Laravel Auditor: AI Code Auditing with 75 Rules | Mohamed Said [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://www.msaied.com) [ Home ](https://www.msaied.com) [ Projects ](https://www.msaied.com/projects) [ Articles ](https://www.msaied.com/articles) [ Certificates ](https://www.msaied.com/certificates) [ Contact ](https://www.msaied.com#contact-section) [ ](https://github.com/EG-Mohamed) [ Home ](https://www.msaied.com) [ Projects ](https://www.msaied.com/projects) [ Articles ](https://www.msaied.com/articles) [ Certificates ](https://www.msaied.com/certificates) [ Contact ](https://www.msaied.com#contact-section) [ home ](https://www.msaied.com) [ articles ](https://www.msaied.com/articles) Laravel Auditor: AI-Powered Code Auditing for Laravel Applications On this page 1. [ What Is Laravel Auditor? ](#what-is-laravel-auditor) 2. [ Key Features ](#key-features) 3. [ 75 Rules Across Six Domains ](#75-rules-across-six-domains) 4. [ Read-Only Context Collectors ](#read-only-context-collectors) 5. [ Structured Findings and Flexible Reports ](#structured-findings-and-flexible-reports) 6. [ Installation ](#installation) 7. [ Takeaways ](#takeaways) ![Laravel Auditor: AI-Powered Code Auditing for Laravel Applications](https://cdn.msaied.com/593/e1204fbf1f19082d6afc53717375ca16.png) [ Composer Pacakge ](https://www.msaied.com/articles?category=composer-pacakge) [ AI ](https://www.msaied.com/articles?category=ai) #Laravel #AI #Code Auditing #MCP #Security #Packages Laravel Auditor: AI-Powered Code Auditing for Laravel Applications ==================================================================== 24 Aug 2026 3 min read ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said Table of contents 1. [ 01 What Is Laravel Auditor? ](#what-is-laravel-auditor) 2. [ 02 Key Features ](#key-features) 3. [ 03 75 Rules Across Six Domains ](#75-rules-across-six-domains) 4. [ 04 Read-Only Context Collectors ](#read-only-context-collectors) 5. [ 05 Structured Findings and Flexible Reports ](#structured-findings-and-flexible-reports) 6. [ 06 Installation ](#installation) 7. [ 07 Takeaways ](#takeaways) What Is Laravel Auditor? ------------------------ Asking an AI agent to audit your Laravel app without any structure tends to produce a noisy mix of genuine bugs, stylistic opinions inflated to high severity, and phantom vulnerabilities. [Laravel Auditor](https://github.com/MrPunyapal/laravel-auditor), created by Punyapal Shah, solves this by giving the agent you already use a formal audit methodology, a catalog of 75 rules with stable IDs, and a set of read-only tools that collect deterministic facts about your project. The package itself executes no checks. Instead, it installs skills and guidelines for your chosen agent — Claude Code, Codex, Cursor, Copilot, Gemini CLI, Junie, Zed, or opencode — and then lets that agent run a structured **Discover → Scope → Verify → Report** pass over your codebase. Key Features ------------ ### 75 Rules Across Six Domains Every finding references a stable rule ID, from `AUD-SEC-001` (missing authorization boundary) to `AUD-PER-011` (query executed inside a loop). The catalog spans: - **Security** — authorization gaps, injection risks, exposure issues - **Performance** — N+1 queries, inefficient loops - **Architecture** — structural and design concerns - **Database** — migration and schema issues - **Testing** — coverage and assertion quality - **Laravel conventions** — idiomatic usage Conditional rule packs for Livewire, Filament, Inertia, Sanctum, and Pest activate only when those packages are detected. List applicable rules with: ```bash php artisan auditor:rules --applicable ``` ### Read-Only Context Collectors Before reading any source file, the agent collects structured facts through eleven MCP tools: `project_info`, `routes`, `models`, `migrations`, `database_schema`, `dependencies`, `configuration`, `policies_authorization`, `jobs_events_schedules`, `tests`, and `subsystems`. Register the MCP server in one command: ```bash claude mcp add -s local -t stdio laravel-auditor php artisan auditor:mcp -q ``` Collectors are also available directly via Artisan or the `LaravelAuditor` facade: ```bash php artisan auditor:context routes --output=storage/auditor-routes.json ``` ```php use LaravelAuditor\Facades\LaravelAuditor; LaravelAuditor::collect('models'); ``` Filters are supported — `routes {uri: "api"}` — so an agent verifying a single suspicion pulls only the relevant slice. ### Structured Findings and Flexible Reports Each finding is structured JSON carrying a rule ID, severity (`critical` down to `info`), a separate confidence value, file-and-line evidence, and a fix recommendation: ```json { "id": "F-2026-0001", "rule_id": "AUD-SEC-001", "title": "Missing authorization boundary", "severity": "high", "confidence": "confirmed", "evidence": [ { "type": "file", "reference": "app/Http/Controllers/PostController.php", "line": 42 } ], "recommendation": "Authorize the deletion with a PostPolicy or route middleware." } ``` Reports can be rendered as Markdown, JSON, CLI text, or SARIF for inline pull-request annotations: ```bash php artisan auditor:report --findings=storage/auditor-findings.json --format=sarif php artisan auditor:ci --findings=storage/auditor-findings.json --fail-on=high ``` Installation ------------ Laravel Auditor requires PHP 8.3+ and Laravel 12 or 13. Install it as a dev dependency: ```bash composer require --dev mrpunyapal/laravel-auditor php artisan auditor:install --agents=claude_code ``` Once installed, prompt your agent: > Use the laravel-audit skill to audit this application. Discover the project first, scope the relevant domains, and report only evidenced findings. **Note:** The package is in early development (0.1.x) at the time of writing. Takeaways --------- - Installs as a dev dependency; the agent does the work, the package provides the methodology - 75 rules with stable IDs across security, performance, architecture, database, testing, and conventions - Conditional packs for Livewire, Filament, Inertia, Sanctum, and Pest - Eleven read-only MCP context collectors prevent hallucinated findings - SARIF output enables inline annotations on pull requests - `auditor:ci --fail-on=high` integrates findings into CI pipelines Source: [Laravel News — Laravel Auditor](https://laravel-news.com/laravel-auditor) Found this useful? [ ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.msaied.com%2Farticles%2Flaravel-auditor-ai-powered-code-auditing-for-laravel-applications&text=Laravel+Auditor%3A+AI-Powered+Code+Auditing+for+Laravel+Applications) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.msaied.com%2Farticles%2Flaravel-auditor-ai-powered-code-auditing-for-laravel-applications) Frequently Asked Questions ---------------------------- 3 questions Q01 Does Laravel Auditor run the checks itself? No. Laravel Auditor installs skills, guidelines, and adapter files for your chosen AI agent (Claude Code, Cursor, Copilot, etc.) and provides read-only context collectors. The agent performs the actual audit using the Discover → Scope → Verify → Report methodology the package defines. Q02 Which AI agents does Laravel Auditor support? Laravel Auditor supports Claude Code, Codex, Cursor, Copilot, Gemini CLI, Junie, Zed, and opencode. You specify the agent during installation with the --agents flag, for example: php artisan auditor:install --agents=claude_code. Q03 Can Laravel Auditor findings be used in a CI pipeline? Yes. The auditor:ci command accepts a --fail-on flag (e.g., --fail-on=high) that converts findings of the specified severity or above into a non-zero exit code, making it straightforward to block merges on critical or high-severity issues. Continue reading More Articles --------------- [ View all ](https://www.msaied.com/articles) [ ![Laravel Queues at Scale: Backpressure, Dead-Letter Queues, and Graceful Degradation](https://cdn.msaied.com/602/fcffaaa5442f84486d6059eaa4106d26.png) laravel queues reliability ### Laravel Queues at Scale: Backpressure, Dead-Letter Queues, and Graceful Degradation Beyond basic queue workers: learn how to implement backpressure signals, dead-letter queues, and graceful degr... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 28 Aug 2026 3 min read Read ](https://www.msaied.com/articles/laravel-queues-at-scale-backpressure-dead-letter-queues-and-graceful-degradation) [ ![Mask Query Bindings in Laravel Exception Messages](https://cdn.msaied.com/603/3011313796d00cd5c4e1ead00e1e9ba1.png) Laravel Security QueryException ### Mask Query Bindings in Laravel Exception Messages Laravel 13.27 adds a per-connection option to prevent bound query values from appearing in QueryException mess... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 27 Aug 2026 3 min read Read ](https://www.msaied.com/articles/mask-query-bindings-in-laravel-exception-messages) [ ![whereBinary(): How to Run Case-Sensitive MySQL Queries in Laravel 13.27](https://cdn.msaied.com/600/0c7655400b43d3b85d1d1e9d0f4c8094.png) Laravel MySQL Query Builder ### whereBinary(): How to Run Case-Sensitive MySQL Queries in Laravel 13.27 Laravel 13.27 adds whereBinary(), orWhereBinary(), whereNotBinary(), and orWhereNotBinary() — clean query-buil... ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MJ.jpg) Mohamed Said 26 Aug 2026 4 min read Read ](https://www.msaied.com/articles/wherebinary-how-to-run-case-sensitive-mysql-queries-in-laravel-1327) [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://www.msaied.com)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. Explore - [Home](https://www.msaied.com) - [Projects](https://www.msaied.com/projects) - [Articles](https://www.msaied.com/articles) - [Certificates](https://www.msaied.com/certificates) - [Contact](https://www.msaied.com#contact-section) Connect - [ hello@msaied.com ](mailto:hello@msaied.com) - [ +20 109 461 9204 ](tel:+201094619204) © 2026 Mohamed Said. All rights reserved. [ ](https://github.com/EG-Mohamed) [ ](https://www.linkedin.com/in/msaiedm/) [ ](https://wa.me/201094619204) [ ](mailto:hello@msaied.com) [ ](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view)