27 tools. one mcp url.
pick what fits your stack — 6 free tools land on install, add à-la-carte tools as you need them, or unlock the lot with all-access. free tools are pinned to the top regardless of how you sort or filter.
detects third-party apis called via fetch() urls (no installed sdk). emits architecture_facts for stack-map.
live architecture map of your stack — services, connections, status pills.
known-cve lookup against osv.dev for npm packages. closes the gap dep-audit (structural) leaves open.
reviews package.json + lockfile for placement, range, and integrity issues.
checks supabase row-level-security policies for the 8 canonical leak shapes.
finds hardcoded api keys, tokens, and provider secrets in your source.
traces every protected route back to its auth check + verifies webhooks.
checks cookie consent — banner presence, parity, withdrawal, pre-consent script firing.
cross-references known data sources against your attribution text + commercial use.
verifies client + server validation parity — catches the "client validates, server trusts" bug.
cross-references your privacy policy against the live dependency tree.
WCAG contrast + font-size + line-height. resolves your design tokens, composites translucent backgrounds, computes the real ratio.
industry-aware regulatory check — auto-detects relevant regulators from your code + claims.
static WCAG check — alts, labels, semantic structure, keyboard nav.
checks the signals AI search engines use — FAQPage, /llms.txt, E-E-A-T, server-rendered.
checks the cross-surface brand metadata (favicons, og, theme-color, manifest).
reviews component code against your design tokens + universal sourdough principles.
flags empty hrefs, broken internal routes, anchor-id mismatches, mailto/tel issues.
reviews writing quality + structural quality from a human-reader perspective.
flags AI-generated tells, buzzwords, and prose-rhythm issues in marketing copy.
inspects api routes for permissive cors configs.
flags `.map()` over a list with no empty-state guard rendered.
checks your .env file for credible secrets behind public prefixes.
pre-launch ritual — fan-out to every other fizzgig tool, single ship/dont-ship verdict.
flags prompt content for injection-vector smells.
comprehensive traditional SEO review — URL, head, schema, body, security headers.
flags SQL built via interpolation, concatenation, or ORM raw escape hatches.