Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

radiantlogicinc/fastworkflow

https://github.com/radiantlogicinc/fastworkflow · scanned 2026-06-15 23:45 UTC (2 months, 4 weeks ago)

97 raw signals (0 security + 97 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 4 weeks ago · v1 · 79 actionable findings from 1 signal source. 18 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
63.5
/100
Security checks
64
0 findings
System graph
64
100.0% cov · 79 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 10 Medium 5 Low 48 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 79 Crowd 0 Layer: Software 21 Frontend 1 Security 12 Quality 29 Api 16
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 63.5/100 with 100.0% coverage. It contains 2532 nodes across 16 cross-layer flows, written primarily in mixed languages. Engine surfaced 97 findings — concentrated in quality (47), software (21), api (16). Risk profile is high: 0 critical, 10 high, 5 medium. Recommended next step: open the quality layer findings first — that's where the highest-impact wins live.

Showing 63 of 79 actionable findings. 97 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .cursor/rules/taskmaster.mdc
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.cursor/rules/taskmaster.mdc:351 SecretsCursor rule
high System graph security auth conf 1.00 FastAPI POST `<anonymous>` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:1058
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:1058 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `<anonymous>` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:744
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:744 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `<anonymous>` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:815
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:815 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `<anonymous>` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:984
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:984 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `dump_all_conversations` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:1395
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:1395 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `generate_mcp_token` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:1450
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:1450 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `initialize` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:524
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:524 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `post_feedback` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:1275
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:1275 securityAuth fastapi unauth mutation
high System graph security auth conf 1.00 FastAPI POST `refresh_token` without auth dependency — fastworkflow/run_fastapi_mcp/__main__.py:666
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
fastworkflow/run_fastapi_mcp/__main__.py:666 securityAuth fastapi unauth mutation
medium System graph quality Agent instructions conf 1.00 Agent authority lacks a verifier contract: .cursor/skills/beads-workflow/SKILL.md
This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes.
.cursor/skills/beads-workflow/SKILL.md VerificationCursor rule
medium System graph security Agent instructions conf 1.00 Agent instruction contains unpinned remote install: .cursor/rules/dev_workflow.mdc
Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands.
.cursor/rules/dev_workflow.mdc:25 Supply chainCursor rule
medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data
A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.
Mock dataCritical flowGenerated repo pattern
medium System graph security security conf 1.00 Insecure pattern 'cors_wildcard' in fastworkflow/run_fastapi_mcp/__main__.py:409
Found a known-risky pattern (cors_wildcard). Review and replace if possible.
fastworkflow/run_fastapi_mcp/__main__.py:409 Cors wildcard
medium System graph quality Integrity conf 1.00 Network/subprocess call without timeout or try/except — fastworkflow/cli.py:472
`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries.
runtime safetyRobustness
low System graph quality Maintenance conf 1.00 158 TODO/FIXME markers
High count of TODO/FIXME/HACK markers — track them as issues so they're not forgotten.
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 166 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 16 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: fastworkflow/workflow.py:current_command_context, fastworkflow/workflow.py:current_command_context This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're …
16 occurrences
repo-level (16 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 4 occurrences Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: fastworkflow/session_state_store.py:load, fastworkflow/session_state_store.py:load, fastworkflow/session_state_store.py:load This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidat…
4 occurrences
repo-level (4 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `model_copy` in tests/test_parameter_extraction_error_regression.py:50
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: add_queue
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/user_message_queues.py:15
low System graph software Dead code conf 1.00 Possibly dead Python function: aforward
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/react.py:280
low System graph software Dead code conf 1.00 Possibly dead Python function: basic_checks
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/signatures.py:285
low System graph software Dead code conf 1.00 Possibly dead Python function: create_mcp_server_for_workflow
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/mcp_server.py:227
low System graph software Dead code conf 1.00 Possibly dead Python function: decorator
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/parameterize_func_decorator.py:8
low System graph software Dead code conf 1.00 Possibly dead Python function: dspySignature
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/dspy_utils.py:137
low System graph software Dead code conf 1.00 Possibly dead Python function: enablecache
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/workflow.py:14
low System graph software Dead code conf 1.00 Possibly dead Python function: execute_workflow_query
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/workflow_agent.py:416
low System graph software Dead code conf 1.00 Possibly dead Python function: fetch_example
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/cli.py:67
low System graph software Dead code conf 1.00 Possibly dead Python function: forward
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/signatures.py:268
low System graph software Dead code conf 1.00 Possibly dead Python function: forward
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/react.py:149
low System graph software Dead code conf 1.00 Possibly dead Python function: handle_json_rpc_request
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/mcp_server.py:174
low System graph software Dead code conf 1.00 Possibly dead Python function: intent_misunderstood
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/workflow_agent.py:409
low System graph software Dead code conf 1.00 Possibly dead Python function: list_context_names
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/context_utils.py:3
low System graph software Dead code conf 1.00 Possibly dead Python function: list_examples
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/cli.py:47
low System graph software Dead code conf 1.00 Possibly dead Python function: parameterize
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/parameterize_func_decorator.py:7
low System graph software Dead code conf 1.00 Possibly dead Python function: profile_invoke_command
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/chat_session.py:462
low System graph software Dead code conf 1.00 Possibly dead Python function: remove_queue
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/user_message_queues.py:19
low System graph software Dead code conf 1.00 Possibly dead Python function: save_examples_to_file
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/generate_param_examples.py:614
low System graph software Dead code conf 1.00 Possibly dead Python function: save_examples_to_json
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/utils/generate_param_examples.py:623
low System graph software Dead code conf 1.00 Possibly dead Python function: update_conversation
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
fastworkflow/run_fastapi_mcp/conversation_store.py:189
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph quality Integrity conf 1.00 Stub function `invoke_command` (body is just `pass`/`return`) — fastworkflow/command_interfaces.py:6
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph quality Integrity conf 1.00 Stub function `update` (body is just `pass`/`return`) — fastworkflow/utils/startup_progress.py:26
Likely an AI scaffold that was never filled in. Remove or implement.
Empty handlerDead code
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`fastworkflow/run_fastapi_mcp/__main__.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /conversations
`fastworkflow/run_fastapi_mcp/__main__.py` declares `GET /conversations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /probes/healthz
`fastworkflow/run_fastapi_mcp/__main__.py` declares `GET /probes/healthz` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /probes/readyz
`fastworkflow/run_fastapi_mcp/__main__.py` declares `GET /probes/readyz` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /activate_conversation
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /activate_conversation` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes …
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/dump_all_conversations
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /admin/dump_all_conversations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who co…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /admin/generate_mcp_token
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /admin/generate_mcp_token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consum…
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /cancel_pending
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /cancel_pending` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /initialize
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /initialize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /invoke_agent
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /invoke_agent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /invoke_agent_stream
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /invoke_agent_stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /invoke_assistant
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /invoke_assistant` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /new_conversation
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /new_conversation` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /perform_action
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /perform_action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /post_feedback
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /post_feedback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /refresh_token
`fastworkflow/run_fastapi_mcp/__main__.py` declares `POST /refresh_token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: fastworkflow/model_pipeline_training.py (1199 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: fastworkflow/run_fastapi_mcp/__main__.py (1533 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: tests/test_simple_workflow_template/test_workitem.py (1672 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/8066120e-599d-4700-b596-7bfd86a038f7/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/8066120e-599d-4700-b596-7bfd86a038f7/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.