overreach

Your AI wrote 2,000 lines. You have 10 minutes to review it.

Overreach tells you where to look first. You asked for a login form — it shows you the Stripe key, the checkout endpoint, and the cron job your AI agent added without asking. Deterministic, evidence-backed, no AI opinions.

$ npx -y overreach demo Overreach — AI PR Review ───────────────────────────────────────────────── You asked: "add a login form to the settings page" 5 files changed · 4 in scope · 1 outside scope Findings ✗ New environment variable: STRIPE_SECRET .env.example ✗ New API endpoint: /api/checkout src/app/api/checkout/route.ts ✗ Scheduled job added cron.config.ts ⚠ File outside scope: cron.config.ts cron.config.ts ⚠ Added dependency: stripe package.json Heads Up → New API route added but no test file updated → Dependencies changed but lockfile not updated → 3 source files changed but no tests updated ───────────────────────────────────────────────── 5 findings · review carefully · deterministic

You asked for a login form. Overreach found a payment system. Review those files before you merge.

# Just run it — zero setup cd your-project npx -y overreach

That's it. It auto-detects your changes, asks what you told the AI to do, and shows the review. No config files, no flags to memorize.

npm install -g overreach # Pipe a diff with an explicit prompt git diff | overreach --prompt "add user authentication" # Install as a pre-commit hook overreach init

No API key? No problem.Without a key, Overreach regex-parses your prompt offline. Instant, free, fully deterministic.

- Claude Code
- Cursor
- Codex
- GitHub Copilot
- Windsurf
- Aider

Any tool that writes code from a prompt. Overreach reviews the output, not the tool.

Unexpected changes (things the AI did that you didn't ask for)

Every finding isdeterministic— derived from your prompt and the diff by set arithmetic. No AI opinions. Just: "you asked for X, the diff also contains Y, and Y wasn't in X."

Heads Up (things you probably need to check)

Overreach also scans for practical cross-file issues that developers miss during review:

These aren't scope creep — they're the stuff you forget at 2am and find out about in production.

Most AI code reviewers use another AI to judge your code. That means opinions, hallucinations, and results that change between runs.
-

Extract scope— One cheap LLM call reads your prompt and extracts what you authorized (files, deps, env vars, endpoints). Or skip the LLM entirely with zero-key mode.

Parse the diff— Regex-based extraction. No LLM. Finds every file changed, dependency added, env var set, endpoint created. Runs in milliseconds.

Compare—actual − authorized = findings. Pure set arithmetic. Everything in the diff that wasn't in your prompt is a finding.

Stages 2 and 3 are pure functions — same input, same output, every time. No inference, no model drift.

Use Overreach as a GitHub Action to block AI scope creep on every PR:

# .github/workflows/overreach.yml - uses: Naveja00/Overreach@v1

Exit code1when unexpected changes are found — the AI agent can't skip this check.

AI agents can use Overreach to check their own work before committing:

# Claude Code claude mcp add overreach -- npx -y overreach --serve # Claude Desktop / Cursor — add to MCP config: { "mcpServers": { "overreach": { "command": "npx", "args": ["-y", "overreach", "--serve"] } } }

Overreach auto-detects your AI provider:

overreach # Interactive mode (recommended) overreach demo # Zero-key demo with sample diff overreach init # Install as pre-commit hook git diff | overreach --prompt "…" # Pipe a diff with explicit prompt overreach --diff file.diff --prompt "…" # Read diff from file overreach --scope scope.json --prompt "…" # Skip LLM, use pre-extracted scope overreach --json # Machine-readable JSON output overreach --serve # Start as MCP server

Add--jsonfor structured output (CI, piping, integrations):

{ "scope": { "files_allowed": [], "features_allowed": [] }, "actual": { "files_changed": [], "symbols_added": [] }, "findings": [ { "kind": "scope.env", "detail": "New environment variable STRIPE_SECRET not in authorized scope", "file": ".env.example", "severity": "high", "evidence": "STRIPE_SECRET" } ], "scope_creep_score": "HIGH", "blast_radius": { "warnings": [ { "pattern": "route-no-test", "message": "New API route added but no test file updated", "files": ["src/app/api/checkout/route.ts"], "suggestion": "Add tests for the new endpoint" } ] } }

Overreach sends anonymous usage pings: counts and enums only (score,findingscount, OS, version) —nevercode, prompts, file paths, or diff content. A one-time notice is printed on your first review. Opt out any time:

export OVERREACH_TELEMETRY=0 # or DO_NOT_TRACK=1

npm test # 241 deterministic assertions, zero API calls

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Create crafted UI components inspired by the best 21st.dev design engineers.

Bring agent evaluations, observability, and synthetic test set generation directly into your IDE for free with Galileo's new MCP server

An MCP server to help AI assistants to answer questions and generate AccelByte Extend SDK code more effectively .

MCP server for AI Diagram Maker — generate beautiful software engineering diagrams directly inside Cursor, Claude Desktop, Claude Code, or any MCP-compatible AI agent

ALAPI MCP Tools,Call hundreds of API interfaces via MCP

AI-powered SVG animation generator that transforms static files into animated SVG components using the Allyson platform

MCP server that gives AI assistants on-demand access to 1,500+ amCharts docs, ~300 code examples, and 1000+ class API references.

APIMatic MCP Server is used to validate OpenAPI specifications using APIMatic. The server processes OpenAPI files and returns validation summaries by leveraging APIMatic’s API.

One shared context layer for AI agents and humans — live API specs, DB schemas, and versioned contracts across repos so every agent and teammate works from the same source of truth.

Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB