complytest

Deterministic GDPR, WCAG 2.2 & security compliance scanner. The ESLint of web compliance.

ComplyTest scans any website and produces deterministic pass/fail verdicts for 69 compliance rules across consent (GDPR/ePrivacy/DSA), accessibility (WCAG 2.2 A/AA/AAA), security & privacy (CSP/HSTS/COOP/TLS/PCI DSS/Privacy Sandbox), and transparency (DSA). Zero runtime JavaScript. CI/CD-native.

npx complytest scan https://your-site.com

Install

npm install -g complytest      # global
npm install -D complytest      # dev dependency
pnpm add -D complytest

On first run, Chromium installs automatically (~2 min). To install it manually:

npx playwright install chromium

Requires Node.js >= 22.

Quick start

npx complytest scan https://example.com

Results for https://example.com
Scanned in 8.3s

  Score: 62% (43/69 rules passed)
  consent          WARN  12/19
  accessibility    PASS  21/21
  security         WARN   6/19
  transparency     PASS   4/4

| Score | Meaning | |---------|-----------------------------------------------------| | 80%+ | Good — minor issues only | | 50–79% | Needs work — likely consent or security gaps | | < 50% | Critical issues — GDPR or WCAG violations likely |

Commands

| Command | Purpose | |---------|---------| | complytest scan <url> | Quick single-URL scan | | complytest run | Full config-driven scan | | complytest run-multi | Multi-site scanning | | complytest scan-batch | Batch URL scanning with concurrency + aggregate summary | | complytest diff | Compare two scan results | | complytest validate | Validate config file | | complytest digest | Weekly compliance digest | | complytest agent | Autonomous agent (once / watch) | | complytest init | Setup wizard: CMP detection, scaffold config |

Output formats

complytest scan https://example.com --format json    # also: html, csv, sarif, pdf, complicer

Fail builds in CI

complytest scan https://example.com --fail-on critical

Custom rules

Drop *.json / *.yaml rule files in a directory and load them with --custom-rules <dir>. Rule IDs must start with custom.. Ten check types are supported: selector_exists, selector_absent, selector_count, header_present, header_equals, header_not_contains, cookie_absent, text_contains, text_absent, meta_present.

What gets checked

• Consent (19 rules) — consent effectiveness via CDP cookie interception (proves trackers actually stop after reject), DSA dark-pattern detection, consent tiers.
• Accessibility (21 rules) — axe-core plus all 9 new WCAG 2.2 success criteria.
• Security (23 rules) — Observatory-style CSP/HSTS/TLS/CORS/SRI/cookies, PCI DSS, Privacy Sandbox.
• Transparency (6 rules) — DSA policy links.

Why ComplyTest

• Deterministic — same input, same verdict. No AI/ML at runtime.
• No injected JavaScript — scans from the outside like a real browser; nothing added to your site.
• CI/CD-native — exit codes, SARIF, JSON. Not a SaaS dashboard.

Links

• GitHub: https://github.com/petrkindlmann/compliance
• Full documentation: see the project README

License

MIT