Laravel Auditor skill
A Composer package that teaches an AI agent to audit a Laravel app from evidence and return findings as a structured report.
- 75 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Reads routes, database schema and project configuration, and the installer edits `AGENTS.md`, `CLAUDE.md` and the agent config.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/laravel-auditorDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads routes, database schema and project configuration, and the installer edits `AGENTS.md`, `CLAUDE.md` and the agent config.
This is third-party code. Review the repository files before installing.
What it does
Laravel Auditor adds a `laravel-audit` skill and a set of MCP tools that read facts about the application without running its code: PHP and Laravel versions, routes, models, migrations, database schema, authorization policies, queues and tests. The agent follows a discover, scope, verify, report loop and records only what a file, route or schema confirms. The 0.1.x release ships 85 rules covering security, performance, architecture, database, testing and Laravel conventions. Optional rule packs for Livewire, Filament, Inertia, Sanctum and Pest apply only when those packages are installed. `php artisan auditor:report` renders the findings into a report.
Who it is for. Laravel 12 and 13 teams that ask Claude Code or Codex for code review and want verifiable findings instead of guesses.
Good fit when
- Before a release, you want uncommitted changes checked for authorization gaps and mass assignment.
- A page is slow and you need to locate queries in loops and redundant fetches.
- The agent inherits an unfamiliar project and maps routes, models and database schema.
- After fixes, you want to re-run the audit and compare findings with the previous report.
Not a fit when
- You want a one-click scanner that works without an agent.
- The application is not built on Laravel, or runs a version below 12.
- The agent output would be accepted without reading the supporting files.
Example request
Use the laravel-audit skill: call review_scope and audit the uncommitted files, reporting only evidenced findings.Limitations
Requires PHP 8.3 or newer and Laravel 12 or 13. The project is early 0.1.x, and finding quality depends on how closely the agent follows the skill. Rules only describe what to look for: the agent runs the checks itself, so serious findings deserve manual confirmation. The installer writes adapters into `AGENTS.md`, `CLAUDE.md` and a `.ai/` directory and registers the MCP server in the chosen agent config.
How to disable. Run `composer remove mrpunyapal/laravel-auditor --dev`, then delete the published files in `.ai/`, the adapters and the MCP server entry from the agent config.
FAQ
How do I install Laravel Auditor for Claude Code?
Add the package with `composer require --dev mrpunyapal/laravel-auditor` and run `php artisan auditor:install --agents=claude_code`. The installer copies the skill and registers the MCP server.
What if the project already uses Laravel Boost?
Run `php artisan boost:install`: Boost reads the guidelines and skills from the package directly. There is no need to run `auditor:install`.
Does the audit modify application code?
No, the audit is read-only. For a whole-application audit it is worth stating explicitly that code must not be changed.
How do I list the rules?
Run `php artisan auditor:rules`. The `--domain=security` flag narrows it to one domain and `--json` prints a machine-readable list.
Which agents are supported?
The installer knows `claude_code`, `codex`, `cursor`, `copilot`, `gemini`, `opencode`, `junie` and `zed`, plus your own agents from the `custom_agents` config key.
Discussion
No questions or reviews yet.
Related
SkillsThe project-local CLI checks PHP quality, style and complexity so an agent can inspect findings before changing the app.
Agent Skills (AsyrafHussin)
Agent Skills
24 skills for Laravel, PHP, React and TypeScript: code rules, testing, security, technical debt and documentation.
PHP Architecture Toolkit is a Claude Code plugin for DDD, CQRS and PSR audits, tiered reviews and test generation.
A Composer plugin that ships AI skills as dependencies, pulls them from vendor and Git and syncs to a project folder.
Bagisto Agent Skills: Bagisto development
Bagisto Agent Skills
21 skills for Bagisto store developers: packages, payments, shipping, themes, DataGrid, Pest and Playwright tests, API
The developing-with-prism skill teaches an agent to write Prism code, a Laravel LLM package: text, structure, tools, streaming.
README in short
The package installs as a dev dependency and wires into the agent. Audit knowledge lives once and is adapted per agent through thin wrappers, while deterministic collectors gather project data.