Laravel Auditor, a development dependency from Punyapal Shah, targets a common complaint about AI-driven audits: agents tend to report a jumble of genuine bugs, subjective style choices relabeled as severe issues, and flaws that were never there. The package itself runs no checks. It installs skills and guidelines for whichever agent a team already relies on, among them Claude Code, Codex, Cursor, Copilot, Gemini CLI, Junie, Zed and opencode, then steps back while that agent works through a Discover, Scope, Verify, Report sequence.

composer require --dev mrpunyapal/laravel-auditor
php artisan auditor:install --agents=claude_code
php artisan auditor:rules --applicable
php artisan auditor:report --findings=storage/auditor-findings.json --format=sarif
php artisan auditor:ci --findings=storage/auditor-findings.json --fail-on=high

The audit catalogue ships with 75 rules, each with a stable ID such as AUD-SEC-001 for a missing authorization boundary or AUD-PER-011 for a query inside a loop. Conditional rule packs for Livewire, Filament, Inertia, Sanctum and Pest activate only when those packages are present. The 0.1.x catalogue spans six domains: security, performance, architecture, database, testing and Laravel conventions. The artisan command auditor:rules lists them, with an --applicable flag to filter for what actually applies to your project.

Before any source is read, the agent pulls deterministic facts through eleven read-only context collectors covering routes, models, schema, policies, jobs and tests. These are exposed as MCP tools (project_info, routes, models, migrations, database_schema, dependencies, configuration, policies_authorization, jobs_events_schedules, tests, subsystems) or reachable directly via auditor:context. With Laravel Boost installed, the collectors register inside Boost's own MCP server automatically. Filters allow an agent to pull a slice, such as routes for a specific URI, rather than the full inventory.

Findings are written as structured JSON with a rule ID, severity from critical to info, a separate confidence value, file-and-line evidence and a fix recommendation. The auditor:report command renders them as Markdown, JSON, CLI text or SARIF, so results can appear inline on pull requests. auditor:ci --fail-on=high turns findings into an exit code for CI. A separate laravel-audit-dsa skill inventories subsystems, sends bounded workers over each, then dedupes and ranks findings P0 to P3.

The package requires PHP 8.3+ and Laravel 12 or 13. Installation is composer require --dev mrpunyapal/laravel-auditor followed by auditor:install --agents=claude_code. Once set up, you instruct your agent to run the audit using the laravel-audit skill. The source is on GitHub and the author notes the package is in early development.