cocoindex-io/cocoindex-code

A super light-weight embedded code search engine CLI (AST based) that just works - improves speed and efficiency for coding agent 🌟 Star if you like it!

https://github.com/cocoindex-io/cocoindex-code · commit 5676897a169f · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/cocoindex-io/cocoindex-code
Commit: 5676897a169fe1d46cf1e4d2eaf323c9d91c8587
Generated: 2026-11-14T00:03:50+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	38	explicit	95%	100%
Code quality	75	adequate	90%	100%
Security	61	weak	85%	100%

AI provenance

Explicit AI attribution on 38% of first-party code added; an estimated 38% including velocity signals.

Explicitly attributed share (lower bound): 37.6%
Unattributed share in AI-consistent velocity bursts: 14.2%
Estimated AI-generated share: 37.6%

AI tool	Attributed commits	Lines added
Claude Code	72	7,435

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 2,677 of 7,124.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	1.121	2.474	0.45x
Security	0.374	0.899	0.42x

Month	Lines added	Attributed to AI
2026-01	904	0%
2026-02	1,225	47%
2026-03	7,958	17%
2026-04	3,417	37%
2026-05	41	0%
2026-06	1,600	99%
2026-07	1,731	84%
2026-08	1,250	28%
2026-10	1,671	49%

Evidence

Claude Code: trailer 'Co-authored-by: Claude' (5676897a169f)
Claude Code: trailer 'Co-authored-by: Claude' (b3834e634c98)
Claude Code: trailer 'Co-authored-by: Claude' (b883be0b5d76)
Claude Code: trailer 'Co-authored-by: Claude' (3aa066e0e7e7)
Claude Code: trailer 'Co-authored-by: Claude' (fbe3adb1e70a)
Claude Code: trailer 'Co-authored-by: Claude' (9feb04f867e3)
Claude Code: trailer 'Co-Authored-By: Claude' (519ce97363d0)
Claude Code: trailer 'Co-authored-by: Claude' (9fd2e7470a8b)
Claude Code: trailer 'Co-authored-by: Claude' (68298cc8d266)
Claude Code: PR description attribution (0c18fe33c3d2)
Claude Code: trailer 'Co-authored-by: Claude' (66bbb422fe93)
Claude Code: trailer 'Co-authored-by: Claude' (fd99851cd5e4)
Claude Code: trailer 'Co-Authored-By: Claude' (df021fbb6832)
Claude Code: trailer 'Co-Authored-By: Claude' (f8411fa6775e)
Claude Code: trailer 'Co-Authored-By: Claude' (3ce9fb5dc92f)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 1.08, CI runs tests; 16% of function code in complex or long functions; 2% duplicated lines. Weakest area: lint.

Area	Score
Complexity (lizard)	62
Duplication	89
Code smells (Opengrep)	40
Tests and CI	100
Documentation	80
Type safety	59
Process (Scorecard review/maintenance)	n/a

Functions: 259; mean complexity 3.8, 90th percentile 8; 6 complex and 3 long functions
Duplicated lines: 2.0% of 5,251 compared
Tests: 7,683 test lines for 7,124 source lines (ratio 1.08); CI test commands: pytest; 61% of recent source commits also change tests
Docs missing or thin: changelog

Most complex functions:

Security

Security posture is weak: 21 known vulnerabilities in 9 dependencies; 4 high-severity SAST findings; 24 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	79
Vulnerable dependencies (OSV)	39
CI workflows (zizmor)	1
Posture (policy, updates, signing, lockfiles)	60
OpenSSF Scorecard	n/a

Known vulnerabilities: 21 in 9 packages (critical 1, high 6, medium 12, low 2)
Posture checks passed: security policy, signed commits; missing: dependency updates, lockfiles

Top findings

Severity	Finding	Location
critical	`osv/GHSA-6q48-6c7w-9gw2`: certifi@2026.1.4 (PyPI) is affected by PYSEC-2026-4320, GHSA-6q48-6c7w-9gw2	uv.lock
high	`opengrep/dockerfile.security.missing-user-entrypoint`: By not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'. [confidence medium]	docker/Dockerfile:82
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	src/cocoindex_code/client.py:564
high	`opengrep/python.lang.security.audit.dangerous-subprocess-use-audit`: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low]	src/cocoindex_code/client.py:572
high	`opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query`: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low]	src/cocoindex_code/query.py:105
high	`osv/GHSA-2g87-pp6c-29x5`: aiohttp@3.14.3 (PyPI) is affected by GHSA-2g87-pp6c-29x5	uv.lock
high	`osv/GHSA-5wr8-gcqf-gqf3`: aiohttp@3.14.3 (PyPI) is affected by GHSA-5wr8-gcqf-gqf3	uv.lock
high	`osv/GHSA-9xw5-w5jj-pvcg`: aiohttp@3.14.3 (PyPI) is affected by GHSA-9xw5-w5jj-pvcg	uv.lock
high	`osv/GHSA-27vj-qcqg-25rc`: fsspec@2026.1.0 (PyPI) is affected by PYSEC-2026-4217, GHSA-27vj-qcqg-25rc	uv.lock
high	`osv/GHSA-g5ff-637f-6q2m`: litellm@1.88.6 (PyPI) is affected by GHSA-g5ff-637f-6q2m	uv.lock
high	`osv/GHSA-84m7-p3x7-pcfv`: mcp@2.0.0 (PyPI) is affected by GHSA-84m7-p3x7-pcfv	uv.lock
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-commit.yml:45
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-commit.yml:53
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-commit.yml:56
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-commit.yml:92
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/pre-commit.yml:95
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/release.yml:116
high	`zizmor/template-injection`: code injection via template expansion [confidence high]	.github/workflows/release.yml:297
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:32
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:37
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:42
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:48
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:66
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:72
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/release.yml:89

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

binary-release-asset: release v0.2.43 ships cocoindex_code-0.2.43.tar.gz (1 downloads)
binary-release-asset: release v0.2.42 ships cocoindex_code-0.2.42.tar.gz (13 downloads)
binary-release-asset: release v0.2.41 ships cocoindex_code-0.2.41.tar.gz (9 downloads)
binary-release-asset: release v0.2.40 ships cocoindex_code-0.2.40.tar.gz (10 downloads)
binary-release-asset: release v0.2.39 ships cocoindex_code-0.2.39.tar.gz (7 downloads)

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Source lines: 7,124; test lines: 7,683

Language	Lines
Python	14,598
TypeScript	159
Shell	50

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/cocoindex-io/cocoindex-code/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/cocoindex-io/cocoindex-code/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/cocoindex-io/cocoindex-code/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/cocoindex-io/cocoindex-code/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/cocoindex-io/cocoindex-code/security.svg)](https://repotrust.synapticcyber.com/r/github.com/cocoindex-io/cocoindex-code/)