MR Review & RCA Toolkit

A dependency-free CLI for reviewing risky infrastructure changes and turning incident telemetry into a first-pass RCA handoff.

mr-rca focuses on the part that is easy to miss in a busy review: newly added Terraform, Kubernetes, Helm, and Ansible lines that widen access, disable safety controls, or create fragile production behavior. It produces human-readable, JSON, SARIF, or GitLab Code Quality reports.

Install

Python 3.11 or newer is required.

pipx install git+https://github.com/semx/mr-rca-toolkit.git
mr-rca --version

For development:

git clone https://github.com/semx/mr-rca-toolkit.git
cd mr-rca-toolkit
python3 -m pip install -e '.[dev]'

Review Git changes

Review staged, unstaged, and untracked files in the current repository:

mr-rca scan . --environment production --format text --fail-on high

Review a merge range in CI:

mr-rca scan . \
  --base origin/main \
  --head HEAD \
  --environment production \
  --format sarif \
  --output mr-rca.sarif \
  --fail-on high

The scanner reviews only added and modified lines. Existing risky lines are not reported again when an unrelated part of a file changes.

Suppress an accepted finding

Put a scoped suppression on the finding line or directly above it:

# mr-rca: ignore tf.public_ingress
cidr_blocks = ["0.0.0.0/0"]

Prefer a rule-specific suppression. mr-rca: ignore all is supported for rare cases where several rules apply to one reviewed line.

Review a JSON manifest

Integrations that already collect merge request data can use the stable JSON envelope:

mr-rca review examples/merge-request.json --format text --fail-on high
cat examples/merge-request.json | mr-rca review - --format json --pretty

See docs/manifest.md for the schema.

Build an RCA draft

mr-rca rca examples/incident.json --format markdown --output rca.md
mr-rca rca examples/incident.json --format json --pretty

The RCA builder correlates deploys within 90 minutes, error logs, slow/failing traces, and ownership metadata. Its confidence describes available evidence; it does not claim that temporal correlation proves root cause.

CI formats and exit codes

• text: terminal and merge request logs.
• json: automation and retained artifacts.
• sarif: GitHub code scanning and SARIF-compatible systems.
• gitlab: GitLab Code Quality report format.
• Exit 0: command succeeded and threshold was not reached.
• Exit 1: one or more findings reached --fail-on.
• Exit 2: invalid input, Git error, or output error.

Set --fail-on none for reporting-only adoption. Available thresholds are info, low, medium, high, and critical.

See the rule catalog, GitLab example, and GitHub Actions example.

Scope

The rules are deliberately explainable heuristics, not a Terraform/YAML parser or a replacement for Checkov, Trivy, OPA, admission control, or human review. Use the toolkit as a fast change-focused guardrail and RCA handoff generator.

Development

ruff check .
mypy toolkit
python3 -m unittest discover -s tests -v
python3 -m build

Licensed under the MIT License.