{"schema_version":"2","scorer_version":"0.1.0","scoring_version":"prov-4+qual-2+sec-2","generated_at":"2026-11-13T23:56:49.525517Z","repo":{"ref":{"host":"github.com","owner":"mrphrazer","name":"binary-ninja-headless-mcp"},"default_branch":"main","clone_url":"https://github.com/mrphrazer/binary-ninja-headless-mcp.git","html_url":"https://github.com/mrphrazer/binary-ninja-headless-mcp","description":"Headless Binary Ninja MCP server — giving AI agents deep reverse-engineering capabilities via 180 tools.","stars":264,"forks":24,"is_fork":false,"is_archived":false,"is_private":false,"size_kb":446,"primary_language":"Python","license_spdx":"GPL-2.0","created_at":"2026-03-03T15:37:01Z","pushed_at":"2026-09-19T15:35:42Z","security_policy_url":null,"distribution":{"owner_created_at":"2015-02-03T17:12:57Z","owner_type":"User","release_assets":[]}},"commit_sha":"7fafd7523838fa2627a972869e34815fc461834f","profile":{"lines_by_language":{"Python":27429,"C":30},"files_by_category":{"test":33,"source":22,"docs":4,"config":3,"binary":1},"source_lines":19449,"test_lines":8010},"pillars":{"ai_provenance":{"score":0.2,"confidence":0.74,"coverage":1.0,"label":"explicit","breakdown":{"attributed_share":0.0024,"suspected_share":0.4751,"estimated_share":0.0024,"ai_artifacts":0.0,"flagged_work_units":2.0,"flagged_releases":null},"summary":"Explicit AI attribution on 0% of first-party code added; an estimated 0% including velocity signals."},"quality":{"score":65.7,"confidence":0.9,"coverage":1.0,"label":"adequate","breakdown":{"complexity":37.8,"duplication":73.7,"lint":67.1,"testing":95.6,"docs":65.0,"type_safety":0.0,"process":null},"summary":"Code quality is adequate: test-to-source ratio 0.41, CI runs tests; 32% of function code in complex or long functions; 5% duplicated lines. Weakest area: type safety."},"security":{"score":73.7,"confidence":0.85,"coverage":1.0,"label":"adequate","breakdown":{"secrets":100.0,"sast":85.4,"dependencies":null,"ci_actions":63.1,"posture":0.0,"scorecard":null},"summary":"Security posture is adequate: 11 high-severity SAST findings; 2 high-severity workflow issues. Weakest area: posture."}},"analyzer_results":[{"analyzer":"sec-scorecard","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no published OpenSSF Scorecard result for this repo"},{"analyzer":"sec-registry","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":"no registry dependencies declared"},{"analyzer":"ai-attribution","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"commits":15.0,"attributed_commits":3.0,"attributed_commit_share":0.2,"effective_loc":30077.0,"attributed_loc":72.0,"attributed_loc_share":0.002393855770189846,"tools_detected":1.0},"findings":[],"evidence":[{"kind":"attribution-summary","description":"Claude Code: 3 attributed commits, 72 lines added","ref":null,"url":null,"weight":1.0},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"7756894cdaf0e28a912118f3f2bfc59e5e30eba0","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/commit/7756894cdaf0e28a912118f3f2bfc59e5e30eba0","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"ce0656d1ae4e6d182f15dc667baec6196a400446","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/commit/ce0656d1ae4e6d182f15dc667baec6196a400446","weight":0.9},{"kind":"attributed-commit","description":"Claude Code: trailer 'Co-Authored-By: Claude'","ref":"bc0a49f93ec9228c6719aaa982d24ffe370be376","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/commit/bc0a49f93ec9228c6719aaa982d24ffe370be376","weight":0.9}],"data":{"attributed_loc_by_commit":{"bc0a49f93ec9228c6719aaa982d24ffe370be376":5,"ce0656d1ae4e6d182f15dc667baec6196a400446":3,"7756894cdaf0e28a912118f3f2bfc59e5e30eba0":64},"tools":{"claude-code":{"name":"Claude Code","commits":3,"loc":72,"first_seen":1777796124,"last_seen":1777796707}},"monthly":{"2026-03":{"loc":15370,"attributed_loc":0},"2026-05":{"loc":78,"attributed_loc":72},"2026-08":{"loc":334,"attributed_loc":0},"2026-09":{"loc":14295,"attributed_loc":0}}},"error":null},{"analyzer":"ai-artifacts","pillar":"ai_provenance","status":"ok","tool_version":"signatures-v1","metrics":{"artifacts":0.0,"workflow_agents":0.0,"tools_configured":0.0},"findings":[],"evidence":[],"data":{"artifacts":[],"workflows":[],"tools":[]},"error":null},{"analyzer":"ai-velocity","pillar":"ai_provenance","status":"ok","tool_version":"prov-4","metrics":{"work_units":8.0,"flagged_units":2.0,"pre_ai_era_bursts":0.0,"pre_ai_era_measured_loc":0.0,"pre_ai_era_burst_loc":0.0,"measured_loc":14727.0,"flagged_loc":14290.0,"flagged_loc_share":0.9703266109866232,"max_loc_per_hour":2659.0,"median_loc_per_hour":913.5,"pr_timed_units":0.0,"excluded_import_loc":15350.0},"findings":[],"evidence":[{"kind":"velocity-burst","description":"10,636 lines of first-party code in ~4.0h (2,659 lines/hour, 1 commit session)","ref":"7fafd7523838fa2627a972869e34815fc461834f","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/commit/7fafd7523838fa2627a972869e34815fc461834f","weight":0.6},{"kind":"velocity-burst","description":"3,654 lines of first-party code in ~4.0h (914 lines/hour, 1 commit session)","ref":"7494690ed6b60c32995c2725562bfa69fb93e73a","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/commit/7494690ed6b60c32995c2725562bfa69fb93e73a","weight":0.27404999999999996}],"data":{"flagged_loc_by_commit":{"7494690ed6b60c32995c2725562bfa69fb93e73a":3654,"7fafd7523838fa2627a972869e34815fc461834f":10636},"excluded_import_commits":["bee81b9f98f7d8b6b0c36f904ab41c1d4553d840"]},"error":null},{"analyzer":"ai-release-velocity","pillar":"ai_provenance","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"ai-stylometry","pillar":"ai_provenance","status":"ok","tool_version":null,"metrics":{"lines_scanned":19449.0,"index":0.0,"count:narrated_steps":0.0,"per_kloc:narrated_steps":0.0,"files:narrated_steps":0.0,"count:placeholder":0.0,"per_kloc:placeholder":0.0,"files:placeholder":0.0,"count:emoji_in_code":0.0,"per_kloc:emoji_in_code":0.0,"files:emoji_in_code":0.0,"count:assistant_voice":0.0,"per_kloc:assistant_voice":0.0,"files:assistant_voice":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-secrets","pillar":"security","status":"ok","tool_version":"gitleaks 8.30.1","metrics":{"secrets_current":0.0,"secrets_history":0.0,"secrets_nonprod":0.0,"secrets_low_confidence":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-sast","pillar":"security","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"findings_high":11.0,"findings_medium":2.0,"findings_low":0.0,"weighted_findings":8.75,"scanned_lines":19449.0,"parse_errors":0.0},"findings":[{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify.py","line":174,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify.py:174"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify.py","line":343,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify.py:343"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify.py","line":1118,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify.py:1118"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify.py","line":1141,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify.py:1141"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify.py","line":1430,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify.py:1430"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify.py","line":1466,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify.py:1466"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify_special.py","line":155,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify_special.py:155"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify_special.py","line":421,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify_special.py:421"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/cli_verify_worker.py","line":90,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/cli_verify_worker.py:90"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/lifecycle_fuzzer.py","line":48,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/lifecycle_fuzzer.py:48"},{"rule_id":"opengrep/python.lang.security.audit.dangerous-subprocess-use-audit","severity":"high","message":"Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]","path":"binary_ninja_headless_mcp/managed_cli.py","line":232,"fingerprint":"python.lang.security.audit.dangerous-subprocess-use-audit:binary_ninja_headless_mcp/managed_cli.py:232"},{"rule_id":"opengrep/python.lang.security.audit.exec-detected","severity":"medium","message":"Detected the use of exec(). exec() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"binary_ninja_headless_mcp/backend.py","line":2507,"fingerprint":"python.lang.security.audit.exec-detected:binary_ninja_headless_mcp/backend.py:2507"},{"rule_id":"opengrep/python.lang.security.audit.eval-detected","severity":"medium","message":"Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources. [confidence low]","path":"binary_ninja_headless_mcp/backend.py","line":2510,"fingerprint":"python.lang.security.audit.eval-detected:binary_ninja_headless_mcp/backend.py:2510"}],"evidence":[],"data":{"rulesets":["python","c"]},"error":null},{"analyzer":"sec-deps","pillar":"security","status":"skipped","tool_version":null,"metrics":{},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-actions","pillar":"security","status":"ok","tool_version":"zizmor 1.32.0","metrics":{"workflows":1.0,"findings":4.0,"findings_high":2.0,"findings_medium":2.0,"findings_low":0.0,"penalty":27.6},"findings":[{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":14,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:14"},{"rule_id":"zizmor/unpinned-uses","severity":"high","message":"unpinned action reference [confidence high]","path":".github/workflows/ci.yml","line":17,"fingerprint":"unpinned-uses:.github/workflows/ci.yml:17"},{"rule_id":"zizmor/artipacked","severity":"medium","message":"credential persistence through GitHub Actions artifacts [confidence low]","path":".github/workflows/ci.yml","line":13,"fingerprint":"artipacked:.github/workflows/ci.yml:13"},{"rule_id":"zizmor/excessive-permissions","severity":"medium","message":"overly broad permissions [confidence medium]","path":".github/workflows/ci.yml","line":8,"fingerprint":"excessive-permissions:.github/workflows/ci.yml:8"}],"evidence":[],"data":{},"error":null},{"analyzer":"sec-posture","pillar":"security","status":"ok","tool_version":null,"metrics":{"check:security_policy":0.0,"check:dependency_updates":0.0,"check:signed_commits":0.0,"check:lockfiles":1.0,"signed_commit_share":0.0667,"unpinned_manifests":0.0},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"sec-distribution","pillar":"security","status":"ok","tool_version":null,"metrics":{"signals":0.0,"binary_assets":0.0,"suspicious":0.0},"findings":[],"evidence":[],"data":{"signals":[],"suspicious":false,"unusual_traction":false,"metadata":true},"error":null},{"analyzer":"qual-complexity","pillar":"quality","status":"ok","tool_version":"lizard 1.25.1","metrics":{"functions":734.0,"function_nloc":16471.0,"mean_ccn":4.5,"p90_ccn":9.0,"complex_functions":26.0,"long_functions":18.0,"many_param_functions":9.0,"risky_nloc_share":0.3241},"findings":[],"evidence":[{"kind":"complex-function","description":"_update_state in binary_ninja_headless_mcp/fuzzer.py: complexity 94, 159 lines","ref":"binary_ninja_headless_mcp/fuzzer.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/fuzzer.py#L563","weight":1.0},{"kind":"complex-function","description":"_build_arguments in binary_ninja_headless_mcp/fuzzer.py: complexity 72, 188 lines","ref":"binary_ninja_headless_mcp/fuzzer.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/fuzzer.py#L788","weight":1.0},{"kind":"complex-function","description":"run_reads in binary_ninja_headless_mcp/cli_verify_reads.py: complexity 69, 396 lines","ref":"binary_ninja_headless_mcp/cli_verify_reads.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/cli_verify_reads.py#L10","weight":1.0},{"kind":"complex-function","description":"_value_for_field in binary_ninja_headless_mcp/fuzzer.py: complexity 67, 159 lines","ref":"binary_ninja_headless_mcp/fuzzer.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/fuzzer.py#L1014","weight":1.0},{"kind":"complex-function","description":"_workflow_machine_control in binary_ninja_headless_mcp/backend.py: complexity 33, 97 lines","ref":"binary_ninja_headless_mcp/backend.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/backend.py#L3486","weight":0.55},{"kind":"complex-function","description":"tool in binary_ninja_headless_mcp/cli_verify.py: complexity 32, 135 lines","ref":"binary_ninja_headless_mcp/cli_verify.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/cli_verify.py#L290","weight":0.5333333333333333},{"kind":"complex-function","description":"run_matrix in binary_ninja_headless_mcp/cli_verify.py: complexity 26, 162 lines","ref":"binary_ninja_headless_mcp/cli_verify.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/cli_verify.py#L1159","weight":0.43333333333333335},{"kind":"complex-function","description":"_run_batch_lines in binary_ninja_headless_mcp/binja_cli.py: complexity 25, 70 lines","ref":"binary_ninja_headless_mcp/binja_cli.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/binja_cli.py#L751","weight":0.4166666666666667},{"kind":"complex-function","description":"main in binary_ninja_headless_mcp/cli_verify.py: complexity 23, 181 lines","ref":"binary_ninja_headless_mcp/cli_verify.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/cli_verify.py#L1359","weight":0.38333333333333336},{"kind":"complex-function","description":"_dispatch_tools_list in binary_ninja_headless_mcp/server.py: complexity 22, 68 lines","ref":"binary_ninja_headless_mcp/server.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/server.py#L357","weight":0.36666666666666664}],"data":{},"error":null},{"analyzer":"qual-duplication","pillar":"quality","status":"ok","tool_version":"repotrust-dup-w6","metrics":{"compared_lines":15718.0,"duplicated_lines":798.0,"duplicated_share":0.0508,"files":22.0},"findings":[],"evidence":[{"kind":"duplicate-code","description":"6+ duplicated lines: binary_ninja_headless_mcp/backend.py:86 and binary_ninja_headless_mcp/backend.py:135","ref":"binary_ninja_headless_mcp/backend.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/backend.py#L86","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: binary_ninja_headless_mcp/backend.py:5016 and binary_ninja_headless_mcp/server.py:2448","ref":"binary_ninja_headless_mcp/backend.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/backend.py#L5016","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: binary_ninja_headless_mcp/catalog.py:261 and binary_ninja_headless_mcp/catalog.py:674","ref":"binary_ninja_headless_mcp/catalog.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/catalog.py#L261","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: binary_ninja_headless_mcp/cli_verify.py:859 and binary_ninja_headless_mcp/cli_verify.py:920","ref":"binary_ninja_headless_mcp/cli_verify.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/cli_verify.py#L859","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: binary_ninja_headless_mcp/fuzzer.py:302 and binary_ninja_headless_mcp/fuzzer.py:362","ref":"binary_ninja_headless_mcp/fuzzer.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/fuzzer.py#L302","weight":0.3},{"kind":"duplicate-code","description":"6+ duplicated lines: binary_ninja_headless_mcp/server.py:596 and binary_ninja_headless_mcp/server.py:627","ref":"binary_ninja_headless_mcp/server.py","url":"https://github.com/mrphrazer/binary-ninja-headless-mcp/blob/7fafd7523838fa2627a972869e34815fc461834f/binary_ninja_headless_mcp/server.py#L596","weight":0.3}],"data":{},"error":null},{"analyzer":"qual-lint","pillar":"quality","status":"ok","tool_version":"opengrep 1.33.1; rules f1d2b562b414","metrics":{"findings":13.0,"weighted_findings":31.0,"scanned_lines":19449.0,"category:best-practice":7.0,"category:correctness":4.0,"category:maintainability":2.0},"findings":[{"rule_id":"opengrep/python.lang.correctness.tempfile.tempfile-without-flush","severity":"high","message":"Using 'tmp.name' without '.flush()' or '.close()' may cause an error because the file may not exist when 'tmp.name' is used. Use '.flush()' or close the file before using 'tmp.name'.","path":"binary_ninja_headless_mcp/backend.py","line":121,"fingerprint":"python.lang.correctness.tempfile.tempfile-without-flush:binary_ninja_headless_mcp/backend.py:121"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"binary_ninja_headless_mcp/cli_verify.py","line":578,"fingerprint":"python.lang.best-practice.arbitrary-sleep:binary_ninja_headless_mcp/cli_verify.py:578"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"binary_ninja_headless_mcp/cli_verify_stateful.py","line":651,"fingerprint":"python.lang.best-practice.arbitrary-sleep:binary_ninja_headless_mcp/cli_verify_stateful.py:651"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"binary_ninja_headless_mcp/fuzzer.py","line":500,"fingerprint":"python.lang.best-practice.arbitrary-sleep:binary_ninja_headless_mcp/fuzzer.py:500"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"binary_ninja_headless_mcp/lifecycle_fuzzer.py","line":173,"fingerprint":"python.lang.best-practice.arbitrary-sleep:binary_ninja_headless_mcp/lifecycle_fuzzer.py:173"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.identical-is-comparison","severity":"high","message":"Found identical comparison using is. Ensure this is what you intended.","path":"binary_ninja_headless_mcp/managed_cli.py","line":49,"fingerprint":"python.lang.correctness.common-mistakes.identical-is-comparison:binary_ninja_headless_mcp/managed_cli.py:49"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"binary_ninja_headless_mcp/managed_cli.py","line":72,"fingerprint":"python.lang.best-practice.arbitrary-sleep:binary_ninja_headless_mcp/managed_cli.py:72"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"binary_ninja_headless_mcp/managed_cli.py","line":267,"fingerprint":"python.lang.best-practice.arbitrary-sleep:binary_ninja_headless_mcp/managed_cli.py:267"},{"rule_id":"opengrep/python.lang.best-practice.arbitrary-sleep","severity":"high","message":"time.sleep() call; did you mean to leave this in?","path":"binary_ninja_headless_mcp/managed_cli.py","line":298,"fingerprint":"python.lang.best-practice.arbitrary-sleep:binary_ninja_headless_mcp/managed_cli.py:298"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"binary_ninja_headless_mcp/catalog.py","line":40,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:binary_ninja_headless_mcp/catalog.py:40"},{"rule_id":"opengrep/python.lang.correctness.common-mistakes.string-concat-in-list","severity":"medium","message":"Detected strings that are implicitly concatenated inside a list. Python will implicitly concatenate strings when not explicitly delimited. Was this supposed to be individual elements of the list?","path":"binary_ninja_headless_mcp/cli_verify_mutations.py","line":616,"fingerprint":"python.lang.correctness.common-mistakes.string-concat-in-list:binary_ninja_headless_mcp/cli_verify_mutations.py:616"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"binary_ninja_headless_mcp/fuzzer.py","line":97,"fingerprint":"python.lang.maintainability.return-not-in-function:binary_ninja_headless_mcp/fuzzer.py:97"},{"rule_id":"opengrep/python.lang.maintainability.return-not-in-function","severity":"medium","message":"`return` only makes sense inside a function","path":"binary_ninja_headless_mcp/lifecycle.py","line":33,"fingerprint":"python.lang.maintainability.return-not-in-function:binary_ninja_headless_mcp/lifecycle.py:33"}],"evidence":[],"data":{},"error":null},{"analyzer":"qual-testing","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:has_tests":1.0,"check:test_ratio":0.8237,"check:ci_present":1.0,"check:ci_runs_tests":1.0,"check:ci_runs_lint":1.0,"check:tests_cochange":1.0,"test_lines":8010.0,"source_lines":19449.0,"test_ratio":0.4118,"ci_files":1.0,"cochange_share":0.7273,"cochange_commits":11.0},"findings":[],"evidence":[{"kind":"ci","description":"CI config: .github/workflows/ci.yml","ref":".github/workflows/ci.yml","url":null,"weight":0.0},{"kind":"ci","description":"CI runs tests (pytest)","ref":null,"url":null,"weight":0.0},{"kind":"ci","description":"CI runs linters (ruff)","ref":null,"url":null,"weight":0.0}],"data":{"test_commands":["pytest"],"lint_commands":["ruff"]},"error":null},{"analyzer":"qual-docs","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:readme":1.0,"check:license":1.0,"check:contributing":0.0,"check:changelog":0.0,"readme_lines":480.0},"findings":[],"evidence":[{"kind":"docs","description":"README.md","ref":"README.md","url":null,"weight":0.0},{"kind":"docs","description":"LICENSE","ref":"LICENSE","url":null,"weight":0.0}],"data":{},"error":null},{"analyzer":"qual-type-safety","pillar":"quality","status":"ok","tool_version":null,"metrics":{"check:strict_config":0.0,"check:low_escape_density":0.0,"escapes":878.0,"escapes_per_kloc":45.188},"findings":[],"evidence":[],"data":{},"error":null},{"analyzer":"x-blame","pillar":"ai_provenance","status":"ok","tool_version":"git-blame","metrics":{"ai_lines":0.0,"other_lines":19449.0,"files_blamed":22.0,"blame_failures":0.0,"quality:ai_findings":0.0,"quality:other_findings":13.0,"quality:other_per_kloc":0.668,"security:ai_findings":0.0,"security:other_findings":13.0,"security:other_per_kloc":0.668},"findings":[],"evidence":[],"data":{"sampled":false,"comparable":false},"error":null}],"flags":[]}