NOTICKET Add CLI-vs-MCP token efficiency benchmark harness - #51
Draft
alexander-rykhlitskiap wants to merge 5 commits into
Draft
NOTICKET Add CLI-vs-MCP token efficiency benchmark harness#51alexander-rykhlitskiap wants to merge 5 commits into
alexander-rykhlitskiap wants to merge 5 commits into
Kodem Security / Kodem Security Code Scan
succeeded
Aug 21, 2026 in 6s
Kodem Security Code Scan
Code Weakness Security Report
PR/MR #51 - Created at 21 Aug 26 12:27 UTC
Policy scan result:
- Scanning result: Success ✅
- Matched protect policy: Warnings for everything
All PR/MR findings:
The following findings relate only to the new code added in this PR/MR to apolloio/apollo-io-cli:
- Total Issues in PR/MR: 2 (0 Critical, 0 High, 1 Medium, 1 Low, 0 Negligible)
- Code Weaknesses: 2
- Exposed Secrets: 0
| Short description | Kai Verdict | Type | Severity | Where to fix |
|---|---|---|---|---|
Active Debug Code
Show Rule IDavoid-console-log-all |
ℹ️ Likely False Positive
See whyThe flagged code is part of a benchmark utility script located in a benchmarks directory,not production application code. Its primary purpose is to generate and display a summary report of performance metrics t o the developer running the script, making the use of standard output via the console API both intentional and appropriate for this context. |
Code Weaknesses | Medium |
Detected in: benchmarks/token-efficiency/run.ts:389 benchmarks/token-efficiency/run.ts:396 🔧 Kodem Remediation1. Remove unnecessary logging statements before pushing to production. 2. Use a proper logging library that supports log levels and can be easily disabled in production, such as winston or log4js. 3. If you need to keep some logs for debugging, consider using console.debug() which can be easily filtered out in most browsers. 4. For temporary debugging, use breakpoints or debugger statements instead. |
Uncontrolled Resource Consumption
Show Rule IDavoid-settimeout-setinterval |
ℹ️ Likely False Positive
See whyThe use of setTimeout in this context is a standard and necessary pattern for implementing a process timeout when spawning child processes. The file path indicates this is a benchmark utility, where resource management via timeo uts is expected behavior. The timer is correctly cleared using clearTimeout within the process close event handler , preventing memory leaks, and the callback performs a synchronous cleanup by killing the child process and resolving the promise. |
Code Weaknesses | Low |
Detected in: benchmarks/token-efficiency/run.ts:218 🔧 Kodem Remediation1. For one-time delayed execution, consider using promises or async/await: await new Promise(resolve => setTimeout(resolve, delay)); 2. For recurring tasks, implement a more robust solution: - Use requestAnimationFrame() for visual updates. - Implement a custom scheduler with self-adjusting intervals. - Use a job scheduling library like node-schedule for server-side tasks. 3. Always store and clear timeouts/intervals when no longer needed: const timeoutId = setTimeout(...); clearTimeout(timeoutId); 4. For React applications, consider using the useEffect hook for timing operations. 5. For Node.js, look into setImmediate() or process.nextTick() for better performance in some cases. |
Loading