RepoTrust

youssofal/MTPLX

The fastest way to run Qwen 3.8 Flash Next, Qwen 3.8 27B and Ternary Bonsai 2 27B on a Mac: 125 tok/s in OpenCode on an M5 Max, and a 27B model on 16 GB Macs. Native MTP speculative decoding on Apple Silicon, exact at any temperature. OpenAI and Anthropic compatible local server.

https://github.com/youssofal/MTPLX · commit eb580fce3fe4 · scored 2026-11-14 · scoring prov-4+qual-2+sec-2

RepoTrust ai badge RepoTrust quality badge RepoTrust security badge

Dispute this score or request a re-score Full report JSON

Scores

Pillar Score Signal Confidence Coverage
AI provenance (estimated AI-generated share) 3 explicit 95% 100%
Code quality 68 adequate 90% 100%
Security 54 weak 85% 100%

AI provenance

Explicit AI attribution on 3% of first-party code added; an estimated 3% including velocity signals.

AI tool Attributed commits Lines added
OpenAI Codex 61 17,099
Claude Code 8 1,914

Current source lines last changed by AI-attributed commits: 11,134 of 399,994 (sampled).

Findings per 1,000 lines AI-attributed Other Ratio
Quality 0.629 0.494 1.27x
Security 0.898 0.445 2.02x
Month Lines added Attributed to AI
2026-05 95,479 12%
2026-06 167,260 0%
2026-07 80,186 2%
2026-08 181,556 1%
2026-09 189,538 2%
2026-10 16,817 0%
2026-11 4,107 0%

Evidence

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is adequate: test-to-source ratio 0.59, CI runs tests; 31% of function code in complex or long functions; 10% duplicated lines. Weakest area: type safety.

Area Score
Complexity (lizard) 40
Duplication 55
Code smells (Opengrep) 81
Tests and CI 90
Documentation 100
Type safety 1
Process (Scorecard review/maintenance) n/a

Most complex functions:

Security

Security posture is weak: 69 known vulnerabilities in 10 dependencies; 85 high-severity SAST findings; 15 high-severity workflow issues. Weakest area: ci actions.

Area Score
Secrets (gitleaks, tree + history) 65
Static analysis (Opengrep) 92
Vulnerable dependencies (OSV) 29
CI workflows (zizmor) 4
Posture (policy, updates, signing, lockfiles) 80
OpenSSF Scorecard n/a

Top findings

Severity Finding Location
critical osv/GHSA-5x8w-8jj5-q52h: pillow@12.3.0 (PyPI) is affected by PYSEC-2026-4330, GHSA-5x8w-8jj5-q52h uv.lock
critical osv/GHSA-8g5g-8vmr-9782: pillow@12.3.0 (PyPI) is affected by PYSEC-2026-4332, GHSA-8g5g-8vmr-9782 uv.lock
critical osv/GHSA-v9pv-5gc8-w2m6: pillow@12.3.0 (PyPI) is affected by PYSEC-2026-4339, GHSA-v9pv-5gc8-w2m6 uv.lock
critical osv/GHSA-xvh5-g6gv-559v: pillow@12.3.0 (PyPI) is affected by PYSEC-2026-4363, GHSA-xvh5-g6gv-559v uv.lock
critical osv/GHSA-332p-7hrc-92wf: pillow@12.3.0 (PyPI) is affected by GHSA-332p-7hrc-92wf uv.lock
critical osv/GHSA-w889-685w-c8fh: pillow@12.3.0 (PyPI) is affected by GHSA-w889-685w-c8fh uv.lock
high opengrep/javascript.browser.security.insecure-document-method: User controlled data in methods like innerHTML, outerHTML or document.write is an anti-pattern that can lead to XSS vulnerabilities [confidence low] dashboard/src/lib/uplotTooltip.ts:87
high opengrep/javascript.browser.security.insecure-innerhtml: User controlled data in a box.innerHTML is an anti-pattern that can lead to XSS vulnerabilities [confidence low] dashboard/src/lib/uplotTooltip.ts:87
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/aria2_downloader.py:234
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/benchmarks/code_eval.py:293
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/benchmarks/runners/preflight.py:36
high opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] mtplx/cache_bank/cold_tier.py:3108
high opengrep/python.sqlalchemy.security.sqlalchemy-execute-raw-query: Avoiding SQL string concatenation: untrusted input concatenated with raw SQL query can result in SQL Injection. In order to execute raw query safely, prepared statement should be used. SQLAlchemy provides TextualSQL to easily used prepared statement with named parameters. For complex SQL composition [confidence low] mtplx/cache_bank/cold_tier.py:3111
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/forge.py:1490
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/forge.py:2347
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/forge.py:3017
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'Popen' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/forge.py:3119
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:4839
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:4921
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:5208
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:6807
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:7872
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:8332
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'run' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:8518
high opengrep/python.lang.security.audit.dangerous-subprocess-use-audit: Detected subprocess function 'call' without a static string. If this data can be controlled by a malicious actor, it may be an instance of command injection. Audit the use of this call to ensure it is not controllable by an external resource. You may consider using 'shlex.escape()'. [confidence low] mtplx/commands/public.py:8569

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Distribution signals

Signals consistent with a repository that exists to distribute a download. They are heuristics, not a verdict; release files were not downloaded or inspected.

Repository profile

Language Lines
Python 511,233
Swift 114,948
TypeScript 6,221
Shell 3,214
C++ 2,672
C 618
JavaScript 286

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/youssofal/MTPLX/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/youssofal/MTPLX/)
[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/youssofal/MTPLX/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/youssofal/MTPLX/)
[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/youssofal/MTPLX/security.svg)](https://repotrust.synapticcyber.com/r/github.com/youssofal/MTPLX/)