fanalis

local-compute repo + localhost audit. bring your own compute.

no api keys. no network egress. nothing uploaded.

install

npm i -g fanalis

use

cd your-project
fanalis audit                       # current repo + autodetect dev server
fanalis audit 3000                  # localhost:3000
fanalis audit ./apps/web            # monorepo path

commands

init                 scaffold fanalis.config.json + .fanalis-ignore
audit [path|port]    full audit (no arg = current repo)
watch [path]         re-audit on file change, surface new + resolved
ci [path]            source-only audit with threshold-based exit codes
routes [path]        list framework-detected routes
report [id|--list]   re-print or list saved audits
diff [a] [b]         compare two audits
share [id]           --format=html|sarif|md|junit|github-pr|json
explain [id]         deep dive on one finding
fix <id>             open the finding's file in $EDITOR
serve                local dashboard for saved reports
bench [path]         per-module timings
baseline [save|show|clear]   snapshot findings; future runs only show deltas
ignore <id|list|clear>       manage .fanalis-ignore
doctor               self-check node/playwright/lighthouse/ollama
detect               this machine's hardware tier
models list|pull|clean       cached ml models

what it audits

8 pillars, all local:

• performance — lighthouse 3x median + 6 hardening checks
• accessibility — axe-core + 6 hardening + keyboard-graph (WCAG 2.4.3)
• seo — lighthouse + 10 hardening (schema.org, alt coverage, hreflang)
• ai-readiness — llms.txt, AI bot allowlist, citation density, q&a structure
• visual — palette discipline, harmony, whitespace, clutter, f-pattern, symmetry
• conversion — FCRS (arrive→orient→consider→commit) + LLM narrative
• responsiveness — 5-viewport probe (320/390/768/1280/1920) + kendall-τ continuity
• security — 99 ast rules + 63 render-pass checks + supply-chain (typosquats, postinstall, lockfile)

12 source-pass modules run without a dev server: deps, secrets, npm-audit, bundle, framework intel (next/vite/astro/sveltekit/remix/nuxt), ast sweep, ts-strictness, dead exports, images, css/tailwind, dep graph, design-system, supply-chain.

llm narrative auto-detects ollama (qwen2.5:1.5b recommended). no llm = no narrative; deterministic checks unchanged.

flags

--tier 1..5          override auto-detected compute tier
--port n             dev server port (probed, errors if dead)
--no-spawn           don't spawn a dev server
--no-llm             skip narrative even if ollama is running
--route /pricing     audit one route only
--concurrency n      parallel route audits (1 = serial, default)
--json               machine-readable
--no-color           strip ansi
--format <fmt>       reporter format (html|sarif|md|junit|github-pr|json)

requirements

• node ≥ 20
• chromium (auto-installed by playwright)
• lighthouse + chrome-launcher (optional, performance pillar degrades to unmeasured without)
• ollama (optional, narrative pillar deterministic without)

run fanalis doctor to check all of the above.

license

MIT