Advisory Engine for AI-Assisted Engineering

Catch what AI breaks in your payments

DiffVet inspects diffs across Claude Code, Cursor, Antigravity, and GitHub pull requests. It hunts lost revenue, broken authentication, and corrupt state with exact file:line citations before you merge.

Get started with GitHub Explore the 6 tools

Free plan: 20 checks every month. Standard Model Context Protocol (MCP) and GitHub App.

claude-code — mcp: diffvet — business_risk_review

> claude "Run diffvet.business_risk_review on git diff"

[DiffVet] Analyzing 3 changed files (184 added lines, 26 removed lines)...

CRITICAL RISK src/checkout.py:42

Double-charge condition on network retry: payment intent created without an idempotency key. Gateway timeouts will charge customers twice.

Suggested Fix: Pass idempotency_key=f"order_{cart.id}_{timestamp}" in stripe.PaymentIntent.create().

HIGH RISK src/orders.py:88

Inventory decremented prior to payment authorization. Abandoned or declined checkouts permanently lock stock from genuine buyers.

Suggested Fix: Move stock reduction inside post-authorization @transaction.atomic block.

HIGH RISK src/billing.py:104

Missing tenant isolation in webhook handler: queries organization by incoming payload customer_id without verifying against signed installation.

Suggested Fix: Verify incoming customer_id matches authenticated tenant installation token.

The Problem

AI writes syntax-clean code. It also quietly ships business bugs.

Compilers, linters, and type checkers catch missing brackets and broken syntax. But AI coding models routinely generate clean, plausible code that violates core business invariants.

FINANCIAL RISK

Lost Revenue & Double Charges

AI generates standard payment flows that omit idempotency keys, retry logic, and webhook replay protection — leading to duplicate billings and uncaptured transactions.

STATE RISK

Corrupted Database State

Multi-step workflows write data outside database transactions. When an external API or timeout interrupts the flow, tables are left in half-committed, orphaned states.

AUTH RISK

Broken Permission Boundaries

AI code frequently checks object existence while skipping tenant verification or role authorization, silently allowing cross-account access and data leakage.

The Toolset

Seven specialized risk-hunting tools in your editor

Available directly inside your AI coding assistant through the standard Model Context Protocol (MCP).

explain_change

Plain-language walkthrough of the diff citing exact file:line locations so you understand what AI wrote.

business_risk_review

Hunts lost money, double charges, missing auth, and state corruption with concrete business impact.

scenario_questions

Generates targeted failure-scenario questions and suggested answers citing exact risky lines.

risk_tests

Produces edge-case test specifications targeting the specific failure modes introduced in the diff.

flow_check

Traces cross-file data flows and database mutations to catch broken assumptions across module boundaries.

pre_deploy_checklist

Actionable operational checklist covering database migrations, environment keys, timeouts, and webhooks.

security_audit

Audits code for leaked credentials, tokens, private keys, and personal data with severity, line citations, and fixes.

Workflow

How DiffVet audits your changes in 3 steps

No proxy servers, no complex configuration, and zero workflow interruption.

Connect Your Environment

Point Claude Code, Cursor, Antigravity, or Windsurf to DiffVet's hosted MCP endpoint, or install the GitHub App on your repositories.

Inspect Changes As You Code

Ask your assistant to review working diffs before committing, or let DiffVet automatically evaluate incoming pull requests upon push.

Ship With Verified Business Logic

Review exact file:line citations, verify edge-case questions, and resolve production risks before merging to main.

Supported AI Assistants

DiffVet runs as a streamable HTTP Model Context Protocol (MCP) server. Any modern AI tool with MCP support connects instantly with a single config line and API key.

Claude Code Cursor Antigravity Windsurf

GitHub Pull Request Reviews

Install DiffVet's GitHub App on personal or organization repositories. When a PR opens, DiffVet fetches the diff, writes execution paths, and posts risk findings as a comment. It runs advisory-only and never blocks merges.

Read / Write Comments Advisory Non-Blocking Shared Meter

Built-in Privacy & Protection

In-memory analysis. Built-in secret masking.

DiffVet was engineered from day one to protect your intellectual property, infrastructure keys, and customer data.

NO CODE STORAGE

DiffVet does not store your code

Your code is analyzed in memory and never written to our database or disk. It is processed by our AI provider (Google Gemini) under their API terms.

AUTOMATIC MASKING

Secrets are masked before analysis

Known secret formats (AWS, Stripe, GitHub, OpenAI keys, private keys, passwords) and personal data are detected and replaced with fixed masks before any analysis, and results show counts and line numbers, not values. Masking is best-effort: no scanner catches every format, so rotate any secret that was ever committed.

Transparent Pricing

Simple plans for solo engineers and teams

One combined meter shared between local MCP editor tools and GitHub PR reviews.

Free

For developers exploring AI-assisted development.

$0 / month

20 checks/month: web code checks + GitHub PR reviews
Paste or upload diffs on the web (/check)
GitHub App pull request review comments
Exact file:line citation guarantees
Standard community documentation

Get started free

Recommended

Pro

For professionals and teams shipping production code.

$15 / month

2,000 checks/month: everything in Free, plus DiffVet inside your AI tools (MCP for Claude Code, Cursor, Antigravity, Windsurf)
All 7 hosted MCP risk-hunting tools (including security_audit)
Generate and manage private API keys
Unlimited connected GitHub repositories
Priority model execution pipeline

Upgrade to Pro

FAQ

Frequently asked questions

Straight answers on how DiffVet operates, handles data, and reviews code.

Does DiffVet block or fail my pull requests?

Never. DiffVet is strictly advisory. The GitHub App posts review comments and always exits with code 0, ensuring pull request checks and CI/CD pipelines never fail.

Which AI editors and tools can connect to DiffVet?

Any tool implementing the Model Context Protocol (MCP) over HTTP. Claude Code, Cursor, Antigravity, and Windsurf connect directly using the URL and API key from your dashboard.

Does DiffVet store or train on my source code?

DiffVet does not store your code. Diffs are analyzed in memory and never written to our database or disk. Code is processed by our AI provider (Google Gemini) under their API terms, and DiffVet itself never uses your code for model training.

How does the monthly check limit work?

Every tool invocation (such as business_risk_review in your editor or an automated GitHub PR review comment) counts as one check. Free accounts receive 20 checks every month, and Pro provides 2,000 checks.