mcpField
A
audit-my-app

audit-my-app

github.com/reticlehqTesting & quality1.3k254 installsUpdated today
Repository

About audit-my-app

audit-my-app is a Reticle skill for auditing a running app by exploring its controls, comparing API results with rendered content, and checking test coverage. It helps coding agents distinguish confirmed defects from untested areas and report findings with source locations.

Key features

  1. 01Inspect the app’s declared test surface
  2. 02Crawl reachable controls for anomalies
  3. 03Compare API responses with rendered content
  4. 04Report exercised and untouched coverage
  5. 05Review whether saved flows contain assertions
  6. 06Separate broken, unverified, and pre-existing findings

Use cases

  1. 01Audit a development app for dead controls
  2. 02Find mismatches between API data and rendered UI
  3. 03Identify controls or flows that have not been checked
  4. 04Summarize findings with file and line references

MCP support

The skill calls Reticle MCP tools, including reticle_capabilities, reticle_verify, reticle_explore, reticle_reconcile, and reticle_domain, to inspect and audit the app.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/reticlehq/reticle --skill audit-my-app

After installing, type/audit-my-appin Claude Code to confirm it loaded.

Details

From the project README

Sweep the whole app and report what is broken

You do not need to understand the codebase to check it. Reticle drives every reachable control in the running app and reports the anomalies. Not set up? Follow the reticle skill: it installs Reticle, asks the user before init changes the app's files, and proves one flow.

1. Ask the app what it can do

reticle_run({ tool: "reticle_capabilities", args: { sessionId } })

About 1 KB, and it is the app describing its own testable surface: every registered testid, every domain signal, the stores, and the saved flows with their steps. That beats snapshotting the DOM and inferring intent from element names, and it is the cheapest orientation available.

2. Click everything

reticle_run({ tool: "reticle_verify", sessionId, args: { action: "crawl", maxSteps: 25 } })

{
  "interactiveFound": 3,
  "stepsRun": 3,
  "anomalies": [],
  "counts": { "consoleErrors": 0, "failedRequests": 0, "deadControls": 0, "contradictions": 0 },
  "visited": ["- textbox \"Email\"", "- button \"Sign in\""],
  "truncated": false
}

deadControls and contradictions are the two counts that mean a real problem. Console errors and failed requests are worth reading but a busy app produces both innocently. A dead control is a button wired to nothing; a contradiction is a channel disagreeing with what the screen showed.

It clicks everything, so point it at a dev environment. maxSteps bounds it and defaults to 25. Want a non-destructive pass first: what is reachable, without touching it? reticle_run({ tool: "reticle_explore", sessionId }).

Do not hand-roll this sweep. The obvious version (click each control, assert no console error) passes on exactly the bug you are sweeping for, because a dead button throws nothing.

3. Compare what the API said against what rendered

reticle_run({ tool: "reticle_reconcile", sessionId })

The API returned ten rows, the table shows nine, nothing errored. Neither the network log nor the DOM is wrong on its own. Only the comparison catches it, and nothing else you can run makes that comparison.

4. Find the parts nobody exercised

reticle_run({ tool: "reticle_verify", sessionId, args: { action: "coverage" } })   // { total, exercised, untouched }

And if the project already has saved flows, ask whether they prove anything:

reticle_run({ tool: "reticle_domain", sessionId })
// → { flowCount, coverage: { asserted, presenceOnly, assertionFree }, gaps: { declaredUntestedSignals, … } }

A suite of forty flows where thirty-one assert nothing is a suite that will stay green through any regression. That number is usually the most alarming thing in the whole audit, and nothing else reports it.

5. Report

Lead with the counts, then one line per real finding with its file:line from reticle_look { action: "element" }. Separate:

  • Broken: dead controls, contradictions, failed requests, errors thrown during the sweep.
  • Unverified: untouched controls and assertionFree flows. Not known to be broken; known to be unchecked.
  • Pre-existing: console errors that were already there before the sweep started. Say so, so nobody attributes them to today's change.

Do not report a clean audit over a partial one. If truncated is true or maxSteps cut the sweep short, say what was not reached. A silent cap reads as "everything is fine" when it means "I stopped".

Full capability reference: curl https://docs.reticle.sh/capabilities.md. Everything else: curl https://docs.reticle.sh/llms.txt.

Comments

Markdown supported