ragapp

Evidence-first code review for correctness bugs, AI-generated code smells, unsupported claims, unwired functionality, dependency hallucinations, and release-to-code mismatches.

Validate new and changed dependencies, imports, install commands, lockfile entries, and runtime tool assumptions for package hallucinations, slopsquatting, cross-ecosystem confusion, and version validity.

Verify that README changes, release notes, changelog bullets, migration notes, PR descriptions, examples, and docstrings match what the code actually ships.

Inspect trust boundaries, validation, authn/authz, deserialization, command execution, path handling, secrets, and failure handling with an evidence-first security review.