Overreach

What is Overreach?

Overreach is a CLI tool that audits AI-agent code diffs against the prompt that authorized them. It runs on any Node.js environment via npx and is designed for developers using AI coding agents such as Claude Code, Cursor, and Codex.

How to use Overreach?

Run npx -y -p overreach overreach-cli demo to try a demonstration. Provide the original prompt and the agent’s diff as input and Overreach returns a report of everything the agent added that was not in scope.

Key features of Overreach

• Audits code diffs against the original prompt
• Catches unauthorized dependencies, env vars, endpoints, and cron jobs
• Three-stage pipeline (LLM scope extraction, deterministic diff parsing and comparison)
• No API key required; falls back to deterministic regex extraction
• Coordinates multiple agents on the same repo with file claims and conflict detection
• Works across Claude Code, Cursor, and Codex simultaneously via JSON files committed to git

Use cases of Overreach

• Verifying that an AI coding agent only implements features explicitly requested in the prompt
• Detecting out-of-scope files, APIs, or environment changes introduced by an agent
• Managing multiple AI agents working on the same codebase to avoid conflicts

FAQ from Overreach

What does Overreach do?

Overreach compares the code diff produced by an AI agent against the prompt you gave it. It reports exactly what the agent added that was not authorized in the prompt.

Does Overreach require an API key?

No. Overreach can run without an API key and will fall back to deterministic regex-based extraction for scope comparison.

What kinds of unauthorized changes does Overreach catch?

It catches unauthorized dependencies, environment variables, endpoints, cron jobs, out-of-scope files, and features that the prompt never mentioned.

How does Overreach work?

It uses a three-stage pipeline: (1) an LLM call extracts the scope from the prompt into structured JSON, (2) deterministic regex parsing identifies what the diff actually adds, and (3) set arithmetic compares actual additions against authorized scope to produce findings.

Can Overreach coordinate multiple AI agents?

Yes. Overreach supports file claims, conflict detection, scope declarations, and check-in heartbeats across agents from Claude Code, Cursor, and Codex working on the same repository. Coordination uses JSON files committed to git and requires no server.