google/adk-java

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

https://github.com/google/adk-java · scanned 2026-05-15 13:34 UTC (4 weeks ago) · 10 languages

26 raw signals (12 security + 14 graph) 50th percentile · Java · large (100-500K LoC) System graph score 90 (lower by 14)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 weeks ago · v1 · 3 actionable findings from 1 signal source. 8 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

77.8% cov · 0 findings

Score breakdown â 2026-05-14-v3

Component	Sub-score	Weight	Contribution
`structure_score`	60.0	0.15	9.00
`security_score`	94.8	0.25	23.70
`testing_score`	80.0	0.20	16.00
`documentation_score`	85.0	0.15	12.75
`practices_score`	65.0	0.15	9.75
`code_quality`	54.5	0.10	5.45
Overall		1.00	76.7

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 1 Medium 1 Low 1 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 3 System graph 0 Crowd 0 Layer: Security 2 Quality 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade B+ (77/100). Dimensions: security 95, maintainability 60. 12 findings. 109,404 lines analyzed.

Showing 3 of 3 actionable findings. 11 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks security path traversal conf 0.80 [SEC013] Path Traversal — User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files.

Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads.

dev/browser/chunk-TXJFAAIW.js:2

medium Security checks security auth conf 0.92 [AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation.

low Security checks quality Quality conf 0.60 9 occurrences Duplicated implementation block across source files

Duplicate implementation blocks are maintenance debt. Keep them visible, but they are not a high-severity defect unless the duplicated logic is security-sensitive or drifting.

8 files, 9 locations

core/src/main/java/com/google/adk/tools/UrlContextTool.java:13, 15 (2 hits)

core/src/main/java/com/google/adk/flows/llmflows/CodeExecution.java:43

core/src/main/java/com/google/adk/runner/Runner.java:88

core/src/main/java/com/google/adk/sessions/InMemorySessionService.java:31

core/src/main/java/com/google/adk/sessions/VertexAiSessionService.java:41

core/src/main/java/com/google/adk/tools/GoogleSearchTool.java:13

core/src/main/java/com/google/adk/tools/applicationintegrationtoolset/IntegrationConnectorTool.java:171

dev/src/main/java/com/google/adk/web/controller/SessionController.java:35

duplicationquality

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/8b20d229-8149-49f5-9ad0-18d057f68f2d/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/8b20d229-8149-49f5-9ad0-18d057f68f2d/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.