v0.2.0 Open source · Apache-2.0

Check your AI‑built app before launch.

Real checks with proof, guided human checks, and a fix list your AI can act on.

Try the demo Install
curl -fsSL https://anvil.sbsngl.org/install.sh | sh

macOS / Linux · Windows, Claude Code, Codex

The Anvil dashboard on sample data. A left sidebar lists automatic checks (13 of 18 done) and your own checks. The overview shows 10 passed, 0 failed, 9 to do and 61% done, with three steps: let the automatic checks finish, do your checks in the Test view, then send the report. The right panel shows check 2 of 5, “A guest sees only the shared notebook”, with steps, what good looks like, and Works, Broken and Not sure buttons.

The real Anvil dashboard, running on its sample data.

The evidence

AI writes the app in an afternoon. It writes the holes just as fast.

These aren't edge cases. They're what researchers keep finding when they look.

  1. Finding

    45%

    of coding tasks: the AI-generated code introduced a security flaw.

    Veracode, 2025 (opens source)
  2. Finding

    ~5,000

    of 380,000 vibe-coded apps scanned were leaking data.

    RedAccess study, via Vibe Graveyard (opens source)
  3. Finding

    48 days

    Lovable left thousands of projects exposed for 48 days.

    The Next Web (opens source)

None of this took a genius attacker. It took nobody checking.

How it works

Three steps. Repeat until the list is empty.

  1. 1

    Machine checks, with proof

    Anvil opens every page in a real browser, on a phone and a laptop. Every finding comes with a screenshot, a file and line, or the request that proved it.

    • Every page, phone + laptop
    • Console errors
    • Sideways scroll
    • Accessibility
    • Leaked keys in code and built JS
    • Open Supabase / Firebase rules
    • Users seeing each other's data
    Anvil's Automatic checks view on sample data, mid-run. A live log shows a page passing on phone, then failing on laptop with a console error (TypeError: Cannot read properties of undefined), with the screenshot it saved below.

    Real run on Anvil's sample app: the laptop check fails with the console error that proves it.

  2. 2

    Human checks, guided

    Some things only a person can judge: does sign-up make sense, is the price right, does checkout feel safe. Anvil gives you short steps and three buttons. Attach a screenshot when something's off.

    Try the buttons. In Anvil, your answers go straight into the report.

    Check 3 of 8 Phone

    Can a new user sign up and keep their first note?

    1. Open /signup on your phone.
    2. Make an account with a new email.
    3. Add a note, then refresh the page.

    What good looks like

    The note is still there after the refresh.

    signup-refresh.png attachedNote vanished after refresh.

  3. 3

    A fix brief your AI can use

    You get the report with its evidence, a plain fix list, and prompts ready to paste into Lovable, Cursor or Claude. Your AI fixes. Anvil scans again. Repeat until nothing fails.

    Prompt for

    Fix these 4 issues in acme-notes. Change nothing else, then run anvil_scan again.

    1. Remove the Stripe secret key from src/lib/pay.ts. Read it from a server-only env var. Rotate the key.
    2. Turn on row level security for "notes": users read rows where user_id = auth.uid().
    3. /pricing overflows at 390px: let the plan table scroll inside its own box.
    4. /settings crashes when plan is null. Guard it.
    Fix brief
    Your AI fixes
    Rescan: 0 failing

Works with your setup

Anvil gives your AI coding agent eyes and a QA team.

  • Claude Code

    Add Anvil as an MCP server. Claude runs the scan, reads the report and proposes fixes you approve.

    MCP

  • Codex

    Same tools, same report. One command to connect.

    MCP

  • Any API key

    Bring your own key for the write-ups. It's kept in your system keychain.

    BYOK

  • Free credits

    A few AI write-ups a month on us, with a hard cap. No card.

    capped

  • No AI at all

    Every check still runs. The report and fix list use plain templates.

    templates

Local mode and GitHub mode

Your code stays yours.

Local mode

Default

Everything runs on your computer: the browser, the scan, the report. Nothing is uploaded.

  • Your code never leaves your machine
  • Uses the Chrome or Edge you already have
  • Reports saved in .anvil/runs/

GitHub mode

Coming soon

Connect a read-only GitHub App. We fetch a copy of the repo, scan it for leaked keys and open database rules, then delete the copy.

  • Read-only access to the repos you pick
  • Our servers never run your code
  • Our servers never open your live site

Secrets are removed before anything reaches an AI

If removing them fails for any reason, the AI call doesn't happen. Your report still works.

Honest by design

No Secure badge. On purpose.

A scan can prove a problem exists. It can't prove there are none. So every Anvil report says what was checked, when, and what wasn't.

Anvil checks

  • Every page it can reach, on phone and laptop
  • Keys in your code and in the built JavaScript
  • Database rules found in your code
  • Whether one test user can open another's data
  • What you told it in the human checks

Anvil can't check

  • Rules you changed in the Supabase or Firebase dashboard
  • Business logic, like who is allowed a refund
  • Live payments and real emails
  • Pages behind a sign-in it wasn't given
  • How the app holds up under heavy traffic

Add-on marketplace

Check packs for the tools you build with.

Packs are plain JSON: checks and human steps. No code runs. Open source and reviewed by pull request.

  • supabase-rlsrules-probe

    Supabase RLS

    Every table has row level security, and signed-out visitors can't read rows.

  • stripe-checkoutsecret-pattern

    Stripe checkout

    No secret key in the browser, and the success page needs a real payment.

  • auth-pagespage · human

    Auth pages

    Sign-up, sign-in and password reset work on a phone and refuse obvious mistakes.

Build your own pack

Write the checks you wish existed for your stack. Send a pull request; once it passes review, everyone can add it with anvil addon add <id>.

Browse add-ons Build your own pack 
{
  "id": "supabase-rls",
  "anvil": "^0.2",
  "checks": [{
    "kind": "rules-probe",
    "severity": "high",
    "title": "Tables readable signed out"
  }],
  "humanChecks": [{
    "prompt": "Can a signed-out visitor see notes?",
    "screenshot": true
  }]
}

Pricing

Free to use. Paid plans later.

Nothing to buy today. Join the waitlist and we'll write when the paid plans open.

Free

Available now

₹0no card needed

  • Unlimited local scans
  • Every check and add-on pack
  • Your own AI key, or no AI
  • A few free AI write-ups a month
Install free

Pro

Coming soon

₹499/ month

  • Everything in Free
  • GitHub mode for private repos
  • More AI write-ups
  • Scan history
Join the waitlist

Agency

Coming soon

₹2,999/ month

  • Everything in Pro
  • Reports branded for your clients
  • Many client projects
Join the waitlist

Prices in Indian rupees, before tax. Plans may change before launch.

Install

One line, then scan.

The installers pin version 0.2.0, check its SHA-256, then install. You need Node 20 or newer and Chrome or Edge.

In Terminal:

curl -fsSL https://anvil.sbsngl.org/install.sh | sh

Quick try, nothing installed

npx -y https://anvil.sbsngl.org/dl/anvil-0.2.0.tgz scan http://localhost:3000

Prefer to read first? The install guide explains each step, and the demo shows a real recorded run.