Open sourcev0.5.1MIT

Know what a code change can break before you merge it.

RepoRipple follows a Git change through Python imports, TypeScript aliases, and local workspace packages. It traces the blast radius, recommends relevant tests, and packages the evidence for humans and coding agents.

Install from PyPI ↗View source ↗
RepoRipple tracing a changed file through its dependency blast radius and producing a high-risk report

Release proof

CLI, Action, and MCP
3 surfaces
v0.5.1 release gate
226 tests
Python, JavaScript, TypeScript
3 languages

Published Nov 3, 2026 · Verified on Python 3.11, 3.12, and 3.13

Built for the shape of real repositories

TypeScript aliases

Follows paths, baseUrl, local configuration inheritance, and modern .mts and .cts module entry points.

Workspace packages

Connects npm and Yarn workspace imports through package entry points, subpath exports, and conditional exports.

Changes with history

Retains pre-change dependency evidence so deleted and renamed source files still reveal their remaining dependents.

Workspace support reads local package.json declarations. External packages and pnpm-workspace.yaml are not resolved; configuration-only changes are flagged as risk without claiming a complete importer map.

One core, three workflows

CLI

Analyze a worktree or compare a branch, then emit a review-ready Markdown or JSON report.

GitHub Action

Attach impact evidence to pull requests and fail CI when a change crosses a configured risk threshold.

MCP server

Give coding agents typed tools to forecast proposed edits or inspect real changes inside an allowed workspace root.

Run it in one command.

The deterministic path needs no API key or hosted service. Use the package directly, run it without installing through uvx, or start its local MCP server.

pip install reporipple
reporipple . --base origin/main

# No-install execution
uvx reporipple . --base origin/main

# Read-only MCP server
uvx reporipple mcp --root /path/to/workspace

Trust boundaries

  • Repository files are parsed, never executed or uploaded by the deterministic analyzer.
  • Repository reads reject symlink traversal, and read-only MCP tools stay inside the configured workspace root.
  • Optional OpenRouter explanations receive anonymized evidence only and cannot change risk or CI results.

Try RepoRipple on a real change.

Published on PyPI and in the MCP Registry.

PyPI ↗MCP setup ↗Release notes ↗