one mcp tool. 27 checks.
code audit is the first of fizzgig's three legs — it detectswhat's wrong with what your AI shipped. live as a single MCP entry point (fizzgig__audit) that fans out to the right checks based on the inputs you provide. 6 free essentials are pinned to the top regardless of how you sort or filter. these are the 27 checks that live behind that one call — audit shows you the catalogue so you can see exactly what coverage you get.
detect <> lift. these 27 tools find the problem. the matching brand & reach _lift tools fix it (Q3 2026).
detects third-party apis called via fetch() urls (no installed sdk). emits architecture_facts for stack-map.
live architecture map of your stack — services, connections, status pills.
known-cve lookup against osv.dev for npm packages. closes the gap dep-audit (structural) leaves open.
reviews package.json + lockfile for placement, range, and integrity issues.
checks supabase row-level-security policies for the 8 canonical leak shapes.
finds hardcoded api keys, tokens, and provider secrets in your source.
traces every protected route back to its auth check + verifies webhooks.
checks cookie consent — banner presence, parity, withdrawal, pre-consent script firing.
cross-references known data sources against your attribution text + commercial use.
verifies client + server validation parity — catches the "client validates, server trusts" bug.
cross-references your privacy policy against the live dependency tree.
WCAG contrast + font-size + line-height. resolves your design tokens, composites translucent backgrounds, computes the real ratio.
industry-aware regulatory check — auto-detects relevant regulators from your code + claims.
static WCAG check — alts, labels, semantic structure, keyboard nav.
checks the signals AI search engines use — FAQPage, /llms.txt, E-E-A-T, server-rendered.
checks the cross-surface brand metadata (favicons, og, theme-color, manifest).
reviews component code against your design tokens + universal sourdough principles.
flags empty hrefs, broken internal routes, anchor-id mismatches, mailto/tel issues.
reviews writing quality + structural quality from a human-reader perspective.
flags AI-generated tells, buzzwords, and prose-rhythm issues in marketing copy.
inspects api routes for permissive cors configs.
flags `.map()` over a list with no empty-state guard rendered.
checks your .env file for credible secrets behind public prefixes.
pre-launch ritual — fan-out to every other fizzgig tool, single ship/dont-ship verdict.
flags prompt content for injection-vector smells.
comprehensive traditional SEO review — URL, head, schema, body, security headers.
flags SQL built via interpolation, concatenation, or ORM raw escape hatches.
fizzgig__audit (general detection) and fizzgig__launch_checklist (pre-deploy ritual with ship/dont-ship verdict). one install, every check._lift partner on the brand & reach leg — context-aware rewrites that take the audit findings AND your project and ship the actual fix. nine planned. Q3 2026.