What Is Laravel Auditor?
Asking an AI agent to audit your Laravel app without any structure tends to produce a noisy mix of genuine bugs, stylistic opinions inflated to high severity, and phantom vulnerabilities. Laravel Auditor, created by Punyapal Shah, solves this by giving the agent you already use a formal audit methodology, a catalog of 75 rules with stable IDs, and a set of read-only tools that collect deterministic facts about your project.
The package itself executes no checks. Instead, it installs skills and guidelines for your chosen agent — Claude Code, Codex, Cursor, Copilot, Gemini CLI, Junie, Zed, or opencode — and then lets that agent run a structured Discover → Scope → Verify → Report pass over your codebase.
Key Features
75 Rules Across Six Domains
Every finding references a stable rule ID, from AUD-SEC-001 (missing authorization boundary) to AUD-PER-011 (query executed inside a loop). The catalog spans:
- Security — authorization gaps, injection risks, exposure issues
- Performance — N+1 queries, inefficient loops
- Architecture — structural and design concerns
- Database — migration and schema issues
- Testing — coverage and assertion quality
- Laravel conventions — idiomatic usage
Conditional rule packs for Livewire, Filament, Inertia, Sanctum, and Pest activate only when those packages are detected.
List applicable rules with:
php artisan auditor:rules --applicable
Read-Only Context Collectors
Before reading any source file, the agent collects structured facts through eleven MCP tools: project_info, routes, models, migrations, database_schema, dependencies, configuration, policies_authorization, jobs_events_schedules, tests, and subsystems.
Register the MCP server in one command:
claude mcp add -s local -t stdio laravel-auditor php artisan auditor:mcp -q
Collectors are also available directly via Artisan or the LaravelAuditor facade:
php artisan auditor:context routes --output=storage/auditor-routes.json
use LaravelAuditor\Facades\LaravelAuditor;
LaravelAuditor::collect('models');
Filters are supported — routes {uri: "api"} — so an agent verifying a single suspicion pulls only the relevant slice.
Structured Findings and Flexible Reports
Each finding is structured JSON carrying a rule ID, severity (critical down to info), a separate confidence value, file-and-line evidence, and a fix recommendation:
{
"id": "F-2026-0001",
"rule_id": "AUD-SEC-001",
"title": "Missing authorization boundary",
"severity": "high",
"confidence": "confirmed",
"evidence": [
{
"type": "file",
"reference": "app/Http/Controllers/PostController.php",
"line": 42
}
],
"recommendation": "Authorize the deletion with a PostPolicy or route middleware."
}
Reports can be rendered as Markdown, JSON, CLI text, or SARIF for inline pull-request annotations:
php artisan auditor:report --findings=storage/auditor-findings.json --format=sarif
php artisan auditor:ci --findings=storage/auditor-findings.json --fail-on=high
Installation
Laravel Auditor requires PHP 8.3+ and Laravel 12 or 13. Install it as a dev dependency:
composer require --dev mrpunyapal/laravel-auditor
php artisan auditor:install --agents=claude_code
Once installed, prompt your agent:
Use the laravel-audit skill to audit this application. Discover the project first, scope the relevant domains, and report only evidenced findings.
Note: The package is in early development (0.1.x) at the time of writing.
Takeaways
- Installs as a dev dependency; the agent does the work, the package provides the methodology
- 75 rules with stable IDs across security, performance, architecture, database, testing, and conventions
- Conditional packs for Livewire, Filament, Inertia, Sanctum, and Pest
- Eleven read-only MCP context collectors prevent hallucinated findings
- SARIF output enables inline annotations on pull requests
auditor:ci --fail-on=highintegrates findings into CI pipelines
Source: Laravel News — Laravel Auditor
