Audit one GraphQL schema and separate what stops it building from what is legal and costs something. Reports a type implementing an interface without declaring its fields, a reference to an undefined type, a union member that is not an object type, an interface nothing implements, and an absent query root. Separately reports a nullable list item type, which forces every client to handle three outcomes, and a deprecation with no reason. Unreachable types are named as dead weight.

Decide whether two GraphQL schemas are compatible, with every finding attributed to the audience it affects. Clients break on a removed field, a removed enum value that is returned, a new required argument, a non-null output turned nullable and a new required input field. Servers break on a new field to resolve, a new interface obligation and an output turned non-null. An enum removal is attributed by where the enum actually flows, computed from the roots.

Audit a Helm values file against a contract the caller states, and optionally against a second environment. Reports a required path absent or null, so the chart renders with its own default instead; a value whose type is not what was declared, naming the YAML cause where there is one; a value outside a permitted set; a path the contract does not mention, which Helm ignores silently so a typo never surfaces; and a path stated in one environment and not the other.

Extract one supplied HTML document into machine-readable evidence and cross-check it against itself. Returns title, metadata, canonical, robots directive, JSON-LD, resolved links, tables, readable text and content hashes. Reports a canonical that disagrees with the URL served, an Open Graph title that disagrees with the document title, a noindex directive, and absent title, description or structured data. Scripts are not executed and nothing is fetched.

Compare two supplied HTML snapshots and separate markup churn from a content change. Reports markup that changed while the readable content did not, which is a template or build change; the readable lines added and removed; and changes to the title, canonical, robots directive, meta values and declared structured-data types. Content is compared by line presence rather than position, so a reflowed paragraph is not reported as wholly rewritten. Nothing is fetched.

Audit one set of response headers against a contract the caller states: headers that must be present, headers that must not be, and exact, prefix or substring rules on values. Also reports a header repeated with different values, where which one a client uses varies; an absent Content-Type, which forces a client to sniff; and a textual Content-Type with no charset. Optionally reports absent cache directives and no validator at all, which makes a conditional request impossible.

Compare two IAM policies and report what the change grants or removes. The comparison is over action-and-resource pairs rather than over statements, so a refactor that splits one statement into three reports no change. A newly written pair already covered by a broader unconditioned pattern is noted rather than reported, since nothing new is granted. A removed Deny is reported as a widening even when no Allow changed, because a Deny overrides every Allow.

Decide whether specific calls are permitted by a set of IAM policies, following IAM evaluation order: an explicit Deny wins over every Allow, and the absence of an Allow is a denial because there is no implicit allow. A request allowed or denied only under a Condition is reported as undetermined rather than decided, because the condition depends on a request context that is not supplied. A NotAction or NotResource statement is named as not evaluated rather than silently skipped.

Audit one IAM policy and report what widens it. The findings that need the document read as a whole: a wildcard action together with a wildcard resource, which means more than either alone; a Deny whose resource patterns no Allow in the policy covers, so it constrains nothing it appears to; and NotAction or NotResource in an Allow, which defines the permitted set by exclusion so the policy widens whenever the cloud gains an action, without the document changing.

Derive incident durations from a timeline and report what makes them unreliable. The finding that matters: a phase recorded before the phase that must precede it, which means a time was backfilled, so every duration derived from the pair is fiction. Also reports a time with no UTC offset, which during an incident means somebody wrote their own zone; a missing phase, so a duration cannot be derived; an unrecorded gap of an hour or more; and a derived duration beyond a target the caller states.

Recompute an invoice exactly and report where it disagrees with itself. Quantity times unit price is an exact decimal product. Rounding happens only where the stated policy says: per line, or once on the whole invoice. Those give different totals, so the difference between the two policies is published rather than one being assumed correct. Also reports a figure with more decimal places than its currency has, and a discount larger than its line.

Validate a JSON document against a schema you supply and get the exact pointer and clause of every failure. Reports what it could not check as well as what failed, so a valid verdict always means every declared constraint was actually evaluated. Patterns run on a non-backtracking engine, and no reference is ever fetched.

Find out which fields your real payloads actually populate. Across a batch of documents it reports, per location, how often it is present, how often it holds anything, and every type it appears as. A location that is a string in some documents and a number in others is named, which no schema check on a single payload would reveal.

Reconcile two sets of JSON records joined on pointers you nominate. Reports keys present on one side only, keys duplicated on either side, and every value disagreement with its key and pointer. Arrays inside records compare as multisets by default and numbers compare exactly, so reordered lists and reformatted amounts are not false findings.

Judge an RFC 6902 patch against the document it will be applied to. The patch is applied to a copy as a sequence, so each operation is judged against the state it will actually see rather than against the original: a later operation targeting a path an earlier one removed is the defect class this exists for. Reports a missing target, which makes the whole patch fail; a remove, which has no inverse; a replace that changes type; a move into itself; and a path the caller marked protected.

Decide whether a schema change breaks your clients, and which ones. Classifies every change by the audience it breaks: producers construct the payload, consumers read it. Adding a required field breaks senders; adding an enum value breaks readers. A change it cannot classify is reported as unclassified and never counted as safe.

Decide whether a schema change is safe to ship, with evidence. Returns the compatibility verdict for your clients and, separately, how many of the real payloads you supply would newly be rejected, with the failing constraints ranked by how many payloads each costs. A breaking change nothing relies on is a different decision from one that rejects a tenth of your traffic.

Compare two JSON documents and get every change with its pointer, classified as added, removed, retyped or revalued. Object key order is not a change. Array order is, unless you say the arrays are unordered. Numbers compare exactly, so 42.50 and 42.5 are the same value and two adjacent large integers are not.

Compare a batch of documents against one reference document and report where the shape drifted: locations the reference has that the batch lacks, locations that changed type, and locations the batch added. Array indices are generalised, so a two-item list and a three-item list are the same shape. Useful when you have an example payload and no schema.

Audit a whole NDJSON batch against one schema in a single call. Returns the failing line number and pointer for every breach, the count of valid, invalid and unparseable lines, and the first failing line. A blank line between records is reported rather than skipped, because it is almost always a producer bug.

Find out which keys every system holds and which only some do. Takes several datasets at once and returns a coverage histogram plus the keys present in only one and the keys partially covered, naming which datasets each is missing from. A pairwise comparison cannot express "present in three of five", which is the question when several systems are meant to hold the same population.

Audit a set of Kubernetes manifests against a contract the caller states. Reports an image with no tag or the latest tag, which changes under you; absent resource requests or limits; absent readiness or liveness probes; a missing required label; hostNetwork, hostPID, a hostPath volume or a privileged container; and a credential-shaped environment variable set to a literal, whose value is never echoed. YAML parsing surprises are reported rather than inherited.

Audit Kubernetes manifests against a contract. Reports a missing memory limit, where one container can take down the node it shares, a missing readiness probe, where traffic arrives before the container is ready, an unpinned image tag, a privileged container, added capabilities, a secret written literally into an env value rather than a valueFrom reference, and missing required labels. A CronJob’s nested pod template is read correctly rather than reported as having no containers.

Compare two sets of Kubernetes manifests and report what applying the second will actually do. Objects are matched the way an apply matches them, by apiVersion, kind, namespace and name. Reports a change to a field that is immutable for that kind, where an apply fails and the object must be deleted and recreated; a change under the pod template, which recreates every pod; a replica change; an object that is gone, which an apply does not delete; and a change that recreates nothing.

Parse every Kubernetes resource quantity exactly and report the pairs that contradict themselves and the totals that exceed a quota. Reports a request above its own limit, which the API server accepts field by field and rejects as a pair; a memory value with a decimal SI suffix rather than the binary one; a memory value with no suffix, which is bytes; a CPU limit written with M rather than m; and requests across the set that exceed a supplied namespace quota.

Match every Service selector in a set of Kubernetes manifests against the pod template labels of every workload in the same set. Reports a Service whose selector matches no supplied workload, which has no endpoints so every request to it fails to connect; a targetPort no matched container declares, which fails at connection time rather than at apply time; and a workload whose own selector does not match its own pod template, which the API server rejects.

Build the internal link graph from a set of supplied pages and report its structure. Names pages with no inbound link, pages unreachable by following links from the declared entry points, internal links pointing outside the supplied set, and links that do not resolve at all. Fragments are stripped, since they identify a position rather than a page. Nothing is fetched, so a link to a page that exists and was not supplied is reported as not in the set rather than as broken.

Compare two versions of a base locale and report which translations went stale. A base string edited without its translations being edited leaves every locale confidently wrong, nothing in the translation file marks it, and the diff is the only place it is visible. Also reports a removed key, where anything still referencing it shows the key in the interface; translations still carrying a removed key; and, per locale, how many of the new keys are outstanding.

Compare keys across locales, separating the three states a single completeness figure hides. An absent key shows the base string, the key itself or nothing, depending on the loader. An empty value satisfies a completeness count and renders nothing, which is how a blank interface passes a translation report. A value identical to the base is either untranslated or a loan word, and nothing says which, so the ambiguity is stated. Also reports a key no base locale defines.

Compare a locale file with the keys the code actually references. Reports a key nothing references, which is translated on every release and shown never, and a referenced key the file does not define, which shows the key itself in the interface. A key built at run time cannot be found by any scan, so the caller declares its prefix and those keys are excluded with the exclusion recorded. The reference list is the caller’s, and nothing is scanned here.

Measure how much longer or shorter each translation is than its base string. A translation much longer than the base overflows or truncates in a layout built to the base length; one much shorter is usually content that did not make it across, and both are reported with the ratio. Length is counted in code points, so an emoji is not counted twice, and a short absolute difference is never reported however large the ratio.

Audit the key structure of a locale file against a contract the caller states. Reports a message that is also the prefix of another message, which a loader nesting on the separator cannot hold both of so it keeps one and drops the other; two keys differing only in case, which is two keys to the file and one to any case-insensitive platform; a doubled separator, which resolves to a different key than written; and whitespace in a key, which several loaders trim or reject.

Compare placeholder structure across locales. A placeholder missing from a translation renders blank in some frameworks and throws in others, so the same file is a cosmetic bug in one stack and a crash in the next. ICU braces, printf conversions and mustache pairs are all recognised. Also reports a placeholder no base string supplies, a positional count that differs, a syntax that differs between locales, and unindexed printf placeholders reordered by a translation, which the renderer ignores.

Check that every plural message covers the categories its language actually uses. A language with six categories given two has no message at all for the other four, and the usual fallback is the key itself appearing in the interface. Both suffixed keys and ICU plural blocks are read. Also reports a declared category the language never selects, so the text is translated and never shown, and an ICU plural with no other branch, which the format requires. The category table is published.

Read the characters in a locale file rather than its structure. Reports a bidirectional control character, which is invisible in every editor and reorders everything after it including text nobody touched; a zero-width character, which still counts toward a length limit; text not in NFC form, which compares unequal to the same text typed differently; and markup appearing only in a translation, where the call site was written for plain text.

Compare two lockfiles and report what a manifest diff cannot see. Reports newly installed transitive packages, resolved version moves with breaking risk, a registry that changed, and the most serious finding available here: the same version with a different integrity hash, meaning the artifact behind a version that was supposed to be immutable is not the one that was there before.

Audit newline-delimited JSON logs against a contract, and across the whole set. The two findings that need every line at once: a field whose type varies between lines, so an index either rejects the minority or coerces them silently; and a message field with nearly as many distinct values as lines, which is interpolated rather than templated so nothing groups and cost scales with volume. Also reports absent required fields, a level differing only in case, and a timestamp with no offset.

Read an SPF record, a DMARC record and a set of DKIM selectors together, and report the combinations that defeat themselves. Every finding needs two or three records at once, which is why a single-record checker finds none of them: a reject policy with no usable selector, an enforcing policy over an SPF record ending in +all, strict alignment with subdomain senders, enforcement with no reporting address, and a subdomain policy that no sending path can satisfy.

Audit a lookup table against its contract. The finding that matters most: one source mapping to several targets, because a lookup built from it is not a function and whichever row is read last wins. Also reports required sources that are unmapped, so anything carrying them falls through, targets outside the permitted set, and - when a one-to-one mapping is declared - a target reached from several sources.

Find out whether an agent can actually choose correctly within a toolset. Reports pairs of tools whose words overlap enough to be confusable, descriptions too short or too empty to distinguish, undescribed arguments an agent must guess at, tools with so many arguments they are filled wrong, state-changing tools with no annotation hints, and the total size of the manifest, which occupies the model context on every turn.

Decide whether an MCP server update breaks its callers. Classifies each change by direction: an agent produces the tool call and consumes its result, so an input-schema change breaks callers while an output-schema change breaks whatever reads the result. Also reports a tool that stopped declaring readOnlyHint, which is a consent change no schema diff would surface.

See how an MCP server’s advertised capability surface changed. Reports capabilities and features added or removed, and the shift in the aggregate annotation surface: how many tools declare themselves read-only, destructive, idempotent or open-world. That total governs what a client may let an agent do without asking a human.

See which tool arguments changed obligation between two MCP manifests. Separates tightening, where every existing call now fails, from loosening, where a tool may be invoked without something it previously demanded. A newly required argument is the single change most likely to break an agent that was working yesterday.

Validate a suite of recorded tool calls against the current MCP manifest and get the failing call index, tool and pointer for each breach. The regression gate for a team that keeps recorded calls as fixtures: after a server update, this says which fixtures no longer satisfy the tools they call. Nothing is executed.

Find out which tools and arguments your agent actually uses. From a transcript of recorded calls, reports which declared tools were never called, which declared arguments were never sent, which arguments always carry the same value, and any call to a tool the manifest does not declare. Nothing is executed.

Check whether several MCP servers can be mounted together. Reports tool names declared by more than one server, which is an ambiguity no prompt can resolve, and pairs of differently named tools whose words overlap enough that an agent will confuse them. Optionally enforces a server-name prefix convention.

Audit one MCP toolset for the defects that stop an agent calling it correctly: a missing or non-object inputSchema, an argument with no type or no description, a required argument the schema never declares, a duplicated tool name, contradictory annotation hints, and a tool whose name reads as state-changing while declaring no hints at all.

See which tools were added, removed or altered between two MCP manifests, and in what respect. Reports a changed description as a change in its own right, because the description is the text an agent reasons over when choosing a tool: editing it can change behaviour with no schema moving at all.

Audit metric names, types and label sets. The finding that needs the whole set: a metric appearing with different label sets, so a sum or average over it groups by whichever labels happen to be present, which is not the grouping anybody asked for. Also reports a counter without a total suffix, a gauge named like one, a sub-second unit where the convention is seconds, a label holding identifiers, which is unbounded cardinality by construction, and a label reserved for another metric type.

Audit an MTA-STS policy against the MX hosts it is meant to authorise. Reports an MX host no pattern matches, which under enforce mode refuses every message to that host; testing or none mode, where nothing is enforced; a max_age under a day, where a receiver that cannot fetch the policy stops honouring it almost immediately; and a DNS record with no id, without which a cached policy is never refreshed.