28 small open-source tools that check things

Each one does a single job, runs with no dependencies or with what you already have, and prints what it found and what to do about it. Source is MIT.

AI coding agents

• agents-md-check
  pip install agents-md-check
  Lint AGENTS.md, CLAUDE.md and .cursor/rules for what makes an agent ignore them: dead path references, contradictions, duplicates, unscoped rules.searched for: agents.md best practices · claude.md rules · cursor rules globs · ai coding agent instructions
• production-mcp-server-template
  npx production-mcp-server-template # npm package queued
  A minimal working MCP server in TypeScript and Python with the production details right: stderr logging, structured error results, transports.searched for: mcp server example · model context protocol server template · mcp stdio server python · mcp server error handling

APIs, web & extensions

• mv3-manifest-lint
  Static linter for Chrome Manifest V3 extensions: the mistakes that get you rejected from the Web Store or break at runtime. 37 rules.searched for: chrome extension manifest v3 errors · mv3 csp unsafe-eval · web store rejection · manifest v3 migration check
• openapi-breaking-change-lint
  pip install openapi-breaking-change-lint
  Diff two OpenAPI specs and classify every change as breaking, potentially breaking or compatible. CI gate plus API design lint, no dependencies.searched for: openapi breaking changes · compare two openapi specs · api contract diff ci · swagger breaking change detection
• schema-jsonld-validator
  pip install schema-jsonld-validator
  Validate JSON-LD structured data against the real schema.org vocabulary and Google's requirements, and warn on markup features Google has retired.searched for: json-ld validator · schema.org structured data check · faqpage deprecated · rich results testing
• stripe-webhook-replay
  Replay Stripe subscription webhooks at your local handler with real signatures: out-of-order delivery, dunning failures, duplicates and retries.searched for: replay stripe webhooks locally · test stripe subscription webhooks · stripe webhook fixtures · simulate stripe dunning
• vscode-extension-lint
  Static linter for a VS Code extension project: manifest, .vscodeignore and packaging mistakes that get you rejected or ship a broken extension.searched for: vscode extension publishing errors · vscodeignore mistakes · vsce package missing files · vscode marketplace rejection
• wcag-axe-crawler
  pip install wcag-axe-crawler
  Crawl a site with axe-core and report WCAG violations, and generate an accessibility statement that refuses to claim conformance you cannot prove.searched for: wcag accessibility audit tool · axe-core crawler · accessibility statement generator · european accessibility act check
• webhook-signature-verify
  Verify Stripe, GitHub and Shopify webhook signatures correctly, plus race-free idempotency so a retried delivery can never execute twice.searched for: stripe webhook signature verification · verify webhook signature node python · webhook idempotency · shopify hmac webhook

Automation & operations

• incident-severity-lint
  pip install incident-severity-lint
  Classify incident severity from user impact instead of gut feeling, and lint the incident record for the questions a postmortem has to answer.searched for: incident severity matrix · sev level classification · postmortem template review · on call severity guide
• n8n-dead-branch-lint
  pip install n8n-dead-branch-lint
  Lint an exported n8n workflow for dead branches, dangling connections, unreachable nodes and hardcoded secrets, before it silently stops working.searched for: n8n workflow not running · n8n dead branch · n8n broken connection export · validate n8n workflow json

CI & delivery

• actions-audit
  pip install actions-audit
  Audit GitHub Actions workflows for supply chain risk: unpinned actions, script injection, pull_request_target, missing permissions and timeouts.searched for: github actions security audit · unpinned action sha · workflow script injection · github actions linter
• dockerfile-hardening-lint
  pip install dockerfile-hardening-lint
  Static Dockerfile audit for hardening mistakes: root user, secrets in build args, latest tags, cache-busting layer order. No Docker daemon needed.searched for: dockerfile security check · dockerfile best practices linter · container runs as root · docker image hardening
• eslint-architecture-rules
  npx eslint-architecture-rules # npm package queued
  ESLint rules that fail CI when architecture boundaries erode: layer and feature imports, public entry points, hermetic tests, console in libraries.searched for: eslint architecture boundaries · no cross feature import · enforce module boundaries javascript · eslint import restrictions
• feature-flag-codemods
  npx feature-flag-codemods # npm package queued
  Remove feature flags that are fully rolled out, and refuse any flag that cannot be proven safe to delete. Byte-level proof untouched code stays untouched.searched for: remove stale feature flags · feature flag cleanup · delete launchdarkly flag · flag debt codemod
• playwright-flaky-test-classifier
  npx playwright-flaky-test-classifier # npm package queued
  Turn Playwright's flaky label into a ranked cause: parse JSON run reports and classify each flaky test as timing, ordering, network or test-data.searched for: playwright flaky tests · flaky test triage · playwright test report analysis · why are my e2e tests flaky
• pr-review-lint
  pip install pr-review-lint
  First-pass pull request review driven by your own markdown rules, with a dry-run that shows exactly what it would post before it posts anything.searched for: automate pr review · pull request review bot · review pr against team rules · dry run code review bot

Data & cloud cost

• bank-csv-reconcile
  pip install bank-csv-reconcile
  Turn a bank CSV or Excel export into one clean table and reconcile the running balance, so a dropped row shows up instead of silently changing totals.searched for: bank statement csv to excel · reconcile bank statement · convert bank export to one table · ofx qif csv normalise
• cur-athena-lint
  pip install cur-athena-lint
  Lint AWS Cost and Usage Report Athena SQL for partition pruning and column mistakes, with the schema reference and a FinOps playbook.searched for: aws cur athena query · cost and usage report sql · athena partition pruning cost · aws cost anomaly query
• ga4-bigquery-lint
  pip install ga4-bigquery-lint
  Lint GA4 BigQuery SQL for the session, event_params and cost mistakes that quietly give you wrong numbers, using sqlglot's real BigQuery grammar.searched for: ga4 bigquery queries · sessionisation 30 minute rule · ga4 event_params unnest · bigquery cost control query

Databases

• pg-perf-check
  pip install pg-perf-check
  PostgreSQL performance diagnostics: 24 read-only checks and 7 SQL files for bloat, missing indexes, slow queries, locks and autovacuum.searched for: postgres performance tuning queries · find missing indexes postgres · table bloat check postgresql · why is my postgres query slow
• pg-restore-drill
  Prove your PostgreSQL backup actually restores: a scripted point-in-time recovery drill with a measured RPO/RTO report and a negative control.searched for: test postgres backup restore · point in time recovery test · pg_basebackup wal archive verify · postgres restore drill
• postgres-migration-safety-lint
  pip install postgres-migration-safety-lint
  Lint SQL migrations before they run: finds statements that take an ACCESS EXCLUSIVE lock, rewrite a table, or destroy data, and gives the safe rewrite.searched for: postgres migration lock · alter table blocking migration · create index concurrently · safe database migration checker
• rls-policy-tester
  pip install rls-policy-tester
  Prove user A cannot read user B's rows in Postgres or Supabase with row level security, including negative controls that fail on a missing policy.searched for: supabase rls test · row level security testing postgres · rls policy leak check · multi tenant isolation test

Email & identity

• google-oauth-verification-preflight
  pip install google-oauth-verification-preflight
  Preflight an OAuth consent screen before submitting for Google verification: scope classification, branding requirements and the common rejection reasons.searched for: google oauth verification rejected · sensitive scopes verification · oauth consent screen requirements · casa security assessment
• spf-dkim-dmarc-audit
  pip install spf-dkim-dmarc-audit
  Audit SPF, DKIM and DMARC against live DNS, with recursive SPF lookup counting and the exact record to publish. Tested against 124 real domains.searched for: spf dkim dmarc check · spf lookup limit exceeded · dmarc policy audit · why do my emails go to spam

Invoicing & business

• peppol-ubl-validate
  pip install peppol-ubl-validate
  Validate UBL invoices against the official UBL 2.1 schemas and the published Peppol BIS Billing 3.0 rules, with Belgian VAT and OGM support.searched for: validate ubl invoice · peppol bis billing 3.0 validation · belgian e-invoicing 2026 · structured communication ogm check

Learning

• anki-deck-generator-lint
  Generate Anki decks from structured notes and lint the cards for the mistakes that make a deck unlearnable: ambiguity, overload, missing context.searched for: generate anki deck from notes · anki card quality · make better flashcards · anki deck from markdown