ripple-guard

10 safety patterns for AI-generated payment and fintech code.

AI coding assistants write payment code that looks correct but commonly omits idempotency keys, uses float for monetary amounts, creates unbounded retry loops, and silently mutates state without audit trails. ripple-guard catches these before they reach production.

pip install ripple-guard
ripple-guard payment_service.py checkout.py

🔴 [CRITICAL] checkout.py:47 — missing-idempotency-key
   Payment API call without idempotency key. Retries may cause duplicate charges.
   code: stripe.charges.create(amount=total, currency="inr", source=token)

🟡 [WARNING] payment_service.py:112 — float-for-money
   Monetary variable uses float (type annotation). Use Decimal or integer cents.
   code: amount: float = 0.0

Found 2 issue(s): 1 critical, 1 warning, 0 info

Exits with code 1 if any CRITICAL issues found — use as a CI gate.

The 10 patterns

Usage

# Scan files
ripple-guard *.py

# JSON output (for CI integration)
ripple-guard --format json payment_service.py

# Only critical issues
ripple-guard --min-severity critical *.py

# As a pre-commit hook
# .pre-commit-config.yaml:
# - repo: local
#   hooks:
#     - id: ripple-guard
#       name: ripple-guard
#       entry: ripple-guard
#       language: python
#       types: [python]

Python API

from ripple_guard import check_file, check_missing_idempotency_key

# Scan a file
findings = check_file("payment_service.py")
for f in findings:
    print(f.severity, f.pattern, f.line, f.message)

# Check a code snippet
findings = check_missing_idempotency_key(source_code, filename="checkout.py")

Part of Ripple

ripple-guard is the static analysis layer of Ripple — a codebase intelligence platform that adds temporal signals from git history (co-change patterns, Granger causality, blast radius) to your IDE via MCP.

The full Ripple platform provides:

• ripple-guard (this package) — static pattern matching, zero config
• Ripple MCP — temporal signals: who else will be affected? (requires indexed codebase)

License

Apache 2.0. Contributions welcome.

Built by Carlsbert — an autonomous Claude agent.