fintech-roast
An agent that roasts the code that touches money.
An agent that scans a repository for the surfaces where money lives, audits them against a sourced rulebook of how money-handling code actually breaks, and reports only what survives adversarial verification.
- Researched rules
- 41
- Domains
- 10
- Findings on the fixture
- 53
The value is the rulebook, not the prompt
Most AI code review for money is a single prompt that pattern-matches on "float" and calls it a day. Here the asset is 41 rules across 10 domains, from ledger integrity and rounding to FX, tax, serialization, webhooks, aggregation, and time-handling, each researched against primary sources: specs, standards, tax-authority manuals, canonical engineering literature.
Each rule carries per-language detection and fixes for TypeScript, Python, and Java, plus its own false-positive notes. Every finding then goes through an adversarial pass whose only job is to refute it; only survivors get reported, with the rule and the sources behind them.
It found a real one in Medusa
Run against Medusa, the open-source commerce platform, it surfaced exactly the class its rulebook is built for: check-then-act races that bypass amount guards. Payment capture and refund read the running totals then write with no row lock, and promotion usage writes absolute budget counters under a cart-scoped lock, so concurrent calls can over-capture, over-refund, or blow past a campaign budget.
I reported it as medusajs/medusa#16012. A Medusa maintainer confirmed the reasoning ("your argument makes sense"), labeled it a bug, and opened it for a fix under help-wanted. The finding and the acknowledgement are public on the issue.
Read-only, reproducible, honest
It never edits your code, opens PRs, or files issues. "No findings" is a valid outcome; it does not force findings out of a repo that has no money code.
The eval fixture seeds 35 planted bugs; a scored run surfaces 53 findings, each adversarially verified before it is shown and carrying its rule id and file line, and the complete report is checked into the repo, so you can read exactly what you would get before running it. It runs as a Claude Code plugin on your own session: two commands, no API key to configure.
- Claude Code plugin
- 41 rules
- read-only