curbcut-cli

Audit a website for accessibility, SEO, security and performance problems. 77 checks on every page. No account, no API key, no browser download, no telemetry.

npx curbcut-cli yoursite.com

That is the whole quick start. It fetches your sitemap, crawls up to 25 pages, and tells you what is broken — with the page, the element and the WCAG success criterion for each one.

Scanning https://example.com/  77 checks per page, up to 25 pages

  robots.txt found · 1 sitemap · 18 URLs from the sitemap
  scanned https://example.com/ (14 images)
  scanned https://example.com/about (3 images)
  …

12 failures

  missing-alt  1.1.1
  Image has no alt attribute, so a screen reader announces only the file name.
  https://example.com/
  main > section:nth-child(2) > img

  empty-link  2.4.4
  Link contains only an image with no alt text, so it is announced as "link".
  https://example.com/pricing
  nav > a:nth-child(3)

── Summary ──
  pages scanned   18
  images found    212
  failures        12
  warnings        41
  passing         1,331

  by category
    a11y            9 failures   22 warnings
    seo             2 failures   11 warnings
    security        1 failures    5 warnings
    performance     0 failures    3 warnings

  score           71/100  4.8s

Exits non-zero when there are failures, so it drops straight into CI.

What it checks

| Group | Checks | Examples | | --- | --- | --- | | a11y | 27 | missing and meaningless alt text, empty links and buttons, skipped heading levels, unlabelled form controls, aria-labelledby pointing at nothing, positive tabindex, nested interactive elements, missing lang, disabled zoom, video without captions, tables without headers, no skip link | | seo | 27 | missing or duplicate titles and descriptions, canonical problems, multiple or missing h1, thin content, absent or partial Open Graph, invalid structured data, accidental noindex | | security | 12 | plain HTTP, missing or weak HSTS, no CSP or a CSP that allows unsafe-inline scripts, no clickjacking protection, active and passive mixed content, cookie flags, version disclosure | | performance | 11 | uncompressed responses, no cache headers, render-blocking scripts, heavy images, legacy image formats, missing lazy loading, missing font preconnect | | links | opt-in | broken internal and external links, distinguishing a real redirect from a tracking one |

Link checking makes a request per link, so it is off by default. Turn it on with --checks all.

What it prints

After the findings, the same four pictures the site draws first, in the forms a terminal can draw them:

• Coverage — one bar in three parts: checks passed, things to fix, and what needs a person. Roughly a third of WCAG can be tested by a machine at all; the last part is drawn, not left out, and comes with a rough time to check it by hand.
• Do these first — the three changes that clear the most per minute, with where, who (content or developer) and a rough duration. The same ordering the paid pack opens with.
• The search result each page will get — the title with a ┃ where Google stops drawing it (measured in Google's title font, so the cut lands where it lands), and whether the description exists.
• The front door — each security header as a lock: ● closed, ◐ half-turned, ○ open.
• Where the weight is — the document and the images, when the scan measured them. Scripts, styles and fonts need a browser.

All of it is in --json too (coverage, plan, needsPerson, serp, locks, weight), which is what the GitHub Action reads.

What it cannot draw: where keyboard focus goes, colour contrast, reflow, or what a screen reader says. Those need a real browser. The free scan at curbcuthq.com opens the home page in one; the pack does every page.

Options

--checks a11y,seo,…   which groups to run (default: everything but links)
--full                audit the whole site (default stops at 25 pages)
--pages N             page cap
--scope URL_PREFIX    confine the crawl to one section — a shop, a docs tree
--all                 list every finding, not just the first 15
--json FILE           write the findings as JSON
--html FILE           write an HTML report
--csv FILE            write a CSV
--quiet               summary only

In CI

Fail a build when accessibility regresses:

- run: npx curbcut-cli https://staging.example.com --full --json a11y.json

The command exits 1 if there is a single failure, 0 if there are none, and 2 if the site could not be reached — so a network problem never reads as a clean bill of health.

As a library

import { audit, summarize } from 'curbcut-cli'

const { findings, summary } = await audit('https://example.com', {
  maxPages: 50,
  checks: ['a11y', 'seo'],
  onPage: p => console.log(p.url),
})

console.log(summary.score, findings.filter(f => f.severity === 'error').length)

Every finding carries code, severity, message, why, wcag, pageUrl and selector.

How it crawls

It reads robots.txt and obeys it, including Crawl-delay. It starts from your sitemap rather than from links, because sitemaps list pages nothing links to — which is exactly where neglected accessibility problems hide. It identifies itself as CurbcutBot so you can recognise it in your logs and block it if you want to.

It makes no requests anywhere except to the site you name. Nothing is uploaded, and there is no analytics of any kind.

What this does not do

This is the deterministic half of a larger product, and it is worth being exact about the half you are getting.

It reads HTML. It cannot see colour contrast, keyboard focus order, reflow at 320px, whether a modal traps focus, or what a screen reader actually says out loud — all of those require rendering the page in a real browser, and none of them can be inferred from markup. It also does not write the fixes.

No automated tool can tell you a site is accessible, this one included. A clean run means the 77 things it knows how to check are fine. Roughly a third of WCAG can be tested automatically at all; the rest needs a person. Anyone selling you a certificate from a scanner is selling you something that does not exist.

A free scan that renders every page in a real browser, and fixes written for you — alt text, link wording, headings, config, resized images — is at curbcuthq.com.

Licence

MIT.