snowmead/rust-docs-mcp

MCP server for agents to explore rust docs, analyze source code, and build with confidence

https://github.com/snowmead/rust-docs-mcp · commit 8c89df058f3b · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/snowmead/rust-docs-mcp
Commit: 8c89df058f3be23db74435569c63fa8d08601767
Generated: 2026-11-13T23:52:16+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	55	explicit	95%	100%
Code quality	76	adequate	90%	100%
Security	55	weak	85%	100%

AI provenance

Explicit AI attribution on 55% of first-party code added; an estimated 55% including velocity signals.

Explicitly attributed share (lower bound): 55.4%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 55.4%

AI tool	Attributed commits	Lines added
Claude Code	49	18,094
OpenAI Codex	3	2,874
GitHub Copilot coding agent	1	0
Devin	1	1,225
Cursor agent	1	0

AI tooling configured in repo: claude-code

Current source lines last changed by AI-attributed commits: 13,144 of 22,820.

Findings per 1,000 lines	AI-attributed	Other	Ratio
Quality	0.0	0.0	n/a
Security	0.533	0.207	2.57x

Stylometry index: 0.68 per 1,000 lines (narrated steps 3, placeholders 0, assistant phrasing 1, emoji 21). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2025-06	15,554	39%
2025-07	3,129	100%
2025-08	3,557	99%
2025-09	41	0%
2025-10	819	100%
2025-11	1,965	98%
2026-04	2,622	78%
2026-07	6,243	0%
2026-09	2,988	100%

Evidence

Claude Code: trailer 'Co-Authored-By: Claude' (8c89df058f3b)
OpenAI Codex: PR branch 'codex/address-open-issues' (a3b5abf5c839)
Cursor agent: trailer 'Co-authored-by: Cursor Agent' (ad81bd3c966f)
Claude Code: trailer 'Co-Authored-By: Claude' (c8ad7890c06e)
Claude Code: trailer 'Co-authored-by: Claude' (42f0744a2f67)
Claude Code: trailer 'Co-authored-by: Claude' (59369680a5ec)
Claude Code: trailer 'Co-authored-by: Claude' (edd9ce870546)
Claude Code: trailer 'Co-Authored-By: Claude' (a175ca4fc1d6)
Claude Code: trailer 'Co-Authored-By: Claude' (1f38a2f649ae)
Claude Code: trailer 'Co-Authored-By: Claude' (b61a4d4ca535)
Claude Code: trailer 'Co-Authored-By: Claude' (d42f8dd70bfc)
Claude Code: trailer 'Co-Authored-By: Claude' (db97a77dc21d)
Claude Code: trailer 'Co-Authored-By: Claude' (6ed7472ab64a)
Claude Code: trailer 'Co-Authored-By: Claude' (606b82f0ffbc)
Claude Code: trailer 'Co-authored-by: Claude' (1b0bc28315e7)

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.15, CI runs tests; 21% of function code in complex or long functions; 9% duplicated lines. Weakest area: complexity.

Area	Score
Complexity (lizard)	53
Duplication	59
Code smells (Opengrep)	100
Tests and CI	82
Documentation	100
Type safety	n/a
Process (Scorecard review/maintenance)	n/a

Functions: 808; mean complexity 3.4, 90th percentile 8; 25 complex and 15 long functions
Duplicated lines: 8.9% of 16,204 compared
Tests: 3,407 test lines for 22,820 source lines (ratio 0.15); CI test commands: go test, cargo test; 23% of recent source commits also change tests
Docs missing or thin: none

Most complex functions:

Security

Security posture is weak: 65 known vulnerabilities in 29 dependencies; 17 high-severity workflow issues. Weakest area: ci actions.

Area	Score
Secrets (gitleaks, tree + history)	100
Static analysis (Opengrep)	97
Vulnerable dependencies (OSV)	12
CI workflows (zizmor)	3
Posture (policy, updates, signing, lockfiles)	20
OpenSSF Scorecard	n/a

Known vulnerabilities: 65 in 29 packages (critical 0, high 15, medium 11, low 8)
Posture checks passed: signed commits; missing: security policy, dependency updates, lockfiles

Top findings

Severity	Finding	Location
high	`osv/GHSA-vvp9-7p8x-rfvv`: lz4_flex@0.11.5 (crates.io) is affected by RUSTSEC-2026-0041, GHSA-vvp9-7p8x-rfvv	Cargo.lock
high	`osv/GHSA-rvr2-r3pv-5m4p`: oneshot@0.1.11 (crates.io) is affected by RUSTSEC-2026-0005, GHSA-rvr2-r3pv-5m4p	Cargo.lock
high	`osv/GHSA-8c75-8mhr-p7r9`: openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0463, GHSA-8c75-8mhr-p7r9	Cargo.lock
high	`osv/GHSA-pqf5-4pqq-29f5`: openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0473, GHSA-pqf5-4pqq-29f5	Cargo.lock
high	`osv/GHSA-xp3w-r5p5-63rr`: openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0474, GHSA-xp3w-r5p5-63rr	Cargo.lock
high	`osv/GHSA-ghm9-cr32-g9qj`: openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0475, GHSA-ghm9-cr32-g9qj	Cargo.lock
high	`osv/GHSA-hppc-g8h3-xhp3`: openssl@0.10.73 (crates.io) is affected by RUSTSEC-2026-0478, GHSA-hppc-g8h3-xhp3	Cargo.lock
high	`osv/RUSTSEC-2026-0414`: pulldown-cmark@0.13.0 (crates.io) is affected by RUSTSEC-2026-0414; also in cargo-modules/Cargo.lock	Cargo.lock
high	`osv/RUSTSEC-2026-0433`: pulldown-cmark@0.13.0 (crates.io) is affected by RUSTSEC-2026-0433; also in cargo-modules/Cargo.lock	Cargo.lock
high	`osv/GHSA-89vp-x53w-74fx`: rmcp@0.8.0 (crates.io) is affected by RUSTSEC-2026-0189, GHSA-89vp-x53w-74fx	Cargo.lock
high	`osv/GHSA-33f5-2c5q-wgwj`: rmcp@0.8.0 (crates.io) is affected by GHSA-33f5-2c5q-wgwj	Cargo.lock
high	`osv/GHSA-9pj6-vhgr-3mwh`: rmcp@0.8.0 (crates.io) is affected by GHSA-9pj6-vhgr-3mwh	Cargo.lock
high	`osv/GHSA-82j2-j2ch-gfr8`: rustls-webpki@0.103.6 (crates.io) is affected by RUSTSEC-2026-0104, GHSA-82j2-j2ch-gfr8	Cargo.lock
high	`osv/GHSA-gchp-q4r4-x4ff`: tar@0.4.44 (crates.io) is affected by RUSTSEC-2026-0068, GHSA-gchp-q4r4-x4ff	Cargo.lock
high	`osv/GHSA-xphw-cqx3-667j`: thin-vec@0.2.14 (crates.io) is affected by RUSTSEC-2026-0103, GHSA-xphw-cqx3-667j	cargo-modules/Cargo.lock
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/claude-code-review.yml:27
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/claude-code-review.yml:33
high	`zizmor/dangerous-triggers`: use of fundamentally insecure workflow trigger [confidence medium]	.github/workflows/claude.yml:4
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/claude.yml:32
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/claude.yml:38
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/nix.yml:19
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/nix.yml:21
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/nix.yml:23
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/rust.yml:24
high	`zizmor/unpinned-uses`: unpinned action reference [confidence high]	.github/workflows/rust.yml:27

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 22,820; test lines: 3,407

Language	Lines
Rust	25,966
Shell	261

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/snowmead/rust-docs-mcp/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/snowmead/rust-docs-mcp/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/snowmead/rust-docs-mcp/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/snowmead/rust-docs-mcp/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/snowmead/rust-docs-mcp/security.svg)](https://repotrust.synapticcyber.com/r/github.com/snowmead/rust-docs-mcp/)