BlastRadius

The problem Code review happens on the diff, but the damage a pull request does usually sits in code the diff doesn't show. A reviewer sees nineteen tidy files and misses the twentieth caller that still passes its arguments in the old order. Both arguments are strings, so TypeScript compiles, CI stays green, and real users get locked out. Our solution BlastRadius turns every pull request into a map of what it can break, and hands that map to IBM Bob, which does the review. A deterministic engine parses both sides of the branch with tree-sitter into a code graph in under a second, with no LLM or network. It: - walks reverse call and render edges from each changed unit to every dependent, and names the affected subsystems; - compares signatures before and after, and checks each caller the PR didn't update against the old and new parameter order, catching argument-swap bugs type checkers miss; - finds untested units and the ADR sections in scope; - produces a 0–100 risk score where every point has a written reason. A BlastRadius MCP server gives Bob this evidence as eight tools. Our custom BlastRadius Reviewer mode and reusable skill tell Bob to stop for a human at high risk, judge each ADR rule with a file and line, send one parallel subagent per risky subsystem to write and run a vitest regression test against a real in-memory database, and apply fixes only after approval. When watsonx.ai is configured, IBM Granite writes the plain-English summary from the evidence alone. Target users Reviewers and tech leads who merge pull requests daily, where one missed caller can become a security incident. How they use it - In Bob IDE: switch to BlastRadius Reviewer and say "review branch X". - CLI: blastradius review --head X --fail-on 70 prints the scored reasons and exits 2. - GitHub Actions: the CLI gates the merge and Bob Shell writes the review as a PR comment. What makes it creative and unique Other PR-risk tools score the diff and ask a model for an opinion. BlastRadius gives Bob evidence, not a prompt: every claim carries a file and line. Bob acts as a reviewer that proves what it says, with tests it wrote and ran and rules it checked against the team's own decisions. Why it works, and efficiently On three seeded PRs: - A copy change scores 6 and is approved in one pass. - Three lines in the session check score 70, reaching 34 units across 13 subsystems. - The hero PR scores 95. BlastRadius points to the missed caller at comments/[commentId]/route.ts:18. Bob's subagent test fails with "expected 403 to be 200", as does a second test proving the new archive route skips the activity log required by ADR-002. After the approved fixes, 5 of 5 tests pass. Across the three PRs, the diffs showed 21 files; the blast radius covered 56. Both hidden bugs were caught before merge, for 3.24 Bobcoins.