Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

HKUDS/nanobot

https://github.com/HKUDS/nanobot · scanned 2026-05-15 05:01 UTC (3 weeks ago) · 10 languages

152 findings (34 legacy + 118 scanner) 44th percentile · Python · large (100-500K LoC) Scanner says 78 (lower by 5)

File as issue Image v2 schema
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 3 weeks ago · v1 · 27 findings from 1 source. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
70.0
/100
Repobility
62
27 legacy
9-layer
78
100.0% cov · 0 gaps
Critical
0
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-17-v4 calibration-aware
Component Sub-score Weight Contribution
structure_score 60.0 0.15 9.00
security_score 54.4 0.25 13.60
testing_score 100.0 0.20 20.00
documentation_score 85.0 0.15 12.75
practices_score 75.0 0.15 11.25
code_quality 59.0 0.10 5.90
Overall 1.00 72.5
Calibrated penalty buckets (security_score): web: 1.6 · agent: 5.8 · docker: 9.5 · threat: 28.8
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 16 Medium 2 Low 7 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 27 9-layer 0 Crowd 0 Layer: Quality 9 Security 9 Cicd 9

All 6956 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

LabelLayerStatusPath
r software healthy webui/src/main.tsx:r
AuthForm software healthy webui/src/App.tsx:AuthForm
handleSubmit software healthy webui/src/App.tsx:handleSubmit
readSidebarOpen software healthy webui/src/App.tsx:readSidebarOpen
App software healthy webui/src/App.tsx:App
msg software healthy webui/src/App.tsx:msg
warm software healthy webui/src/App.tsx:warm
handleModelNameChange software healthy webui/src/App.tsx:handleModelNameChange
handleLogout software healthy webui/src/App.tsx:handleLogout
Shell software healthy webui/src/App.tsx:Shell
normalizeLocale software healthy webui/src/i18n/config.ts:normalizeLocale
readStoredLocale software healthy webui/src/i18n/config.ts:readStoredLocale
detectNavigatorLocale software healthy webui/src/i18n/config.ts:detectNavigatorLocale
resolveInitialLocale software healthy webui/src/i18n/config.ts:resolveInitialLocale
persistLocale software healthy webui/src/i18n/config.ts:persistLocale
applyDocumentLocale software healthy webui/src/i18n/config.ts:applyDocumentLocale
localeOption software healthy webui/src/i18n/config.ts:localeOption
currentLocale software healthy webui/src/i18n/index.ts:currentLocale
setAppLanguage software healthy webui/src/i18n/index.ts:setAppLanguage
syncLocaleSideEffects software healthy webui/src/i18n/index.ts:syncLocaleSideEffects
fakeClient software healthy webui/src/tests/useSessions.test.tsx:fakeClient
wrap software healthy webui/src/tests/useSessions.test.tsx:wrap
Wrapper software healthy webui/src/tests/useSessions.test.tsx:Wrapper
rect software healthy webui/src/tests/thread-composer.test.tsx:rect
fakeClient software healthy webui/src/tests/useNanobotStream.test.tsx:fakeClient
wrap software healthy webui/src/tests/useNanobotStream.test.tsx:wrap
Wrapper software healthy webui/src/tests/useNanobotStream.test.tsx:Wrapper
makeClient software healthy webui/src/tests/thread-shell.test.tsx:makeClient
wrap software healthy webui/src/tests/thread-shell.test.tsx:wrap
session software healthy webui/src/tests/thread-shell.test.tsx:session
httpJson software healthy webui/src/tests/thread-shell.test.tsx:httpJson
pngFile software healthy webui/src/tests/thread-composer-attach.test.tsx:pngFile
resolveReady software healthy webui/src/tests/thread-composer-attach.test.tsx:resolveReady
r software healthy webui/src/tests/setup.ts:r
lastSocket software healthy webui/src/tests/nanobot-client.test.ts:lastSocket
loadMarkdownRenderer software healthy webui/src/components/MarkdownText.tsx:loadMarkdownRenderer
preloadMarkdownText software healthy webui/src/components/MarkdownText.tsx:preloadMarkdownText
MarkdownText software healthy webui/src/components/MarkdownText.tsx:MarkdownText
DeleteConfirm software healthy webui/src/components/DeleteConfirm.tsx:DeleteConfirm
EmptyState software healthy webui/src/components/EmptyState.tsx:EmptyState
titleFor software healthy webui/src/components/ChatList.tsx:titleFor
p software healthy webui/src/components/ChatList.tsx:p
ChatList software healthy webui/src/components/ChatList.tsx:ChatList
groupSessions software healthy webui/src/components/ChatList.tsx:groupSessions
MarkdownTextRenderer software healthy webui/src/components/MarkdownTextRenderer.tsx:MarkdownTextR…
ImageLightbox software healthy webui/src/components/ImageLightbox.tsx:ImageLightbox
next software healthy webui/src/components/ImageLightbox.tsx:next
onKey software healthy webui/src/components/ImageLightbox.tsx:onKey
NavButton software healthy webui/src/components/ImageLightbox.tsx:NavButton
LanguageSwitcher software healthy webui/src/components/LanguageSwitcher.tsx:LanguageSwitcher

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
MockClient software healthy webui/src/tests/app-layout.test.tsx:MockClient
FakeSocket software healthy webui/src/tests/nanobot-client.test.ts:FakeSocket
ApiError software healthy webui/src/lib/api.ts:ApiError
fans software healthy webui/src/lib/nanobot-client.ts:fans
NanobotClient software healthy webui/src/lib/nanobot-client.ts:NanobotClient
_Manager software healthy tests/test_tool_contextvars.py:196
TestSupportedExtensions software healthy tests/test_document_parsing.py:12
TestExtractText software healthy tests/test_document_parsing.py:37
TestIsTextExtension software healthy tests/test_document_parsing.py:283
DummyBus software healthy tests/test_msteams.py:24
FakeResponse software healthy tests/test_msteams.py:32
FakeHttpClient software healthy tests/test_msteams.py:46
TestHook software healthy tests/test_nanobot_facade.py:78
UserHook software healthy tests/test_nanobot_facade.py:264
TestResolveEnvVars software healthy tests/config/test_env_interpolation.py:13
TestResolveConfig software healthy tests/config/test_env_interpolation.py:51
_StopGatewayError software healthy tests/cli/test_commands.py:30
_FakeAgentLoop software healthy tests/cli/test_commands.py:1512
_FakeCron software healthy tests/cli/test_commands.py:1271
_FakeApiApp software healthy tests/cli/test_commands.py:977
_StopCron software healthy tests/cli/test_commands.py:1395
_FakeSession software healthy tests/cli/test_commands.py:1115
_FakeSessionManager software healthy tests/cli/test_commands.py:1508
_StopAfterCronSetup software healthy tests/cli/test_commands.py:1302
_FakeDream software healthy tests/cli/test_commands.py:1500
_FakeChannelManager software healthy tests/cli/test_commands.py:1531
_FakeCronService software healthy tests/cli/test_commands.py:1541
_FakeHeartbeatService software healthy tests/cli/test_commands.py:1557
_FakeServer software healthy tests/cli/test_commands.py:1567
_FakeReader software healthy tests/cli/test_commands.py:1583
_FakeWriter software healthy tests/cli/test_commands.py:1590
TestSanitizeSurrogates software healthy tests/cli/test_safe_file_history.py:9
TestSafeFileHistory software healthy tests/cli/test_safe_file_history.py:38
TestRestartCommand software healthy tests/cli/test_restart_command.py:44
TestToolHintKnownTools software healthy tests/agent/test_tool_hint.py:16
TestToolHintMCP software healthy tests/agent/test_tool_hint.py:111
TestToolHintFallback software healthy tests/agent/test_tool_hint.py:125
TestToolHintFolding software healthy tests/agent/test_tool_hint.py:147
TestToolHintMultipleCalls software healthy tests/agent/test_tool_hint.py:198
TestToolHintEdgeCases software healthy tests/agent/test_tool_hint.py:212
TestToolHintMixedFolding software healthy tests/agent/test_tool_hint.py:241
TestToolHintMaxLength software healthy tests/agent/test_tool_hint.py:259
_RecordingHook software healthy tests/agent/test_runner_reasoning.py:23
TestBuildRuntimeContext software healthy tests/agent/test_context_builder.py:25
TestMergeMessageContent software healthy tests/agent/test_context_builder.py:61
TestLoadBootstrapFiles software healthy tests/agent/test_context_builder.py:114
TestIsTemplateContent software healthy tests/agent/test_context_builder.py:156
TestBuildUserContent software healthy tests/agent/test_context_builder.py:181
TestBuildSystemPrompt software healthy tests/agent/test_context_builder.py:230
TestBuildMessages software healthy tests/agent/test_context_builder.py:272

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
README.md software healthy README.md
CLAUDE.md software healthy CLAUDE.md
THIRD_PARTY_NOTICES.md software healthy THIRD_PARTY_NOTICES.md
CONTRIBUTING.md software healthy CONTRIBUTING.md
Dockerfile software healthy Dockerfile
core_agent_lines.sh software healthy core_agent_lines.sh
pyproject.toml software healthy pyproject.toml
COMMUNICATION.md software healthy COMMUNICATION.md
SECURITY.md software healthy SECURITY.md
docker-compose.yml software healthy docker-compose.yml
entrypoint.sh software healthy entrypoint.sh
vite.config.ts software warning webui/vite.config.ts
tsconfig.build.json software healthy webui/tsconfig.build.json
README.md software healthy webui/README.md
tailwind.config.js software warning webui/tailwind.config.js
package.json software healthy webui/package.json
index.html software healthy webui/index.html
package-lock.json software healthy webui/package-lock.json
components.json software healthy webui/components.json
tsconfig.json software healthy webui/tsconfig.json
postcss.config.js software warning webui/postcss.config.js
globals.css software healthy webui/src/globals.css
main.tsx software healthy webui/src/main.tsx
App.tsx software healthy webui/src/App.tsx
config.ts software healthy webui/src/i18n/config.ts
index.ts software healthy webui/src/i18n/index.ts
common.json software healthy webui/src/i18n/locales/id/common.json
common.json software healthy webui/src/i18n/locales/ko/common.json
common.json software healthy webui/src/i18n/locales/es/common.json
common.json software healthy webui/src/i18n/locales/ja/common.json
common.json software healthy webui/src/i18n/locales/fr/common.json
common.json software healthy webui/src/i18n/locales/en/common.json
common.json software healthy webui/src/i18n/locales/zh-TW/common.json
common.json software healthy webui/src/i18n/locales/vi/common.json
common.json software healthy webui/src/i18n/locales/zh-CN/common.json
message-bubble.test.tsx software warning webui/src/tests/message-bubble.test.tsx
useSessions.test.tsx software healthy webui/src/tests/useSessions.test.tsx
thread-composer.test.tsx software healthy webui/src/tests/thread-composer.test.tsx
format.i18n.test.ts software warning webui/src/tests/format.i18n.test.ts
app-layout.test.tsx software healthy webui/src/tests/app-layout.test.tsx
useNanobotStream.test.tsx software healthy webui/src/tests/useNanobotStream.test.tsx
thread-shell.test.tsx software healthy webui/src/tests/thread-shell.test.tsx
thread-composer-attach.test.tsx software healthy webui/src/tests/thread-composer-attach.test.tsx
api.test.ts software warning webui/src/tests/api.test.ts
setup.ts software healthy webui/src/tests/setup.ts
thread-viewport.test.tsx software warning webui/src/tests/thread-viewport.test.tsx
thread-messages.test.tsx software warning webui/src/tests/thread-messages.test.tsx
nanobot-client.test.ts software healthy webui/src/tests/nanobot-client.test.ts
main-randomuuid.test.tsx software warning webui/src/tests/main-randomuuid.test.tsx
i18n.test.tsx software warning webui/src/tests/i18n.test.tsx

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
webui software healthy webui
src software healthy webui/src
i18n software healthy webui/src/i18n
locales software healthy webui/src/i18n/locales
id software healthy webui/src/i18n/locales/id
ko software healthy webui/src/i18n/locales/ko
es software healthy webui/src/i18n/locales/es
ja software healthy webui/src/i18n/locales/ja
fr software healthy webui/src/i18n/locales/fr
en software healthy webui/src/i18n/locales/en
zh-TW software healthy webui/src/i18n/locales/zh-TW
vi software healthy webui/src/i18n/locales/vi
zh-CN software healthy webui/src/i18n/locales/zh-CN
tests software healthy webui/src/tests
components software healthy webui/src/components
settings software healthy webui/src/components/settings
thread software healthy webui/src/components/thread
ui software healthy webui/src/components/ui
providers software healthy webui/src/providers
lib software healthy webui/src/lib
workers software healthy webui/src/workers
hooks software healthy webui/src/hooks
tests software healthy tests
security software healthy tests/security
config software healthy tests/config
cli software healthy tests/cli
agent software healthy tests/agent
tools software healthy tests/agent/tools
utils software healthy tests/utils
heartbeat software healthy tests/heartbeat
providers software healthy tests/providers
cron software healthy tests/cron
tools software healthy tests/tools
channels software healthy tests/channels
session software healthy tests/session
command software healthy tests/command
docs software healthy docs
bridge software healthy bridge
src software healthy bridge/src
.github software healthy .github
ISSUE_TEMPLATE software healthy .github/ISSUE_TEMPLATE
workflows software healthy .github/workflows
nanobot software healthy nanobot
security software healthy nanobot/security
config software healthy nanobot/config
api software healthy nanobot/api
cli software healthy nanobot/cli
agent software healthy nanobot/agent
tools software healthy nanobot/agent/tools
utils software healthy nanobot/utils

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
port:18790 network healthy Dockerfile
port:8900 network healthy docker-compose.yml
port:1000 network healthy entrypoint.sh
port:5173 network healthy webui/vite.config.ts
port:5174 network healthy webui/vite.config.ts
port:18791 network healthy tests/cli/test_commands.py
port:18900 network healthy tests/cli/test_commands.py
port:9999 network healthy tests/agent/test_onboard_logic.py
port:29901 network healthy tests/channels/test_websocket_http_routes.py
port:29902 network healthy tests/channels/test_websocket_http_routes.py
port:29906 network healthy tests/channels/test_websocket_http_routes.py
port:29903 network healthy tests/channels/test_websocket_http_routes.py
port:29910 network healthy tests/channels/test_websocket_http_routes.py
port:29909 network healthy tests/channels/test_websocket_http_routes.py
port:29904 network healthy tests/channels/test_websocket_http_routes.py
port:29905 network healthy tests/channels/test_websocket_http_routes.py
port:29907 network healthy tests/channels/test_websocket_http_routes.py
port:29908 network healthy tests/channels/test_websocket_http_routes.py
port:29920 network healthy tests/channels/test_websocket_media_route.py
port:29921 network healthy tests/channels/test_websocket_media_route.py
port:29922 network healthy tests/channels/test_websocket_media_route.py
port:29923 network healthy tests/channels/test_websocket_media_route.py
port:29924 network healthy tests/channels/test_websocket_media_route.py
port:29925 network healthy tests/channels/test_websocket_media_route.py
port:29926 network healthy tests/channels/test_websocket_media_route.py
port:29917 network healthy tests/channels/test_websocket_integration.py
port:29876 network healthy tests/channels/test_websocket_channel.py
port:29877 network healthy tests/channels/test_websocket_channel.py
port:29878 network healthy tests/channels/test_websocket_channel.py
port:29879 network healthy tests/channels/test_websocket_channel.py
port:29891 network healthy tests/channels/test_websocket_channel.py
port:29892 network healthy tests/channels/test_websocket_channel.py
port:29880 network healthy tests/channels/test_websocket_channel.py
port:29881 network healthy tests/channels/test_websocket_channel.py
port:29882 network healthy tests/channels/test_websocket_channel.py
port:29883 network healthy tests/channels/test_websocket_channel.py
port:29884 network healthy tests/channels/test_websocket_channel.py
port:29885 network healthy tests/channels/test_websocket_channel.py
port:29886 network healthy tests/channels/test_websocket_channel.py
port:29887 network healthy tests/channels/test_websocket_channel.py
port:29930 network healthy tests/channels/test_websocket_channel.py
port:29931 network healthy tests/channels/test_websocket_channel.py
port:29932 network healthy tests/channels/test_websocket_channel.py
port:29933 network healthy tests/channels/test_websocket_channel.py
port:29934 network healthy tests/channels/test_websocket_channel.py
port:443 network healthy nanobot/agent/tools/mcp.py

LabelLayerStatusPath
127.0.0.1 network healthy docker-compose.yml
127.0.0.2 network healthy tests/security/test_security_network.py
10.0.0.1 network healthy tests/security/test_security_network.py
172.16.5.1 network healthy tests/security/test_security_network.py
192.168.1.1 network healthy tests/security/test_security_network.py
169.254.169.254 network healthy tests/security/test_security_network.py
93.184.216.34 network healthy tests/security/test_security_network.py
140.82.121.3 network healthy tests/security/test_security_network.py
100.64.0.0 network healthy tests/security/test_security_network.py
100.100.1.1 network healthy tests/security/test_security_network.py
192.168.1.2 network healthy tests/agent/test_runner_safety.py
192.168.8.188 network healthy tests/providers/test_local_endpoint_detection.py
10.0.0.5 network healthy tests/providers/test_local_endpoint_detection.py
172.16.0.1 network healthy tests/providers/test_local_endpoint_detection.py
172.31.255.255 network healthy tests/providers/test_local_endpoint_detection.py
172.32.0.1 network healthy tests/providers/test_local_endpoint_detection.py
192.168.1.5 network healthy tests/channels/test_websocket_http_routes.py
10.0.0.0 network healthy nanobot/security/network.py
127.0.0.0 network healthy nanobot/security/network.py
169.254.0.0 network healthy nanobot/security/network.py
172.16.0.0 network healthy nanobot/security/network.py
192.168.0.0 network healthy nanobot/security/network.py

LabelLayerStatusPath
auth::tests/cli/test_commands.py security healthy tests/cli/test_commands.py
auth::tests/agent/tools/test_self_tool.py security healthy tests/agent/tools/test_self_tool.py
auth::nanobot/providers/github_copilot_provider.py security healthy nanobot/providers/github_copilot_provider.py
auth::tests/tools/test_search_tools.py security healthy tests/tools/test_search_tools.py
auth::nanobot/providers/registry.py security healthy nanobot/providers/registry.py
auth::tests/test_msteams.py security healthy tests/test_msteams.py
auth::nanobot/config/schema.py security healthy nanobot/config/schema.py
auth::nanobot/channels/msteams.py security healthy nanobot/channels/msteams.py
auth::pyproject.toml security healthy pyproject.toml
auth::nanobot/providers/openai_codex_provider.py security healthy nanobot/providers/openai_codex_provider.py
auth::nanobot/cli/commands.py security healthy nanobot/cli/commands.py

LabelLayerStatusPath
image::Dockerfile hardware healthy Dockerfile
nanobot-gateway hardware healthy docker-compose.yml
nanobot-api hardware healthy docker-compose.yml
nanobot-cli hardware healthy docker-compose.yml

LabelLayerStatusPath
password_literal::tests/agent/tools/test_self_tool.py security healthy tests/agent/tools/test_self_tool.py
generic_api_key::tests/providers/test_litellm_kwargs.py security healthy tests/providers/test_litellm_kwargs.py
password_literal::tests/channels/test_email_channel.py security healthy tests/channels/test_email_channel.py
password_literal::tests/channels/test_email_channel.py security healthy tests/channels/test_email_channel.py

LabelLayerStatusPath
vps::aws hardware healthy tests/providers/test_bedrock_provider.py
vps::azure hardware healthy tests/providers/test_provider_sdk_retry_defaults.py

LabelLayerStatusPath
App frontend healthy webui/src/App.tsx
MarkdownTextRenderer frontend healthy webui/src/components/MarkdownTextRenderer.tsx

LabelLayerStatusPath
repobility-clone-yzephyjw software healthy /tmp/repobility-clone-yzephyjw

LabelLayerStatusPath
postgresql data healthy tests/tools/test_mcp_tool.py

LabelLayerStatusPath
test_config_migration.py data healthy tests/config/test_config_migration.py

LabelLayerStatusPath
gpu (detected) hardware healthy webui/src/components/ImageLightbox.tsx

LabelLayerStatusPath
gha::ci cicd healthy .github/workflows/ci.yml

LabelLayerStatusPath
test cicd healthy .github/workflows/ci.yml
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/9cb48be6-42ed-41b5-8e46-4312e8f96321/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/9cb48be6-42ed-41b5-8e46-4312e8f96321/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.