Check AI agent change impact

Coding agents are increasingly trusted to make real infrastructure changes: removing a credential, disabling a webhook, swapping an integration. The agent reasons from what it can see in the current repository. It cannot see that a credential it's about to revoke also authorizes a webhook in a repository it was never given access to.

Tests passing in the current repository is not evidence that nothing elsewhere depends on what changed. An agent that reasons only from local context will confidently report a change as safe when “safe” was never something it was in a position to know. The failure mode isn't a bad agent, it's an agent given a question (“is this used?”) that local repository context can't actually answer.

Wirecheck gives the agent an organization-wide answer instead of a repository-local guess: known dependants, which repositories they live in, and whether any reference couldn't be resolved. The agent still decides what to do, Wirecheck never returns a verdict, only known dependants, unknowns, and evidence for each.

Before modifying or removing an existing credential, MCP server, webhook,
scheduled job, or integration: run `wirecheck preflight <name> --json`
first, and do not treat zero known dependants as safe if UNKNOWNs remain.

wirecheck preflight segment-write-key --operation REVOKE --json

{
  "component": { "name": "segment-write-key", "type": "CREDENTIAL", "confidence": "HIGH" },
  "direct_dependants": 2,
  "indirect_dependants": 0,
  "unknown_relationships": 0,
  "affected_repositories": ["acme/web-app", "acme/mobile-events"]
}

Two known consumers across two repositories the agent may not have been working in. That is the information the agent needed before touching anything, not after.

Each dependant count is backed by evidence: a file, a line, and a confidence level, resolved from an actual scan of the connected repositories, not inferred from the current diff. See how that mapping works.

Wirecheck only knows about repositories your organization has connected. A dependency in an unconnected repository, or one referenced only through runtime configuration Wirecheck's detectors don't yet parse, won't appear, which is exactly why unresolved relationships are surfaced as UNKNOWN rather than silently treated as zero.