Scope-creep auditor for AI coding agent diffs

What to build

A CLI and GitHub Action (with a companion VS Code extension) that diffs an AI coding agent's commit against the stated task description, then flags out-of-scope changes — unrelated file edits, deleted comments, formatting/style churn, and touched dependencies — as a pre-merge scope-creep report for developers using Claude Code, Cursor, and Copilot.

AI coding agents routinely fix the requested bug but also quietly touch unrelated files, comments, formatting, and dependencies, and no dedicated tool exists yet to flag that scope creep before merge.

Demand

Developers shipping with Claude Code, Cursor, and Copilot are the buyers — they're merging agent diffs fast and have no purpose-built way to catch scope creep beyond manual review, which doesn't scale as agent usage grows.

• Hacker NewsDiscussion

  48 points, 6 comments on HN discussing the Trail of Bits post on AI agents introducing unrequested changes alongside bug fixes — high engagement at the source.

• Signal cluster summaryNews

  No widely adopted, purpose-built diff-auditing tool exists yet for flagging AI-agent scope creep before merge, per the signal analysis.

Stack

• GitHub REST API / Actions toolkit
• git diff / unified-diff parsing (e.g. parse-diff, libgit2)
• tree-sitter for language-aware change classification
• Claude API (for semantic 'is this change in-scope' judgment)
• VS Code Extension API
• npm/PyPI package registries API (for dependency-change detection)

Solo + AI difficulty

The mechanical parts — parsing diffs, detecting changed files/deps/comment deletions — are straightforward with existing diff libraries; the hard part is reliably judging 'in-scope vs out-of-scope' semantically, which needs an LLM-as-judge prompt tuned against real agent diffs to avoid false positives. A CLI + GitHub Action MVP (diff parsing + LLM scope classification + a markdown report) is achievable solo in 2-4 weeks; the VS Code extension and polished UX would come later.

Entry threshold

A solo developer can build a first version in days by parsing git diffs and using an LLM to classify changes as in-scope or out-of-scope relative to the stated task; no licences or capital needed, distribution via GitHub Marketplace and dev communities.

Window

6-12 months

Where to find first users

• r/ClaudeAI and r/cursor communities
• Show HN launch
• Product Hunt launch
• GitHub Marketplace listing for the Action

Counter-signals & risks

• Existing code review tooling (standard git diff review, linters, PR review bots like CodeRabbit or GitHub Copilot PR summaries) may already partially cover this use case, reducing differentiation for a dedicated tool.

• Low historical signal match (none) and a moderate score (0.58) suggest this is an early, unvalidated trend rather than a confirmed widespread pain point.

• Developers may tolerate or even want agents to make adjacent improvements (e.g. cleanup, formatting) as part of normal workflow, limiting demand for strict scope-enforcement tooling.