Audit the code behind the site, from your editor
Run a set of audits on the repository open in VS Code — security, structure, code quality, interface and agent surface — and read every result next to what that audit cannot see.
The causes behind what the site audit finds — read straight from the code.
- Free to install
- VS Code Marketplace & Open VSX
- Sign in from the browser — no key to copy
Hover to play
Sound familiar?
The problem
A site audit sees what the browser sees. The causes — a leaked key, a tangle of imports, error handling that swallows failures — live in the code.
A site audit only sees the symptoms
It can tell a page is slow or broken, not which code made it so.
Security issues hide in the repository
A committed key or a vulnerable dependency is invisible from the browser.
“0 issues” from a tool that didn't look
A clean result with no stated limits is how a review gets closed on nothing.
What changes
Before and after Dr Urls Sync
How it works
4 steps, start to finish
- 1
Open the repo
With Dr Urls Sync installed, open the project in VS Code, Cursor or Windsurf.
- 2
Run the audit
“Dr Urls: Audit this codebase” runs them all, or “choose an audit” runs one — from secret scanning and dependency checks to complexity, duplication and accessibility.
- 3
Read it honestly
Each result is printed with its blind spots, so “0 findings” says what clean means for that audit instead of implying more.
- 4
Export it
“Export the last audit as markdown” gives you a file to hand to a coding agent or attach to a review.
What you get
- Security: static analysis, secret scanning, dependency vulnerabilities
- Structure and quality: complexity, duplication, dead code, coupling, typing, error handling
- Interface and agent surface: accessibility, design-system consistency, MCP and machine-surface practice
- A markdown report a coding agent can work from
Who it's for
Developers
Check the code before the site audit finds the symptom.
Tech leads
One honest read of the codebase's health, with its limits.
Teams using coding agents
Hand the agent a report it can act on.
No surprises
Good to know
What it does not do, said up front.
- Every audit states what it cannot see — secrets in files outside git, values built at runtime, and so on. A clean result is clean within those limits.
- The dependency check runs pnpm audit, then npm audit, so it needs a network connection; when neither answers it says nothing was checked rather than reporting clean.
- It reads the code; it does not change it.
FAQ
Questions
Does my code leave my machine?
The audits run inside your editor on the open workspace, and the report stays there. The dependency check runs your package manager's own audit (pnpm audit or npm audit), which asks the registry about your dependencies — package names and versions, not your source.
Is this the same as the site audit?
No. The site audit crawls what your visitors and Google see; this one reads the repository. They answer different questions, and together they cover both ends.
Also in the extensions
More you can do
The causes behind what the site audit finds — read straight from the code.
Free to install. Your work goes to a free Dr Urls account, filed against the site it is about.
- Free to install
- VS Code Marketplace & Open VSX
- Sign in from the browser — no key to copy