Overreach
- coding-agent
Overreach catches AI-agent scope creep. You give it the prompt you gave your coding agent and the diff it produced; it flags every part of the diff the prompt didn't authorize — unauthorized dependencies, env vars, endpoints, cron jobs, files, and features. Every finding is deter
About
What is Overreach?
Overreach is a CLI tool that audits AI-agent code diffs against the prompt that authorized them. It runs on any Node.js environment via npx and is designed for developers using AI coding agents such as Claude Code, Cursor, and Codex.
How to use Overreach?
Run npx -y -p overreach overreach-cli demo to try a demonstration. Provide the original prompt and the agent’s diff as input and Overreach returns a report of everything the agent added that was not in scope.
Key features of Overreach
- Audits code diffs against the original prompt
- Catches unauthorized dependencies, env vars, endpoints, and cron jobs
- Three-stage pipeline (LLM scope extraction, deterministic diff parsing and comparison)
- No API key required; falls back to deterministic regex extraction
- Coordinates multiple agents on the same repo with file claims and conflict detection
- Works across Claude Code, Cursor, and Codex simultaneously via JSON files committed to git
Use cases of Overreach
- Verifying that an AI coding agent only implements features explicitly requested in the prompt
- Detecting out-of-scope files, APIs, or environment changes introduced by an agent
- Managing multiple AI agents working on the same codebase to avoid conflicts
FAQ from Overreach
What does Overreach do?
Overreach compares the code diff produced by an AI agent against the prompt you gave it. It reports exactly what the agent added that was not authorized in the prompt.
Does Overreach require an API key?
No. Overreach can run without an API key and will fall back to deterministic regex-based extraction for scope comparison.
What kinds of unauthorized changes does Overreach catch?
It catches unauthorized dependencies, environment variables, endpoints, cron jobs, out-of-scope files, and features that the prompt never mentioned.
How does Overreach work?
It uses a three-stage pipeline: (1) an LLM call extracts the scope from the prompt into structured JSON, (2) deterministic regex parsing identifies what the diff actually adds, and (3) set arithmetic compares actual additions against authorized scope to produce findings.
Can Overreach coordinate multiple AI agents?
Yes. Overreach supports file claims, conflict detection, scope declarations, and check-in heartbeats across agents from Claude Code, Cursor, and Codex working on the same repository. Coordination uses JSON files committed to git and requires no server.
Details
- Author
- Naveja00
- Category
- coding-agent
- Repository
- naveja00/overreach
Overreach audits AI-agent code diffs against the prompt that authorized them. Give it the prompt you gave your coding agent and the diff it produced — it tells you exactly what the agent added that wasn't in scope.
Catches: unauthorized dependencies, env vars, endpoints, cron jobs, out-of-scope files, features the prompt never mentioned.
3-stage pipeline:
1. Scope extraction (LLM) — one cheap call reads your prompt into structured JSON
2. Diff parsing (deterministic) — regex-parses what the diff actually adds
3. Comparison (deterministic) — set arithmetic: actual - authorized = findings
No API key required. Falls back to deterministic regex extraction without a key.
Try it: npx -y -p overreach overreach-cli demo
Also coordinates multiple AI agents on the same repo — file claims, conflict detection, scope declarations, check-in heartbeats. Works across Claude Code, Cursor, and Codex simultaneously. Just JSON files committed to git, no server.
