openauditB85out of 100: openaudit's audit of itself

Getting started

Code, websites, running apps, APIs, containers, infrastructure, cloud accounts and mobile builds, from your terminal, your CI or your AI agent.

openaudit runs 32 built-in auditors and wraps 45 established open-source scanners, linters and type checkers when they're installed. Ten agent playbooks cover the judgment-heavy work no rule can do, such as authorisation review, keyboard and screen-reader journeys, and privacy data flows. Everything lands in one report with a 0–100 score and an A–F grade per area.

Quick start

bunx openaudit .                            # a codebase
bunx openaudit https://example.com          # a live site (add --browser for Playwright + axe-core)
bunx openaudit ./app-release.apk            # a mobile build (.apk, .aab, .ipa)
bunx openaudit image:nginx:1.27             # a container image
bunx openaudit cloud:aws --only cloud       # a live cloud account (Prowler)

bunx openaudit . -f html -o report          # write the interactive report to report/
bunx openaudit doctor                       # which optional scanners are installed

openaudit needs Bun 1.4 or newer. Scanners are optional: an auditor whose tool is missing is skipped with an install hint, and the rest of the audit runs normally. To run from source, see Contributing.

Install

Requires Bun 1.4 or later. Install globally with bun add -g openaudit, or run it on demand with bunx openaudit. npx openaudit also works when Bun is on PATH; without Bun it prints how to install it. External scanners (gitleaks, TruffleHog, Semgrep, Trivy, zizmor, pa11y and the others listed by openaudit list) are optional. When one is missing, the auditor that wraps it is skipped and tells you how to install it. Run openaudit doctor to see what is available.

How it works

 CLI · MCP server · HTTP API · GitHub Action
                    │
                    ▼
 target detection ─► engine: select auditors, run them in parallel, isolate failures
                    │
        built-in · wrapped scanners · agent playbooks
                    │
                    ▼
 merge duplicates ─► score each area ─► terminal · JSON · SARIF · Markdown · HTML
PathWhat
packages/coreReport model (the public contract), engine, cross-tool correlation, diff mode, target detection, reporters
packages/auditorsBuilt-in and external-tool auditors: codebase, web, infra, mobile, cloud
packages/agentPlaybooks, agentic auditors (Claude Agent SDK), AI insights
packages/mcpMCP server
apps/cliThe openaudit binary
apps/server, packages/apiHono + oRPC HTTP API (/api-reference for OpenAPI docs)
apps/webWebsite: landing page, live URL audit, report viewer, docs
docs/Architecture page (bun docs/architecture.ts regenerates it) and the GitHub Pages landing page

Next