Sanity - Pre-commit Risk Checker

Sanity acts as a pre-commit risk checker for AI-generated code changes. It evaluates code additions for dangerous statements, exposed secrets, and scope drift, and safely blocks risky commits.

Safety Nets & Snapshots

Whenever a commit is allowed (whether deemed safe, or overridden via --force), Sanity automatically creates a lightweight local git tag (e.g. sanity-snapshot-20260823-153012) pointing to the commit before the new changes. This ensures that even if an AI agent makes a destructive commit, you can easily view your history and roll it back using sanity rollback <number>.

Note: sanity-snapshot-* tags are intended strictly as local safety nets. Git naturally keeps tags local during a standard git push, so they won't clutter your remote repository unless you explicitly run git push --tags.

What it catches

• Mass deletions -- flags commits that delete far more code than they add
• Leaked secrets -- detects API keys, AWS credentials, private keys
• Dangerous commands -- catches rm -rf, DROP TABLE, force-push scripts
• Scope creep -- uses LLM analysis to verify changes match the stated task
• Auto-snapshots -- every commit gets a safety snapshot for easy rollback

Quick start

# Install
pip install -e .

# Set up your Groq API key (free tier)
cp .env.example .env
# Edit .env with your key from https://console.groq.com

# Install the pre-commit hook in your repo
sanity init

# Manually check staged changes
sanity check

# Rollback to a previous safe state
sanity rollback

Commands

Requirements

• Python 3.11+
• Git
• Groq API key (free, no credit card needed)