Audit any site. Nothing leaves the browser.
Performance, SEO, accessibility, security and best-practice auditing that runs entirely on your device. No account, no cloud, no telemetry — and a CLI that fails your build when a score drops.
In the app, every audit runs on your device — no account, no telemetry
Performance, SEO, accessibility, security and PWA checks
Bundles axe-core, web-vitals and Retire.js
npx @tanvrit/auditor-cli <url> with exit-code gating for CI
Score badges for your README
An audit that runs where you are, not on someone's server
Most site auditors are a queue: you hand over a URL, a machine somewhere fetches it, and you wait for a score tied to an account. Auditor inverts that. The check catalogue is compiled into the app itself, so the browser, desktop or mobile build fetches the target page and evaluates it locally. There is no login, no stored history and no analytics sink — session state is an in-memory flow that resets when you close the tab.
What the engine checks
Checks are grouped into performance, SEO, accessibility, security, best practices, PWA, content, mobile, internationalisation and discoverability. Three well-known engines are bundled as local probes rather than called as services: axe-core for accessibility rules, web-vitals for field metrics, and the Retire.js signature database for known-vulnerable JavaScript libraries. HTML and XML are parsed with ksoup and xmlutil. There are no third-party audit APIs in the path, so there are no keys and no per-run quotas.
Static checks and rendered checks are labelled differently
Some checks only need the HTML: meta tags, headings, link structure, header policy, dependency versions. Others need a real layout pass — LCP, INP, CLS and the full axe-core rule set need a rendered DOM. The browser build runs the static catalogue; the desktop build embeds KCEF and the Android and iOS builds use the system WebView to run the rendered ones. The report says which is which, marking each result Auto-detected or Needs manual check instead of quietly scoring what it could not measure.
Failing a build on a regression
npx @tanvrit/auditor-cli <url> runs the same check catalogue headlessly. --min-score sets a floor, --fail-on trips the exit code on any finding at or above a severity, and --json pipes the full outcome into jq. When GITHUB_ACTIONS is set the CLI switches on workflow annotations, so findings land inline on the pull request with their severity. Unlike the apps, the CLI queries a hosted audit endpoint by default; --endpoint or AUDITOR_ENDPOINT points it elsewhere.
Frequently asked questions
- Do I need an account, and is anything stored?
- No account, and nothing is persisted. Audit state lives in memory for the duration of the session, and the analytics sink is a no-op by default. Beyond fetching the URL you asked for, the only optional outbound call is a monthly refresh of the bundled Retire.js signatures.
- How does this differ from a hosted auditing service?
- A hosted service fetches your page from its own network, which is a problem for staging URLs, internal hosts and pages behind a login. Auditor fetches from your machine, on your connection, with your network position. That also means results reflect your environment rather than a data centre's.
- Why does the browser version report fewer metrics?
- The WebAssembly build has no embedded browser, so it cannot produce rendered metrics like LCP, INP and CLS or run the full axe-core rule set. Those run in the desktop build via KCEF and on Android and iOS via the platform WebView. The web report marks the difference rather than substituting an estimate.
- How do I gate a pull request on a score?
- Add a step running npx @tanvrit/auditor-cli against your preview URL with --min-score and --fail-on. A score below the floor, or a finding at or above the chosen severity, exits non-zero and fails the job. Annotations are emitted automatically inside GitHub Actions.
- Can I put a score badge in a README?
- Yes. The badge endpoint renders an SVG from either a score you already have or a URL it audits on request. The dynamic path runs the same HTML-level checks as the browser portal — no rendered-DOM metrics — so the two numbers track each other closely.
Built on the same platform
Auditor shares its foundations — one SDK, one API, one account — with the rest of what we build.