Developer tools and workflows for safer AI-assisted coding.

Example output

$ python agent_change_risk_auditor.py --diff change.patch

AI Agent Change Risk Audit
Risk level: high
Risk score: 63/100
Files changed: 2
Lines: +3 / -1

Flags:
- DEPENDENCY_CHANGE:package.json
- SOURCE_CHANGED_WITHOUT_TEST_CHANGE
- POSSIBLE_SECRET_LITERAL_IN_DIFF

Recommendations:
- Add or update tests for changed source files before merge.
- Remove secret-like literals and rotate exposed credentials if real.
- Review dependency changes manually and run lockfile/security checks.

API mode — local HTTP server

# Start the local API server
$ python agent_change_risk_auditor.py serve --port 8080
AI Agent Change Risk Audit API v1.2.0 running on http://127.0.0.1:8080
Endpoints: POST /audit (diff body), GET / (health), GET /audit/schema (JSON schema)

# Audit a diff via HTTP
$ curl -X POST http://127.0.0.1:8080/audit \
    --data-binary @change.patch \
    -H "Content-Type: text/plain"

# Get the JSON schema for audit results
$ curl http://127.0.0.1:8080/audit/schema
{
  "version": "1.2.0",
  "result_schema": { ... },
  "flag_descriptions": { ... },
  "risk_levels": { ... }
}

# Health check
$ curl http://127.0.0.1:8080/health
{"status": "ok", "service": "ai-agent-change-risk-auditor", "version": "1.2.0"}

Use --serve to integrate with CI pipelines, pre-receive hooks, or team dashboards — no deployment, no cloud, no API keys. The server runs entirely on your machine.

CI / Git hook integration

# .github/workflows/risk-gate.yml
- name: AI Change Risk Gate
  run: python agent_change_risk_auditor.py audit --diff diff.patch

# .git/hooks/pre-commit
git diff --cached > /tmp/staged.patch
python agent_change_risk_auditor.py audit --diff /tmp/staged.patch

How it compares

FAQ

Does this replace code review?

No. It's a triage tool that tells you which parts of a diff need the most human attention. Always review code yourself before merging.

Does it scan for vulnerabilities?

No. Use Snyk, Dependabot, or OWASP Dependency-Check for vulnerability scanning. This tool flags review priority signals, not security vulnerabilities.

Does it send my code anywhere?

No. It's 100% local. No network calls, no cloud upload, no API keys. Your code never leaves your machine. The --serve mode binds to localhost only.

Can it produce false positives?

Yes. It uses pattern matching. Test fixtures may trigger "secret" flags, and generated-looking filenames may trigger "generated" flags. Use it as a triage signal, not ground truth.

What Python version do I need?

Python 3.10 or later. No external dependencies — just the standard library.

What's in the Pro Pack?

Multi-repo batch audit, agency client review checklist, pre-commit hook template, Slack/Teams webhook integration, and priority email support. Everything in Basic, plus team features.

What about refunds?

Contact us within 14 days for a full refund. No questions asked.

What is the --serve mode?

It starts a local HTTP API server on your machine (default: localhost:8080). Send POST /audit with a diff body, get a JSON risk report. GET /audit/schema returns the result schema. Great for CI pipelines and team tools. Zero deployment.

Still have doubts?

See the full objection handler & expanded FAQ for detailed answers to common concerns, or the manual review vs risk audit comparison.