Understanding Results

Cadence analysis reports contain a layered set of information — a top‑level verdict, per-strategy detections, and source-specific metrics. This page explains every field so you can act on results with confidence.

Output Formats

Cadence's report engine supports five output formats: text, json, html, yaml, and bson. Which formats are accessible depends on the command.

cadence analyze — file extension selects format

The --output/-o flag is required. The file extension determines the format:

# Save as JSON (CI-friendly)
cadence analyze github.com/owner/repo -o report.json --config .cadence.yaml

# Save as plain text
cadence analyze github.com/owner/repo -o report.txt --config .cadence.yaml

Any other extension (e.g., .bson, .html, .yaml) will return an error from the CLI — those formats exist in the underlying reporter but are not yet surfaced as recognized extensions.

cadence web — flag selects format

The --output/-o flag is optional. Format is controlled by the --json/-j flag:

# Print human-readable text to terminal
cadence web https://example.com

# Save JSON report to file
cadence web https://example.com --json -o report.json

Output location

When -o is used, the file is written inside a reports/ subdirectory (e.g., -o report.json → reports/report.json). This directory is created automatically.

Top-Level Fields

Every report has these top-level fields, regardless of source type:

Score and Assessment

overallScore

The overall score (0–100) is a weighted sum of all triggered detections, capped at 100:

confidence is a per-strategy weight (0.0–1.0) reflecting how reliable that strategy's signal is. If a strategy does not set confidence, it defaults to 0.5.

assessment

The assessment string is derived from overallScore (for git/repository analysis):

For web and webhook analysis, the assessment is derived from the suspicionRate (fraction of triggered strategies):

suspicionRate

suspicionRate = detectionCount / totalDetections

This is a straightforward ratio — it does not account for severity or confidence. Use overallScore for a weighted view of risk.

Detections

Each entry in the detections array represents one strategy's evaluation result:

Reading a detection (JSON)

{
  "strategy": "commit_message_analysis",
  "detected": true,
  "severity": "high",
  "score": 0.87,
  "confidence": 0.9,
  "category": "linguistic",
  "description": "Commit messages show uniform formatting and vocabulary inconsistent with organic development",
  "examples": [
    "feat: implement complete authentication system",
    "feat: add full test suite with 100% coverage"
  ]
}

Interpreting severity

Strategies with detected: false appear in the report as passed checks — they confirm the source passed that signal's test.

Source Metrics

sourceMetrics contains aggregate statistics computed across all analyzed items:

Git-specific extra fields

Web-specific extra fields

Timing

The timing object records how long each phase of the analysis took:

{
  "timing": {
    "startedAt": "2024-01-15T10:00:00Z",
    "completedAt": "2024-01-15T10:00:04.5Z",
    "durationMs": 4500,
    "durationSeconds": 4.5,
    "phases": [
      { "name": "fetch",    "startedAt": "...", "durationMs": 1200 },
      { "name": "analyze",  "startedAt": "...", "durationMs": 3100 },
      { "name": "report",   "startedAt": "...", "durationMs": 200  }
    ]
  }
}

Sample Text Report

The text format printed by default (or to .txt) looks like this:

═══════════════════════════════════════════════════════════
CADENCE ANALYSIS REPORT - github
═══════════════════════════════════════════════════════════

Source ID:      github.com/owner/repo
Analysis ID:    a1b2c3d4-...
Started At:     2024-01-15 10:00:00.000 UTC
Completed At:   2024-01-15 10:00:04.500 UTC
Duration:       4.50s

Phase Breakdown:
  ├─ fetch:       1.20s
  ├─ analyze:     3.10s
  └─ report:      200ms

─────────────────────────────────────────────────────────────
ASSESSMENT
─────────────────────────────────────────────────────────────
Overall Score:  72.4%
Assessment:     Suspicious Activity Detected
Suspicion Rate: 60.0%

─────────────────────────────────────────────────────────────
STATISTICS
─────────────────────────────────────────────────────────────
Total Detections:     9
Detected:             5
Passed:               4
  ├─ High Severity:   2
  ├─ Medium Severity: 2
  └─ Low Severity:    1

─────────────────────────────────────────────────────────────
SOURCE METRICS
─────────────────────────────────────────────────────────────
Items Analyzed:       147
Items Flagged:        5
Unique Authors:       1
Average Score:        0.62
Coverage Rate:        100.0%
Strategies Used:      9
Strategies Triggered: 5
  timeSpan: 6 hours
  velocity: 24.5 commits/hour

─────────────────────────────────────────────────────────────
HIGH SEVERITY DETECTIONS
─────────────────────────────────────────────────────────────
• commit_message_analysis [linguistic] (87% score, 90% weight)
  Commit messages show uniform formatting inconsistent with organic development
  Examples: feat: implement complete auth system, feat: add full test suite

Acting on Results

Start with high-severity detections. These carry the most scoring weight and the clearest signals. For each:

1. Read the description to understand what the strategy found.
2. Review the examples — these are direct quotes from the source.
3. Decide whether the finding is a true positive or an explainable pattern (e.g., a team using standardised commit conventions).

Correlate across detections. A single triggered strategy may be a false positive. Multiple triggered strategies — especially across different categories (linguistic, behavioral, structural) — are much more diagnostic.

Use suspicionRate for a quick triage. If under 20%, the source passed most checks with low confidence findings; if over 60%, multiple independent signals align.

Save JSON for pipelines. Use -o report.json in CI so downstream tools can parse overallScore, highSeverityCount, and assessment programmatically.

Related Pages

• Quick Start — running your first analysis
• Quick Reference — all flags and environment variables
• Detection Reference — full field documentation and category constants