The risk is usually in the application, not the ALTER
Dropping a column is easy. Finding every ORM mapping, raw query, and stored-procedure call that still names it is not. Risk Assessment indexes your Git repositories and scores how a proposed schema change lands in real code.
Code impact, and SQL heuristics
Connect GitHub or GitLab. The service indexes source files and incrementally re-parses on change. When a change script proposes a table drop, column rename, type change, NOT NULL, or foreign-key edit, it searches that index for references.
SQL, Python, Java, C#, Kotlin, JavaScript, TypeScript, Go, Ruby, and PHP. Parsers run as sidecars, including SqlGlot for SQL, so the hit is a real reference rather than a grep that matches comments.
Hits are scored Low, Medium, High, or Critical and stored on the change script. Reviewers see the impact map next to the SQL, not in a separate ticket.
Independent of the code index, a heuristic analyser flags DROP, TRUNCATE, ALTER, and unbounded UPDATE or DELETE before execution. MCP exposes this as AnalyzeChangeScriptRisk.
Do not confuse it with operational scoring
Risk Assessment answers "what application code depends on this object?". It does not estimate lock time, replication lag, or whether an ALTER will rewrite a 2 TB table. Those still need an engineer who knows the engine.
It comes with the Growth plan
Code impact analysis is included from the Growth plan. The SQL risk checks on the script itself run on every change script, in every plan.
Unindexed code is invisible
If a service lives in a repo you did not connect, or in a stored procedure the indexer cannot see, it will not appear. Coverage is as good as the repositories you attach.
Change types, bands, and how a hit attaches to a script
| Proposed change | Base score |
|---|---|
| Delete table | 100 - Critical |
| Rename table | 95 - Critical |
| Delete column | 90 - Critical |
| Rename column | 80 - Critical |
| Change column type | 60 - High |
| Add NOT NULL | 55 - High |
| Add foreign key | 35 - Medium |
| Drop constraint | 20 - Low |
Bands: Critical at 75 and above, High at 50, Medium at 25, Low below that. A table-only reference under a column-scoped change is scored at half precision, so a weak match can drop a band. Confidence is 1.0 for an exact hit, 0.75 for a naming convention, 0.65 otherwise.
Languages extracted
SQL, Python, Java, C#, Kotlin, JavaScript, TypeScript, Go, Ruby, and PHP. Dedicated extractors exist for C#, Java, Python, Kotlin, JS/TS, and Go. SQL goes through SqlGlot sidecars rather than a string search.
Stuck to the change script
The result is stored as AnalysisRequestId on the script. Reopening the page reloads it. Analysis can start from the editor, from the popover, or automatically when you execute.
Two different “risks”
Code impact answers what breaks in your applications. The DROP and TRUNCATE checks are a separate, always-on layer that reads the SQL itself. Worth keeping the two apart when you describe your controls to an auditor.