Laravel Auditor gives your AI coding agent 75 evidence-first rules
AI coding agents can already read a Laravel codebase. The problem is they tend to guess at framework behavior, flag style opinions as high-severity issues, and occasionally invent vulnerabilities from uncommon patterns. Laravel Auditor, a new MIT-licensed dev package from Punyapal Shah, gives your agent a repeatable workflow instead of letting it wing it.
What it does
The package is not a one-click scanner. It installs as a development dependency and wires a structured audit methodology into whichever AI agent you already use: Claude Code, Cursor, Codex, Gemini CLI, or others. The agent follows a Discover, Scope, Verify, Report workflow rather than free-styling across the codebase.
Version 0.1.x ships 75 evidence-first rules across six domains:
- Security: authorization gaps, mass assignment, sensitive data, unsafe redirects, committed secrets, debug exposure
- Performance: N+1 risks, queries in loops, unbounded retrieval, repeated HTTP/storage I/O, Livewire/Filament/Inertia hot paths
- Architecture: boundary violations, duplicated logic, unnecessary abstractions
- Database: schema/relationship mismatches, destructive migrations, nullability risks
- Testing: missing meaningful coverage, weak tests, missing authorization tests
- Laravel conventions: version-inappropriate APIs, reinvented framework features, lifecycle misuse
️ Setup and requirements
Requires PHP 8.3+ and Laravel 12 or 13. Install as a dev dependency:
composer require --dev mrpunyapal/laravel-auditorThen run the installer for your agent:
php artisan auditor:install --agents=claude_codeSupported agent keys: opencode, claude_code, cursor, copilot, gemini, codex, junie, zed. If your project uses Laravel Boost, run php artisan boost:install instead and the package integrates through Boost’s third-party guidelines automatically.
MCP tools and reporting
The package registers an MCP server that exposes 11 read-only context collectors: project info, routes, models, migrations, database schema, dependencies, configuration, policies, jobs/events/schedules, tests, and subsystems. The agent calls these before reading source files so it works from deterministic facts rather than guesses.
Findings are structured JSON ranked P0 to P3. Reports render as Markdown, JSON, CLI text, or SARIF:
php artisan auditor:report --findings=storage/auditor-findings.json --format=sarif
php artisan auditor:ci --findings=storage/auditor-findings.json --fail-on=highThe catch
Finding quality depends entirely on the agent following the skill. The package is early (0.1.x) and the developer is explicit that it is not an autonomous product. If your agent skips the verification step, you can still get hallucinated findings. The methodology is the product, not the scan runner.
Command names, config keys, MCP tool names, finding fields, and rule IDs are stable across 0.1.x. The package is free on Packagist. Docs live at mrpunyapal.github.io/laravel-auditor.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
