@glasswatch/collector

Outside-in client-side scan engine. Point it at a URL and get a structured report of what runs on the page and how risky it is — scripts and their origins, third-party network destinations, security headers, cookies and trackers, known-vulnerable libraries, tech stack, and an A–F risk grade.

Part of the Glasswatch project. Apache-2.0.

Requirements

• Node.js ≥ 20.

• Chromium for Playwright. The collector drives a headless Chromium browser, which is downloaded separately from the npm package. Run this once after installing (and on CI):

  npx playwright install chromium

  Without it, the first scan fails with a "browser not found" error.

CLI

npx @glasswatch/collector https://example.com

Prints a JSON ScanResult.

Library

import { scan } from "@glasswatch/collector";

const result = await scan("https://example.com", { enforceSsrfGuard: true });
console.log(result.grade.letter, result.trackers);

Security: when scanning untrusted, user-supplied URLs on shared infrastructure, always pass { enforceSsrfGuard: true } to refuse private/loopback/metadata targets.

Detection rules

The seed datasets in data/ (trackers.json, known-vulns.json, fingerprints.json) are intentionally small and community-maintainable. Contributions that expand coverage are welcome.