fizzgig__form_validation_audit
verifies client + server validation parity — catches the "client validates, server trusts" bug.
4 checks: client forms with no validation library imported, server routes accessing request body without a parse/validate call (the canonical "client validates, server trusts" bug), validation library mismatch between client + server (drift risk), and `<input required>` as the only validation signal (browser-native only). Now inline-aware — distinguishes manual typeof/length/regex guards on the server (flagged high, not false-critical) and native HTML5 constraints (type=email / pattern / minlength) on the client (medium, not false-high) from genuinely-unvalidated input. Recognises zod, yup, joi, superstruct, valibot, arktype, react-hook-form, formik.
caught a policy that would have leaked every user's comments. shipped a fix in 4 minutes.
first tool i installed. it's the one that pays for itself.
works great. one false positive on a join table — easy to ignore.
{
"fizzgig": {
"url": "https://mcp.fizzgig.ai",
"tools": ["form_validation_audit"]
}
}