ImpactGuard CLI

Know what breaks before your PR merges.

ImpactGuard scans your codebase locally, builds a call graph, and tells you exactly which methods, callers, and API endpoints are affected when something changes — before you raise a PR.

npx impactguard-cli init
npx impactguard-cli check

How it works

Your code changes
      ↓
impactguard check
      ↓
⛔ Method Removed — confidence 95%
   Changed : DriversService.assignNearestDriver
   Callers : DriversController.assignDriver
   APIs    : POST /caption/assign
   Evidence:
     · Method removed: DriversService.assignNearestDriver
     · 1 direct caller: DriversController.assignDriver
     · 1 API endpoint affected: POST /caption/assign

Quick start

Setup — once per project

cd your-project
npx impactguard-cli init

After every code change

npx impactguard-cli check

That is it. Two commands. The tool remembers your baseline and compares automatically.

Language support

| Language | Framework | Scanner | |------------------|------------------------|--------------| | TypeScript/Node | NestJS | ts-morph AST | | JavaScript/Node | Express, Fastify | ts-morph AST | | Java | Spring Boot | Regex parser | | Python | FastAPI, Flask | Python AST |

# Node / NestJS / Express (default)
npx impactguard-cli init

# Java Spring Boot
npx impactguard-cli init --lang java

# Python FastAPI / Flask
npx impactguard-cli init --lang python

What it detects

| Change type | Confidence | What is shown | |---------------------|------------|--------------------------------------| | Method removed | 95% | All callers and API endpoints | | Signature changed | 90% | All callers passing wrong args | | Return type changed | 85% | All callers depending on old type | | Endpoint removed | 95% | All clients get 404 | | Method renamed | 45% | Heuristic — verify manually |

Every warning includes evidence explaining exactly why it was flagged.

Consumer rule

ImpactGuard only warns when something depends on what changed.

No consumer = silence. No noise. No false positives on isolated changes.

What it does NOT check

ImpactGuard is a heuristic static call-graph generator — not a runtime analyser. It does not check:

• Logic changes inside methods
• Feature flag behaviour
• Database migrations
• Config-driven logic changes
• Dynamic calls — service[method]()
• Runtime polymorphism
• Cross-service dependencies (Phase 3 — coming soon)
• Message queue consumers (Phase 3)

These are documented at the bottom of every report.

Commands

# Set up ImpactGuard for this project (run once)
npx impactguard-cli init

# Check impact after code changes (run every time)
npx impactguard-cli check

# Update baseline after intentional breaking change
npx impactguard-cli check --update-baseline

# Generate call graph manually
npx impactguard-cli generate --lang node

# Diff two call graph files manually
npx impactguard-cli diff baseline.json changed.json

# Install pre-push git hook
npx impactguard-cli install-hook

Requirements

• Node.js 16 or higher
• For Python projects: Python 3.6+
• No other dependencies — no Docker, no database, no server

The tool reads your source files locally. Nothing is sent anywhere.

Tested on

• NestJS backends with 100+ methods
• Express REST APIs
• Fastify services
• Spring Boot microservices
• FastAPI services

Positioning

ImpactGuard sits between your unit tests and integration tests:

Compiler → Unit Tests → ImpactGuard → Integration Tests → Production

It catches structural breaks — removed methods, changed signatures, removed endpoints — that cause immediate runtime failures in callers. Not a replacement for tests. A different layer.

Feedback

Testing ImpactGuard on your project? We want to know:

1. Did it catch something you would not have noticed?
2. Did it miss something it should have caught?
3. Was anything wrong or unhelpful?

Open an issue at github.com/impactcheckorg/impactcheck-cli/issues or email [email protected]

ImpactGuard is practical CI-level impact intelligence — not authoritative for exact runtime reachability. We identify likely impacts and explain why we think they are at risk.