unsafe-review is the CLI install handle for advisory unsafe Rust PR review.
It turns changed unsafe-adjacent code into ReviewCards, a PR summary, witness
routes, and read-only projection artifacts that a maintainer can inspect before
asking for a guard, test, contract, or receipt.
It is not a UB prover, Miri replacement, policy gate, or automatic reviewer.
Install
Most users should install this unsafe-review crate.
Use unsafe-review-core only
when embedding the analysis engine programmatically.
First PR Review
Run the first-use PR cockpit from a repository checkout:
Then open the summary and inspect the top card:
The intended loop is:
changed unsafe seam
-> ReviewCard
-> missing evidence
-> concrete reviewer action
-> optional witness route or receipt
For the full maintainer path from first card to fix, witness receipt, and outcome comparison, see docs/FIND_AND_FIX_UB.md.
Artifact Bundle
first-pr writes a standard advisory bundle under target/unsafe-review/:
cards.json
pr-summary.md
github-summary.md
cards.sarif
comment-plan.json
witness-plan.md
receipt-audit.md
manual-candidates.json
manual-repair-queue.json
tokmd-packets.json
lsp.json
repair-queue.json
The bundle is artifact-first:
| Artifact | Use |
|---|---|
cards.json |
Canonical ReviewCard data |
pr-summary.md |
Reviewer first screen |
github-summary.md |
Bounded GitHub job summary text |
cards.sarif |
Code scanning / CI artifact |
comment-plan.json |
Planned comments, not posted |
witness-plan.md |
Suggested witness routes and limits |
receipt-audit.md |
Saved receipt metadata audit; no witness was run |
manual-candidates.json |
Imported manual/advisory candidates, separate from ReviewCards |
manual-repair-queue.json |
Copy-only manual candidate repair handoff; no agent was run |
tokmd-packets.json |
Formatting input for Bun packet presets; tokmd was not run |
lsp.json |
Saved read-only editor projection |
repair-queue.json |
Copy-only agent repair queue; no agent was run |
Explain One Card
Use explain when a card needs reviewer context:
The explanation should answer:
why this card exists
which safety conditions matter
which evidence was found
which evidence is missing
what would resolve it
what would not resolve it
which witness route is credible
what unsafe-review is not claiming
Trust boundary
unsafe-review reports static review evidence. It is not a proof of memory safety,
not a UB-free claim or status, not a Miri result or Miri-clean status, not
soundness evidence, and not a site-execution claim unless a matching witness
receipt is attached.
By default it does not run witnesses, post comments, edit source, enforce blocking policy, or claim calibrated precision or recall.
Findings are advisory unless you explicitly build a separate policy around the artifacts.
Common Commands
| Need | Command |
|---|---|
| Check first-run readiness | unsafe-review doctor |
| Build a PR review bundle | unsafe-review first-pr --base origin/main |
| Explain a card | unsafe-review explain <card-id> |
| Show support posture | unsafe-review support |
| Print a bounded agent packet | unsafe-review context <card-id> --json |
| Inspect repo posture | unsafe-review repo --format markdown |
| Generate badge endpoints | unsafe-review badges --out badges/ |
| Audit saved witness receipts | unsafe-review receipt audit |
| Compare saved snapshots | unsafe-review outcome --before before.json --after after.json |
Links
| Topic | Link |
|---|---|
| Repository | EffortlessMetrics/unsafe-review |
| Find/fix workflow | docs/FIND_AND_FIX_UB.md |
| First-use guide | docs/FIRST_USE.md |
| CLI guide | docs/CLI.md |
| Support summary | docs/status/SUPPORT_SUMMARY.md |
| Support tiers | docs/status/SUPPORT_TIERS.md |
| ReviewCard trust boundary | docs/explanation/review-cards-and-trust-boundary.md |
| Explain examples | docs/explanation/explain-examples.md |
| Agent repair workflow | docs/explanation/agent-repair-workflow.md |
| Dogfood evidence | docs/dogfood/index.md |
License
Licensed under either of:
- Apache License, Version 2.0
- MIT license