Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo
114 of your 150 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.
Upstream (GitHub) caused delay on this scan — not Repobility.
  • GitHub API rate-limited (HTTP 403) — preflight skipped, fell back to direct git clone.
  • Clone from GitHub took 206.54s for a 211.7 MB repo slow.
  • Repobility's analysis ran in 8.26s after the clone landed.

crewAIInc/crewAI

https://github.com/crewAIInc/crewAI · scanned 2026-06-17 01:53 UTC (2 months, 3 weeks ago) · 10 languages

443 raw signals (150 security + 293 graph) 11/13 scanners ran 39th percentile · Python · large (100-500K LoC)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 3 weeks ago · v3 · 312 actionable findings from 2 signal sources. 106 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
72.8
/100
Security checks
83
47 findings
System graph
63
100.0% cov · 265 findings
Critical
7
click to filter
Agents
10
0 votes
Crowd
0
reported
Score breakdown â 2026-05-18-v5
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 100.0 0.25 25.00
testing_score 100.0 0.20 20.00
documentation_score 82.0 0.15 12.30
practices_score 91.0 0.15 13.65
code_quality 55.0 0.10 5.50
Overall 1.00 89.2
security_score may be inflated — optional security scanners were skipped on this fast scan
Severity distribution — click a segment to filter
Active filters: severity: info × excluding tests × Reset all
Severity: Critical 7 High 4 Medium 136 Low 104 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 47 System graph 265 Crowd 0 Layer: Quality 167 Security 9 Software 23 Cicd 2 Frontend 1 Network 110
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 63.0/100 with 100.0% coverage. It contains 16293 nodes across 0 cross-layer flows, written primarily in mixed languages. Engine surfaced 293 findings — concentrated in quality (141), network (115), software (20). Risk profile is high: 11 critical, 0 high, 142 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 25 of 312 actionable findings. 418 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

info Security checks quality Quality conf 0.95 [COMP001] High cognitive complexity: Function `_sanitize_payload` has cognitive complexity 10 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand — nested branches, boolean chains, and recursion all weigh in. Breakdown: else=1, for=1, if=3, nested_bonus=3, recursion=2.
Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 — yours is 10.
scripts/age90_file_input_runner.py:41
info Security checks quality Quality conf 1.00 [SEC132] String concat where the language has interpolation (AI style drift): String built by concatenation where the language has cleaner interpolation (Python f-strings since 3.6, JS template literals since ES6). Not a vulnerability on its own, but a style signature of cross-language AI rewrites — the model wrote idiomatic Java/C# and then translated mechanically. When this style appears in only *some* files of a repo, it's a strong indicator of an AI-driven rewrite that needs a human review p
Python: `f"prefix {var} suffix"`. JS/TS: `` `prefix ${var} suffix` ``. Add a lint rule (pyupgrade UP032, eslint prefer-template) so future PRs catch this automatically.
docs/reo-tracking.js:11
info System graph quality Integrity conf 1.00 Commented-code block (11 lines) in lib/crewai/src/crewai/flow/visualization/assets/interactive.js:2325
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in conftest.py:77
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/cli/src/crewai_cli/crew_run_tui.py:2006
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai-tools/src/crewai_tools/tools/nl2sql/nl2sql_tool.py:320
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai/src/crewai/agents/step_executor.py:189
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai/src/crewai/experimental/agent_executor.py:2258
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai/src/crewai/llms/providers/bedrock/completion.py:1854
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai/src/crewai/memory/encoding_flow.py:424
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai/src/crewai/memory/types.py:12
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai/src/crewai/rag/factory.py:15
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (5 lines) in lib/crewai/tests/test_flow_conversation.py:41
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai-tools/src/crewai_tools/tools/file_writer_tool/file_writer_tool.py:44
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai-tools/tests/tools/brave_search_tool_test.py:340
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai/src/crewai/events/listeners/tracing/trace_listener.py:237
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai/src/crewai/experimental/conversational_mixin.py:112
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai/src/crewai/flow/runtime/__init__.py:165
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai/src/crewai/llms/base_llm.py:763
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai/src/crewai/memory/unified_memory.py:613
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai/src/crewai/tools/agent_tools/base_agent_tools.py:66
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (6 lines) in lib/crewai/tests/events/test_llm_finish_reason_response_id.py:113
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (7 lines) in lib/crewai-tools/src/crewai_tools/tools/brave_search_tool/base.py:286
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (7 lines) in lib/crewai/src/crewai/experimental/__init__.py:7
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
info System graph quality Integrity conf 1.00 Commented-code block (7 lines) in lib/crewai/src/crewai/llms/providers/anthropic/completion.py:676
A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest.
commented codeDead code
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/79a38bd6-8ae7-4ba7-866b-4c4ca1eeb85e/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/79a38bd6-8ae7-4ba7-866b-4c4ca1eeb85e/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.