What is blast-radius?

A command that estimates a file's blast radius: how many other files refer to it and whether it matches sensitive file paths. A sensitive path is a location that may require extra care, such as configuration or security-related code.

Run it on a repository file to count references and check whether the file falls under configured sensitive-path rules.

It helps assess the likely impact and risk of changing a file before editing it.

blast-radius — Command for Claude Code by andyzengmath/soliton

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/andyzengmath/soliton

Made for: Claude Code.

Or install soliton, the plugin that ships this one along with the rest of its 1 skill, 3 commands, 13 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/andyzengmath/soliton/blast-radius/github.svg)](https://agentmods.dev/commands/andyzengmath/soliton/blast-radius)

Your own site

<a href="https://agentmods.dev/commands/andyzengmath/soliton/blast-radius"><img src="https://agentmods.dev/badge/commands/andyzengmath/soliton/blast-radius/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/commands/andyzengmath/soliton/blast-radius"><img src="https://agentmods.dev/badge/commands/andyzengmath/soliton/blast-radius.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 16 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 711 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00016	$0.00711
Opus 5.5	$0.00006	$0.00284
Sonnet 5.5	$0.00003	$0.00142
Haiku 4.5	$0.00002	$0.00071

Measured 1mo ago against content hash 1e1b6e5caab2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

blast-radius scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/blast-radius.md · 54 lines

How it starts

The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/blast-radius

Compute the blast radius (number of files that import or reference a target file, plus sensitive-paths hit) using Soliton's risk-scorer heuristic — the same grep-based computation the risk-scorer agent uses today (agents/risk-scorer.md Factor 1).

This is a degraded-mode standalone surface of Soliton's existing logic. When the graph plugin lands (POST_V2_FOLLOWUPS §B1), this command will switch to graph-cli's info + dependency-edges queries; the user-facing contract stays the same.

Argument

<file> — path to a file in the current repository (relative or absolute).

Behavior

Validate input: if <file> is missing or doesn't exist, output Error: file not found: <file> and STOP.
Compute import-count via grep heuristic (same as agents/risk-scorer.md Factor 1):
- Extract the file's basename without extension (e.g. auth-utils.ts → auth-utils)
- Run git grep -l "<basename>" to count files that reference it
- Strip the input file itself from the count
Compute sensitive-paths hit (same as risk-scorer Factor 3):
- Apply each pattern from rules/sensitive-paths.md (and any config.sensitivePaths overrides from .claude/soliton.local.md) to the input file path
- Mark hit if any pattern matches
- Note: do NOT inline the pattern list in this command's output — read the canonical source so future updates to rules/sensitive-paths.md propagate automatically.
Output a compact summary:

Blast Radius for <file>

Importers: <N> files (grep heuristic)
Sensitive: <hit | clean>
Backing source: grep (graph plugin pending §B1; will upgrade when graph-cli ships)

Top 5 importers (alphabetical):
- path/a.ts
- path/b.ts
- ...

If the import-count is 0, note explicitly: "0 importers found via grep — file may be entry-point, deleted-only PR target, or grep-heuristic miss. Risk-scorer's full analysis runs the same query against git diff context."

Non-goals

This is NOT the full risk score. The risk-scorer agent computes 6 factors weighted to a 0-100 score; /blast-radius exposes only Factor 1 + Factor 3 in isolation for ad-hoc queries.
This is NOT graph-aware. When the graph plugin lands, the same surface upgrades to use real call/import edges. Until then, false-positives are possible (any file containing the basename string matches, including comments and unrelated symbols).

Read the full file on GitHub · 54 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 54 lines · 16 tokens per session scan A 1e1b6e5caab2

Subscribe to this mod's changes

blast-radius is a command published in the GitHub repository andyzengmath/soliton (1 stars, last pushed 4mo ago), licensed MIT. It adds 16 tokens to every session and 711 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Debugging agent-skills claude-code-plugin claude-skills opencode-plugin skills

techdebt

Find and report technical debt in the codebase.

oliver-kriska/claude-elixir-phoenix · 13 tokens

deep-code-analysis

Comprehensive codebase investigation using research-expert for documentation, explore-codebase for structure, and deep analysis. Perfect for understanding complex systems.

fusengine/agents · 28 tokens

watch

Check for Claude Code updates, detect breaking changes, analyze plugin compatibility, and optionally gather community pulse via Exa.

fusengine/agents · 23 tokens

cg

Generate a call graph of a module or task (Design Thinking output format).

widnyana/eyay-toolkits · 15 tokens

nyann:retrofit

Audit an existing repo against a profile and fix what's drifted. Unlike doctor (read-only), retrofit detects missing hooks, misconfigured gitignore, documentation gaps, and non-compliant history, then offers to remediate via bootstrap. Idempotent — safe to re-run.

thettwe/nyann · 61 tokens

fix

Quick bugfix commit. Use for fix bug, bugfix, patch, hotfix, correct error.

fusengine/agents · 21 tokens