Skip to content

RippleCheck v0.1.1

Latest
Latest

Choose a tag to compare

View all tags
@agrajeet-builds agrajeet-builds released this 19 Jul 20:46
v0.1.1
0aaf041

Insurance for AI-generated code. Know what else breaks before you change anything.

An AI assistant changes one function and reports success. It was right about that function — it just didn't check the eleven other files that call it. RippleCheck answers one question before you commit: what else touches this?

The scan is static, deterministic and entirely local. No account, no network call, no code leaves your machine.

Three ways to run it

MCP server — exposes a check_impact tool to any MCP-compatible client:

claude mcp add ripplecheck --scope user -- npx -y ripplecheck-mcp

Claude Code hooks — automatic reporting with no prompting. PostToolUse silently keeps a warm index current after every edit; Stop fires once when the assistant finishes and prints a single report covering everything it touched. See the README for the config.

Desktop app — a standalone Electron app (macOS + Windows) that watches a folder and shows impact live. Depends on no AI tool, no hooks, no MCP support. Downloads below.

CLI — npx -p ripplecheck-mcp ripplecheck /path/to/project

Core features

  • Deterministic scanning — reference-based resolution via ts-morph for JS/TS and Python's own ast module for Python. Not regex. Same input, same output, every time.
  • Risk levels by fan-out: safe (used nowhere else), moderate (1–2 other files), high (3+).
  • Adaptive report timing — waits for edits to settle (default 3.5s) so a burst of AI edits across many files lands as one report, not one per file.
  • Retest — re-scan a single finding after fixing it: fixed, unchanged, or now pointing somewhere different.
  • Fix prompts — copy-paste-ready prompts describing a finding and its call sites.
  • Session summaries and a whole-repository risk overview with tech-stack detection.
  • GitHub repository browser — sign in and scan a repo without cloning it by hand.
  • Optional AI enrichment (BYOK) — bring your own API key, stored encrypted at rest via Electron safeStorage and sent only to your chosen provider. Never to any RippleCheck server; there isn't one. With no key set, enrichment is skipped silently.

Languages: .js .jsx .ts .tsx, inline <script> in .html, and .py. Python analysis needs python3 (or py -3 on Windows) on your PATH; without it, Python files are skipped with a note and the JS/TS scan proceeds normally.

Installers are unsigned

Neither installer is code-signed, so both platforms will warn on first launch. This is expected.

macOS — drag to Applications, then right-click → Open, and click Open in the dialog. macOS remembers the decision; every later launch is a normal double-click. Double-clicking the first time gives you a dialog with no "open anyway" button, so use right-click.

Windows — SmartScreen may show "Windows protected your PC". Click More info → Run anyway.

Both warnings go away with a code-signing certificate, which this project doesn't have yet.

⚠️ The Windows build has not been tested on real Windows hardware

Read this before installing on Windows.

The .exe was built and verified to contain the correct files — the app bundle, the asar archive, and the unpacked python-analyzer.py that Python analysis needs. It targets x64 and the build completes without errors.

But it was produced on macOS and never run on Windows. Specifically unverified: whether the installer completes, whether the app launches afterward, whether Python analysis finds an interpreter, and whether the icon renders correctly.

Treat it as "compiles and contains the right files," not "known working." Community testing on real Windows is very welcome — please open an issue with what you find, working or not.

The macOS .dmg has been installed and run: it launches, watches a folder, and completes real scans including Python.

Known limitations

  • The risk level is a fan-out count. Three usages reads as "high" whether the change is a comment tweak or a signature rewrite.
  • Only top-level declarations are tracked — class methods, object properties and nested closures are not individually mapped.
  • Two unrelated functions sharing a name across files can be conflated, particularly in the Python path, which links by name rather than by resolved reference.
  • Dynamic references are invisible to static analysis: obj[methodName](), string-based imports, runtime dispatch. A clean report is not proof that nothing else depends on a symbol.
  • First scan of a large repository is slow; subsequent scans use a warm index.

Downloads

Platform File
macOS (Apple Silicon) RippleCheck-0.1.1-arm64.dmg
Windows (x64) RippleCheck Setup 0.1.1.exe

macOS Intel is not currently built. On Apple Silicon, building the Windows target from source additionally requires Rosetta 2 — see NOTES.md.

License: MIT © Agrajeet Verma

Assets 4
Loading