This is it running
Not a mockup and not a reconstruction — a scripted pass over a page you have read, recorded whole, re-rendered every release so it cannot quietly stop matching the product.
A panel that floats over the page — names the framework, extracts the palette, measures the box model — and scores how much of the page an AI generated. Twenty-eight heuristics, every one quoting the number it fired on.
3 free audits · no sign-up · no <all_urls>
Not a mockup and not a reconstruction — a scripted pass over a page you have read, recorded whole, re-rendered every release so it cannot quietly stop matching the product.
All of it on the page you are already looking at, and none of it behind an account.
Frameworks, UI kits, bundlers, CDNs, payment providers, consent managers. Every row shows the literal evidence that matched — a selector, a URL, a header — and the confidence behind it.
Pin one page, open another. You get what each one runs alone, what both share, and where their versions have drifted. Neither report leaves the browser.
Twenty-eight heuristics across markup, CSS, runtime, copy and accessibility. Each finding quotes the number that triggered it and states the change that would fix it.
Around seventy CSS properties, editable in place with a unit menu and a colour picker. Box model, contrast against the first opaque ancestor, distances to the viewport edges, and a numbered tab order.
Palette and font matrix read from what is painted rather than from what is declared. Copy them as a Tailwind theme, a config, W3C design tokens or a Figma token file.
Side-by-side iframes at genuine device widths, so breakpoints resolve the way a visitor gets them. A CSS transform would show the desktop layout at phone size and call it mobile.
One install, one shortcut, one permission list. The three markedProare marked the same way inside the panel, next to a sentence saying what they do once unlocked.
Act on the page. Every one of them undoable.
Read the page, and hand back somewhere to look.
Read this against the manifest of anything else you have installed. It is the comparison that does not show up in a feature table.
Reads the tab you are on, from the moment you click. Not before, and not any other tab.
Keeps your settings, the local device id and your own AI key on this machine. Nothing in it is synced.
Runs the inspector inside that one page. There is no declared content script, so nothing is injected anywhere you have not acted.
Adds the right-click entries. It carries no data access at all — it cannot read the page, the tab, or what you clicked.
Absent from both built manifests. A test fails if one appears.
Never as a permission. It appears once, in web_accessible_resources, which is not one.
Your other tabs are not enumerated, titled or counted.
The cookie editor reads document.cookie — exactly what the page can already read about itself.
Nothing sits in front of your traffic.
Not requested, and nothing in the panel would use them.
There is none to make. A device id is minted locally on first run.
This site fetches nothing off-origin, and its build is scanned for it.
An audit runs on a click. No tab is read because you happened to open it.
Four more are optional and none of them is granted at install: the AI provider origins, the one that lets the panel open itself on a page, the request-rule permission and the WebRTC privacy setting. Each is asked for from the click that turns the feature on, and handed back in the action that turns it off.
Safari is not shipped and is not on the roadmap. Its extension model would need a third build and a native app wrapper around it, which is a different product rather than a fourth target.
It floats over the page, not beside it — a docked panel narrows the viewport, so every width you measure belongs to a layout no visitor sees. Drag it anywhere, and it stays put when you click into the page, which is exactly when a hover inspector needs to still be there.
No price is printed on this page on purpose — checkout reads the live one, so this cannot quote a figure that has moved.
No account, no card
A device id is minted locally on first run.
Billed monthly
Everything in Free, and everything in the list below.
Cancel any time from the Stripe portal.
One-time payment
Everything in Free, and everything in the list below.
No subscription, no renewal.
Run one on every page of a site instead of rationing the free three.
The full rule breakdown and what to change, not the score and a summary.
The version this page is serving, dated against published CVEs.
Send a client the finding instead of a screenshot. It stops working on your date.
The page is read here. Paying does not switch that off — there is no version that does.
Upgrading happens in the panel, not here. Payment runs through Stripe and we never see a card number; a refund is fourteen days, by email.
What is in the build today. Nothing here is a roadmap item.
A hostname. Integer counts. Class-name strings. The page title and heading text, truncated and redacted. That is the whole audit payload — no body copy, no form values, no full URL.
Everything else. The palette, the fonts, the assets, the box model and every live edit stay in the page and leave only through your clipboard. Your AI keys never reach our servers — they are not in the request, and the code that sends them cannot reach the code that talks to us.
<all_urls>. There is no declared content script and no host permission; page code is injected only on the tab you invoked it on, only when you click. Nothing runs in the background across your tabs.
// permissions, both builds
"permissions": ["activeTab", "storage", "scripting"]
"host_permissions": []
Twenty-eight heuristics across five weighted categories — markup, CSS, runtime, copy and accessibility. Each awards partial credit against a budget and quotes the value it measured, so a score of 62 comes with the sentence that produced it. The scoring runs on the server, not in the extension, so it cannot be read off or edited from the page it is judging.
No. It means the markup carries the fingerprints of a generator: repeated utility strings, inline SVG flooding, unstyled component defaults, buzzword headings. Plenty of good sites are generated and plenty of hand-written ones are a mess. The report is a starting point for a refactor, not a verdict on the work.
DevTools answers one element and one question at a time. This reads the whole page at once and hands back a ranked list — every element that overflows the viewport, every stacking context, every image shipped at twice the size it renders, a heatmap of which rule actually won. It also answers questions DevTools never asks: what the page was built with and how each detection was made, what its design tokens are, and how much of the markup reads as generated. It floats over the page rather than docking beside it, so what you are inspecting keeps the width it had.
So did we. Forty-six tools and diagnostics in one panel is one install, one shortcut and one place to look — and, more to the point, one permission list. Four extensions that each read every site you visit are a wider surface than one that reads the tab you are looking at when you click it. Compare the manifests rather than the feature tables; that is where the difference is.
Free is for looking, and looking is most of it: the inspector, the extractors, the stack detection with the evidence for each match, the SEO and accessibility readers, and the tools and diagnostics that answer from the document already in front of you. Pro is for taking something away — a generated theme or token file, a client-ready report, a WCAG conformance statement, the third-party register — and for the readings that cost a request, the audit past the free three among them. Every locked feature is marked where it sits, with a sentence saying what it does once unlocked, so you meet the line while reading rather than at the checkout.
One payment, no renewal, and it carries exactly what the monthly plan carries. That is a constraint in the code rather than a promise in the copy: both plans are held to one shared feature list, so neither can quietly grow a perk the other lacks. No price appears on this page on purpose — checkout reads the live one, so this page cannot quote a stale figure.
Fourteen days from the payment. Email and ask — there is no form to fill in and no retention flow to sit through. Fourteen rather than thirty because it is the withdrawal period EU consumer law already gives you for digital content bought online, so the promise and the obligation are one thing instead of two. Payment runs through Stripe and we never see a card number.
That is what the changelog is for. The release list on this site and the What’s new screen in the panel render the same array, so the rate is visible rather than promised. Adding a tool to the panel is a row in a table by design, which is why the count keeps moving.
Most of it does not depend on us. Everything that reads the page in front of you runs in the browser and calls nothing — the inspector, the extractors, the stack detection, the SEO and accessibility readers, and every tool and diagnostic that works on the open document. What would stop is the handful of readings that leave this machine: the audit, the Server tab’s probes, field data from the Chrome UX Report, the advisories against a detected version, the sitemap crawl, and anything published at a link. The panel would keep working; it would answer fewer questions.
Yes, personal and commercial both. The client report is built for exactly that — a branded export of a finding at a link that stops working on a date you choose, instead of a screenshot in an email.
Yes. It reads whichever tab you are on when you click, which includes localhost, a staging host and anything you are signed in to. There is no list of sites it works on because there is no list of sites at all.
A hostname, integer counts, class-name strings, and the page title plus heading text after truncation and redaction. No body text, no input values, no full URL. The privacy page lists every field.
An audit costs a server request; nothing else in the extension does. The inspector, extractor and the three playground tools run entirely in your browser and are free without limit. A device id is minted locally on first run — there is no account to create and no email to give.
Into your browser storage, and from there straight to the provider you chose. They are never sent to our server, never logged, and never shown again in full. Browser storage is not encrypted — anything with access to your profile can read it — and the settings screen says so before you paste anything.
activeTab and scripting, granted for the tab you are on when you click. That is what lets it read the page you asked about. It does not request access to all sites, and neither built manifest contains a host permission.
Chrome, Edge and any other Chromium browser, and Firefox from version 140. It is the same panel on both — one build target each, and the two manifests are structurally identical. The Firefox floor is 140 because that is the version with the built-in data-consent screen; below it an add-on has to ship its own, and a second parallel consent path for the one security-relevant statement this product makes is worse than a higher floor. Safari is not shipped.