packages/server/api/src/app/flags/flag.module.ts` declares `GET /environment-id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /flows

`packages/server/api/src/app/flows/folder/folder.module.ts` declares `GET /flows` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /list

`packages/server/api/src/app/store-entry/store-entry.controller.ts` declares `GET /list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /metadata

`packages/server/api/src/app/app-connection/app-connection.controller.ts` declares `GET /metadata` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or document…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /overview

`packages/server/api/src/app/dashboards/dashboards-module.ts` declares `GET /overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /poll

`packages/server/api/src/app/flows/trigger-events/trigger-event.module.ts` declares `GET /poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /redirect

`packages/server/api/src/app/app.ts` declares `GET /redirect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /runs/:runId

`packages/server/api/src/app/workers/engine-controller.ts` declares `GET /runs/:runId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: GET /workflows-stats

`packages/server/api/src/app/dashboards/dashboards-module.ts` declares `GET /workflows-stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting w…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: PATCH /

`packages/server/api/src/app/app-connection/app-connection.controller.ts` declares `PATCH /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting wh…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: PATCH /:chatId/name

`packages/server/api/src/app/ai/chat/ai-mcp-chat.controller.ts` declares `PATCH /:chatId/name` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /

`packages/server/api/src/app/flow-template/flow-template.controller.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who c…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /:flowVersionId/test-output

`packages/server/api/src/app/flows/flow/flow-version.controller.ts` declares `POST /:flowVersionId/test-output` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removin…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /:flowVersionId/trigger

`packages/server/api/src/app/flows/flow/flow-version.controller.ts` declares `POST /:flowVersionId/trigger` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /:id

`packages/server/api/src/app/flows/folder/folder.module.ts` declares `POST /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /:id/retry

`packages/server/api/src/app/flows/flow-run/flow-run-controller.ts` declares `POST /:id/retry` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /:id/run

`packages/server/api/src/app/flows/flow/flow.controller.ts` declares `POST /:id/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /:id/stop

`packages/server/api/src/app/flows/flow-run/flow-run-controller.ts` declares `POST /:id/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting w…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /chat-name

`packages/server/api/src/app/ai/chat/ai-mcp-chat.controller.ts` declares `POST /chat-name` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /code

`packages/server/api/src/app/ai/chat/ai-mcp-chat.controller.ts` declares `POST /code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consu…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /delete-webhook-simulation

`packages/server/api/src/app/workers/worker-controller.ts` declares `POST /delete-webhook-simulation` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or docum…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /execute-variable

`packages/server/api/src/app/block-variable/block-variable-module.ts` declares `POST /execute-variable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or doc…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /model

`packages/server/api/src/app/ai/chat/ai-mcp-chat.controller.ts` declares `POST /model` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /open

`packages/server/api/src/app/ai/chat/ai-mcp-chat.controller.ts` declares `POST /open` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consu…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /resume-run

`packages/server/api/src/app/workers/worker-controller.ts` declares `POST /resume-run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who cons…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /save-payloads

`packages/server/api/src/app/workers/worker-controller.ts` declares `POST /save-payloads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who c…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /send-webhook-update

`packages/server/api/src/app/workers/worker-controller.ts` declares `POST /send-webhook-update` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /sign-in

`packages/server/api/src/app/authentication/authentication.controller.ts` declares `POST /sign-in` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or document…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /sign-out

`packages/server/api/src/app/authentication/authentication.controller.ts` declares `POST /sign-out` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documen…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /sign-up

`packages/server/api/src/app/authentication/authentication.controller.ts` declares `POST /sign-up` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or document…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /submit-payload

`packages/server/api/src/app/workers/worker-controller.ts` declares `POST /submit-payload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who …

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: POST /submit-payloads

`packages/server/api/src/app/workers/worker-controller.ts` declares `POST /submit-payloads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who…

wiringunused-endpoint

low 9-layer api wiring conf 1.00 Unused endpoint: PUT /

`packages/server/api/src/app/user-settings/user-settings.module.ts` declares `PUT /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…

wiringunused-endpoint

{# ── 2026-05-17 Round 14: AI-agent bridge footer ────────────────────── Discoverability: the /agents/voting/ guide + MCP manifest exist but aren't linked from anywhere users actually land. Small, opt-in footer. #}

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/48fc393f-1836-47d4-82d1-6e5622dc46fc/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/48fc393f-1836-47d4-82d1-6e5622dc46fc/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.