Laravel Auditor Audits Your App With Your Own AI Agent

Ask an AI agent to audit your Laravel application and you tend to get a mix of real bugs, style opinions dressed up as high-severity issues, and vulnerabilities that don't exist. Laravel Auditor, by Punyapal Shah, is a development dependency that hands the agent you already use a written audit methodology, a catalog of 75 rules, and read-only tools that report facts about your project instead of leaving the model to guess at them.

The package executes none of the checks itself — it installs skills and guidelines for Claude Code, Codex, Cursor, Copilot, Gemini CLI, Junie, Zed, or opencode, then gets out of the way while that agent runs a Discover → Scope → Verify → Report pass over your code.

Here's what the package gives you:

• Agent-agnostic install — auditor:install --agents=claude_code publishes skills, guidelines, and adapter files, or boost:install exposes the same resources through Laravel Boost when it's present
• 75 rules with stable IDs — every finding cites one, from AUD-SEC-001 (missing authorization boundary) to AUD-PER-011 (query executed inside a loop)
• Conditional rule packs — Livewire, Filament, Inertia, Sanctum, and Pest rules that only apply when those packages are installed
• Eleven read-only context collectors — routes, models, schema, policies, jobs, and tests, available over MCP or straight from Artisan
• A finding schema — findings are structured JSON with evidence, severity, confidence, and a recommendation, validated against a published schema
• Report and CI commands — auditor:report renders findings as Markdown, JSON, CLI text, or SARIF, and auditor:ci --fail-on=high turns them into an exit code
• A DSA pass — a separate laravel-audit-dsa skill inventories subsystems, sends bounded workers over each, then dedupes and ranks findings P0–P3

#What the Rules Cover

The 0.1.x catalog spans six domains: security, performance, architecture, database, testing, and Laravel conventions. Listing them is an Artisan command:

php artisan auditor:rules
php artisan auditor:rules --domain=security
php artisan auditor:rules --applicable

--applicable is the useful one on a real project, since it filters out the conditional packs for packages you don't have installed.

#Read-Only Project Facts

Before the agent reads any source, it collects deterministic facts about the application. Those collectors are exposed as MCP tools — project_info, routes, models, migrations, database_schema, dependencies, configuration, policies_authorization, jobs_events_schedules, tests, and subsystems — and registering the stdio server takes one command:

claude mcp add -s local -t stdio laravel-auditor php artisan auditor:mcp -q

With Laravel Boost installed, the same collectors are registered inside Boost's own MCP server, so there's nothing extra to wire up.

They're all reachable without MCP, too:

php artisan auditor:context --list
php artisan auditor:context project_info
php artisan auditor:context routes --output=storage/auditor-routes.json

Or from PHP, if you want the array:

use LaravelAuditor\Facades\LaravelAuditor;
 
LaravelAuditor::collect('models');

The tools return structured facts rather than source dumps, and routes, models, database_schema, and dependencies accept filters — routes {uri: "api"} — so an agent verifying a single suspicion can pull the relevant slice instead of the whole inventory.

#Findings and Reports

The agent writes findings and the package renders them. Each finding carries a rule ID, a severity from critical down to info, a separate confidence value, file-and-line evidence, and a fix:

{
  "id": "F-2026-0001",
  "rule_id": "AUD-SEC-001",
  "title": "Missing authorization boundary",
  "domain": "security",
  "severity": "high",
  "confidence": "confirmed",
  "summary": "Any authenticated user can delete another user's post.",
  "why_it_matters": "The destroy action never authorizes the Post policy.",
  "evidence": [
    {
      "type": "file",
      "reference": "app/Http/Controllers/PostController.php",
      "line": 42,
      "end_line": 48
    }
  ],
  "symbol": "App\\Http\\Controllers\\PostController@destroy",
  "recommendation": "Authorize the deletion with a PostPolicy or route middleware."
}

Reports can be formatted using SARIF, so a findings file produced locally can be uploaded and shown inline on a pull request:

php artisan auditor:report --findings=storage/auditor-findings.json --output=storage/auditor-report.md
php artisan auditor:report --findings=storage/auditor-findings.json --format=sarif
php artisan auditor:ci --findings=storage/auditor-findings.json --fail-on=high

#Installation

Laravel Auditor needs PHP 8.3+ and Laravel 12 or 13, and installs as a dev dependency:

composer require --dev mrpunyapal/laravel-auditor
php artisan auditor:install --agents=claude_code

Check out the readme and documentation for full details on setup. Once installation is done, ask your agent to run the audit:

Use the laravel-audit skill to audit this application. Discover the project first, scope the relevant domains, and report only evidenced findings.

Note: this package is in early development at the time of writing.

The source is on GitHub, with documentation at mrpunyapal.github.io/laravel-auditor.