Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

Tox1cCoder/AgenticChatbot

https://github.com/Tox1cCoder/AgenticChatbot · scanned 2026-06-16 00:41 UTC (2 months, 1 week ago)

204 raw signals (0 security + 204 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 1 week ago · v1 · 188 actionable findings from 1 signal source. 16 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
68.4
/100
Security checks
68
0 findings
System graph
68
100.0% cov · 188 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 37 Medium 7 Low 128 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 188 Crowd 0 Layer: Software 26 Frontend 1 Security 40 Cicd 1 Quality 70 Api 50
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 68.4/100 with 100.0% coverage. It contains 5516 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 204 findings — concentrated in quality (86), api (50), security (40). Risk profile is high: 0 critical, 37 high, 7 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 172 of 188 actionable findings. 204 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security auth conf 1.00 FastAPI DELETE `delete_conversation_ai_sdk` without auth dependency — app/api/ai_sdk.py:776
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/ai_sdk.py:776 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_conversation` without auth dependency — app/api/conversations.py:147
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/conversations.py:147 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_custom_agent` without auth dependency — app/api/custom_agents.py:96
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/custom_agents.py:96 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_document` without auth dependency — app/api/documents.py:471
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/documents.py:471 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `delete_task_plan` without auth dependency — app/api/task_plans.py:174
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/task_plans.py:174 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI DELETE `remove_server` without auth dependency — app/api/mcp.py:91
`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/mcp.py:91 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `toggle_server` without auth dependency — app/api/mcp.py:103
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/mcp.py:103 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `update_conversation_ai_sdk` without auth dependency — app/api/ai_sdk.py:752
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/ai_sdk.py:752 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `update_conversation` without auth dependency — app/api/conversations.py:134
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/conversations.py:134 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `update_custom_agent` without auth dependency — app/api/custom_agents.py:79
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/custom_agents.py:79 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PATCH `update_task_plan` without auth dependency — app/api/task_plans.py:128
`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/task_plans.py:128 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `<anonymous>` without auth dependency — app/api/ai_sdk.py:855
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/ai_sdk.py:855 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `<anonymous>` without auth dependency — app/api/ai_sdk.py:874
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/ai_sdk.py:874 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `<anonymous>` without auth dependency — app/api/ai_sdk.py:941
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/ai_sdk.py:941 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `add_server_from_url` without auth dependency — app/api/mcp.py:78
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/mcp.py:78 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `add_server` without auth dependency — app/api/mcp.py:65
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/mcp.py:65 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `complete_task_plan` without auth dependency — app/api/task_plans.py:155
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/task_plans.py:155 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_conversation_ai_sdk` without auth dependency — app/api/ai_sdk.py:682
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/ai_sdk.py:682 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_conversation` without auth dependency — app/api/conversations.py:48
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/conversations.py:48 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_custom_agent` without auth dependency — app/api/custom_agents.py:41
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/custom_agents.py:41 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_feedback` without auth dependency — app/api/feedback.py:13
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/feedback.py:13 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_message_stream` without auth dependency — app/api/messages.py:142
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/messages.py:142 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_message` without auth dependency — app/api/messages.py:109
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/messages.py:109 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_task_plan_manual` without auth dependency — app/api/task_plans.py:53
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/task_plans.py:53 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `create_task_plan` without auth dependency — app/api/task_plans.py:24
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/task_plans.py:24 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `execute_tool` without auth dependency — app/api/mcp.py:144
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/mcp.py:144 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `generate_conversation_title` without auth dependency — app/api/conversations.py:32
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/conversations.py:32 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `refresh_token` without auth dependency — app/api/auth.py:47
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/auth.py:47 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `refresh` without auth dependency — client_backend/api/auth.py:188
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
client_backend/api/auth.py:188 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `restore_session` without auth dependency — client_backend/api/auth.py:242
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
client_backend/api/auth.py:242 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `resume_interrupt` without auth dependency — app/api/messages.py:198
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/messages.py:198 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `stop_message_generation` without auth dependency — app/api/messages.py:164
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/messages.py:164 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `upload_document` without auth dependency — app/api/documents.py:261
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/documents.py:261 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `upload_documents` without auth dependency — app/api/documents.py:318
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/documents.py:318 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `verify_local_token` without auth dependency — client_backend/api/auth.py:312
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
client_backend/api/auth.py:312 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_document` without auth dependency — app/api/documents.py:448
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/documents.py:448 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI PUT `update_feedback` without auth dependency — app/api/feedback.py:76
`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
app/api/feedback.py:76 securityAuth fastapi unauth mutation
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: app/ai/mcp_config.json
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
app/ai/mcp_config.json VerificationMcp config
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in app/main.py:206
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
app/main.py:206 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in client_backend/main.py:85
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
client_backend/main.py:85 Cors wildcard
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in demo.py:2074
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
demo.py:2074 Local storage auth token
medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
CI/CD securityCoverage
medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected
Found 62 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.
Mock dataIncompleteGenerated repo pattern
low System graph quality Integrity conf 1.00 5 env vars used in code but missing from .env.example
Drift between code and config docs. The first few: `CHATBOT_API_BASE_URL`, `CHATBOT_WIDGET_WS_BASE_URL`, `CLIENT_ENV_FILE`, `LOCALAPPDATA`, `TAVILY_API_KEY`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break.
config drift
low System graph quality Maintenance conf 1.00 63 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph quality Production readiness conf 1.00 Composite production-readiness gap
Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.
Repo hardeningGenerated repo pattern
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 9 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 17 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: upload_support.py:upload_documents, upload_support.py:upload_document This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
17 occurrences
repo-level (17 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: client_backend/services/server_api.py:upload_documents_bytes_with_status, client_backend/services/server_api.py:upload_documents_bytes, client_backend/services/server_api.py:upload_document This is *the* AI-coder failure mode (4× more duplication in …
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 6 places
Functions with the same first-5-line body hash: client_backend/api/proxy.py:proxy_custom_agents, client_backend/api/proxy.py:proxy_custom_agents_options, client_backend/api/proxy.py:proxy_custom_agent, client_backend/api/proxy.py:proxy_ai_custom_agents This is *the* AI-coder failure mode (4× more …
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 7 places
Functions with the same first-5-line body hash: client_backend/api/proxy.py:proxy_conversation_custom_agents, client_backend/api/proxy.py:proxy_ai_conversation_custom_agents, client_backend/api/proxy.py:proxy_conversation_task_plans, client_backend/api/proxy.py:proxy_conversation_task_plans_manual …
duplicatesduplication
low System graph quality License conf 1.00 No license file detected
No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.
Repo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_inline_rich_response_v1` in app/core/response_constants.py:384
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_inline_rich_response_v1` in app/core/rich_placement.py:210
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_inline_rich_response_v1` in tests/test_article_image_flow.py:41
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_inline_rich_response_v1` in tests/test_rich_placement.py:133
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `_inline_rich_response_v1` in tests/test_rich_response_metadata.py:60
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `cache_cleared_v2` in demo.py:2121
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `client__old` in tests/test_multi_sidecar_hardening.py:883
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `config_copy` in app/services/mcp_service.py:108
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `from_buffer_copy` in client_backend/core/security.py:211
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/ai/graph.py:109
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/ai/schemas.py:184
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/api/ai_sdk.py:476
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/api/messages.py:227
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/interfaces/message_service_interface.py:96
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/schemas/message.py:53
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/schemas/workflow.py:105
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in app/services/event_streaming/ai_sdk_v6.py:38
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in tests/test_client_invocation_isolation.py:181
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in tests/test_message_history_pipeline.py:320
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in tests/test_rich_response_prompt_inventory.py:125
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `inline_rich_response_v1` in tests/test_rich_response_streaming.py:121
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `is_v1` in app/ui/rich_response.py:53
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `is_v1` in tests/test_demo_plan_widget.py:533
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in app/ai/agents/custom_agent.py:267
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in app/ai/deferred_tool_binding.py:43
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in app/core/mcp_adapter_utils.py:233
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in app/services/ai_service.py:118
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in app/services/message_service.py:112
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in client_backend/services/runtime_bridge.py:121
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/test_custom_agent_client_tool_resync.py:95
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: bulk_set_enabled
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/services/local_skills_registry.py:322
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_charref
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1898
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_comment
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1901
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_data
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1889
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_endtag
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1873
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_entityref
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1895
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_startendtag
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1882
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_starttag
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1821
low System graph software Dead code conf 1.00 Possibly dead Python function: list_user_messages
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/services/server_api.py:457
low System graph software Dead code conf 1.00 Possibly dead Python function: make_relative_to_root
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/core/paths.py:126
low System graph software Dead code conf 1.00 Possibly dead Python function: poll_document_status
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
upload_support.py:153
low System graph software Dead code conf 1.00 Possibly dead Python function: redact_env_for_audit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/core/security.py:340
low System graph software Dead code conf 1.00 Possibly dead Python function: redact_path_for_audit
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/core/security.py:307
low System graph software Dead code conf 1.00 Possibly dead Python function: reload_skill
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/services/local_skills_registry.py:274
low System graph software Dead code conf 1.00 Possibly dead Python function: render_document_list
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
upload_support.py:289
low System graph software Dead code conf 1.00 Possibly dead Python function: render_upload_section
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
upload_support.py:41
low System graph software Dead code conf 1.00 Possibly dead Python function: replace_display_math
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1934
low System graph software Dead code conf 1.00 Possibly dead Python function: replace_inline_math
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:1949
low System graph software Dead code conf 1.00 Possibly dead Python function: sanitize_filename
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/core/paths.py:85
low System graph software Dead code conf 1.00 Possibly dead Python function: search_skills
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/services/local_skills_registry.py:356
low System graph software Dead code conf 1.00 Possibly dead Python function: sort_key
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
demo.py:8287
low System graph software Dead code conf 1.00 Possibly dead Python function: stream_message
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/services/server_api.py:466
low System graph software Dead code conf 1.00 Possibly dead Python function: to_posix_path
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/core/paths.py:113
low System graph software Dead code conf 1.00 Possibly dead Python function: upload_document
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
upload_support.py:125
low System graph software Dead code conf 1.00 Possibly dead Python function: upload_document
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/services/server_api.py:695
low System graph software Dead code conf 1.00 Possibly dead Python function: validate_workspace_path
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
client_backend/core/paths.py:55
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph quality Integrity conf 1.00 Stub function `_get_base_system_prompt` (body is just `pass`/`return`) — app/ai/agents/base_agent.py:1272
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `authenticate_user` (body is just `pass`/`return`) — app/interfaces/auth_service_interface.py:12
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `close` (body is just `pass`/`return`) — app/services/client_runtime_store.py:250
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `upgrade` (body is just `pass`/`return`) — app/alembic/versions/1ce64a959f7d_merge_hitl_with_main.py:18
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `upgrade` (body is just `pass`/`return`) — app/alembic/versions/be1969e4b7f2_merge_heads.py:18
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `upgrade` (body is just `pass`/`return`) — app/alembic/versions/m4n5o6p7q8r9_merge_allow_custom_model_with_device_branch.py:18
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph api Wiring conf 1.00 Unused endpoint: ANY /ai/conversations/{conversation_id}/custom-agents
`client_backend/api/proxy.py` declares `ANY /ai/conversations/{conversation_id}/custom-agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /ai/custom-agents
`client_backend/api/proxy.py` declares `ANY /ai/custom-agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /ai/custom-agents/{custom_agent_id}
`client_backend/api/proxy.py` declares `ANY /ai/custom-agents/{custom_agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /conversations/{conversation_id}/custom-agents
`client_backend/api/proxy.py` declares `ANY /conversations/{conversation_id}/custom-agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /conversations/{conversation_id}/task-plans
`client_backend/api/proxy.py` declares `ANY /conversations/{conversation_id}/task-plans` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /custom-agents
`client_backend/api/proxy.py` declares `ANY /custom-agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /custom-agents/{custom_agent_id}
`client_backend/api/proxy.py` declares `ANY /custom-agents/{custom_agent_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /messages/{message_id}/feedbacks
`client_backend/api/proxy.py` declares `ANY /messages/{message_id}/feedbacks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /model-config
`client_backend/api/proxy.py` declares `ANY /model-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /providers
`client_backend/api/proxy.py` declares `ANY /providers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: ANY /providers/{provider_type}
`client_backend/api/proxy.py` declares `ANY /providers/{provider_type}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /servers/{server_name}
`client_backend/api/mcp.py` declares `DELETE /servers/{server_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /{conversation_id}
`client_backend/api/conversations.py` declares `DELETE /{conversation_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`client_backend/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /ai/custom-agents/options
`client_backend/api/proxy.py` declares `GET /ai/custom-agents/options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /custom-agents/options
`client_backend/api/proxy.py` declares `GET /custom-agents/options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /device
`client_backend/api/health.py` declares `GET /device` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /messages/{message_id}/feedbacks/stats
`client_backend/api/proxy.py` declares `GET /messages/{message_id}/feedbacks/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consume…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /messages/{message_id}/feedbacks/user
`client_backend/api/proxy.py` declares `GET /messages/{message_id}/feedbacks/user` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /model-config/options
`client_backend/api/proxy.py` declares `GET /model-config/options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /providers/{provider_type}/models
`client_backend/api/proxy.py` declares `GET /providers/{provider_type}/models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /servers
`client_backend/api/mcp.py` declares `GET /servers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /servers/{server_name}
`client_backend/api/mcp.py` declares `GET /servers/{server_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /session
`client_backend/api/auth.py` declares `GET /session` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /tools
`client_backend/api/mcp.py` declares `GET /tools` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /tools/{tool_name}
`client_backend/api/mcp.py` declares `GET /tools/{tool_name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /users
`client_backend/api/auth.py` declares `GET /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /users/{user_id}
`client_backend/api/proxy.py` declares `GET /users/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{conversation_id}
`client_backend/api/conversations.py` declares `GET /{conversation_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{conversation_id}/messages
`client_backend/api/conversations.py` declares `GET /{conversation_id}/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes i…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{name}
`client_backend/api/skills.py` declares `GET /{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /servers/{server_name}/toggle
`client_backend/api/mcp.py` declares `PATCH /servers/{server_name}/toggle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{conversation_id}
`client_backend/api/conversations.py` declares `PATCH /{conversation_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{name}/toggle
`client_backend/api/skills.py` declares `PATCH /{name}/toggle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /
`client_backend/api/conversations.py` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /conversations/{conversation_id}/task-plans/manual
`client_backend/api/proxy.py` declares `POST /conversations/{conversation_id}/task-plans/manual` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documentin…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /generate-title
`client_backend/api/conversations.py` declares `POST /generate-title` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /login
`client_backend/api/auth.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /logout
`client_backend/api/auth.py` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /model-config/reset
`client_backend/api/proxy.py` declares `POST /model-config/reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /providers/{provider_type}/validate
`client_backend/api/proxy.py` declares `POST /providers/{provider_type}/validate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /refresh
`client_backend/api/auth.py` declares `POST /refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /reload
`client_backend/api/skills.py` declares `POST /reload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /restore
`client_backend/api/auth.py` declares `POST /restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /servers
`client_backend/api/mcp.py` declares `POST /servers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /servers/from-url
`client_backend/api/mcp.py` declares `POST /servers/from-url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /signup
`client_backend/api/auth.py` declares `POST /signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /tools/{tool_name}/execute
`client_backend/api/mcp.py` declares `POST /tools/{tool_name}/execute` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /verify-local-token
`client_backend/api/auth.py` declares `POST /verify-local-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PUT /messages/{message_id}/feedbacks/{feedback_id}
`client_backend/api/proxy.py` declares `PUT /messages/{message_id}/feedbacks/{feedback_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who…
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: app/ai/agents/base_agent.py (1357 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: app/ai/graph.py (4908 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: app/services/document_processing_service.py (1649 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: app/services/message_service.py (2593 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: demo.py (10204 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_graph_planning_subagents.py (1903 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/491d6a1b-990f-4b9e-a42d-4174e16016ec/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/491d6a1b-990f-4b9e-a42d-4174e16016ec/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.