Check Risk

Watch out

The score is explicitly a policy index, not the probability that a change will fail, and the README repeats that so nobody wires it to an incident forecast. Project status is v0.1: source plus an installable CLI archive exist, but npm publication and live Jev validation are still pending, so it is not on the registry and you install from the release tarball or build it yourself with Node.js 22 and pnpm. The shipped default policy is financial — P&L, trade validation, production IAM — and the README says to replace those path globs with your own sensitive areas, in particular because the production IAM patterns are literally iam/production/** and terraform/production/iam/**. Dependency detection is deliberately narrow: for npm it compares names across dependencies, devDependencies, optionalDependencies and peerDependencies in changed package.json files, treats section moves as additions and version-only updates as not, and does not interpret lockfile-only or transitive changes at all. Without an API key, --no-jev still gives you the deterministic findings but returns exit 2 and status incomplete, and auto-merge eligibility stays disabled. It assesses and prescribes; your CI, your reviewers and your merge controls still do the actual work. Copy reviewed against the repository README on 2026-10-04, not from running it.