The Audits · run from your editor

Say “run a vibe audit” and get a grade your repo has earned.

Connect the hashtag.org MCP and your own coding agent audits the repo where it sits: 14 ordered phases, 68 concrete checks, real findings only. The network scores it, grades it A+ to F, and hosts a shareable report with a README badge. Then it offers the fixes, top severity first, one at a time. Your code never leaves your machine; only the findings do.

Three kinds now, same one connection: the vibe audit (code, security, scaling), the SEO audit (SEO + AEO), and the new performance audit — a 12-phase playbook from edge-cache and TTFB through hydration, LCP, CLS and main-thread budgets. Every kind produces the same graded, hosted, shareable report and README badge.

1 · Install the MCP

Add one server to your .mcp.json (Claude Code, Cursor, or any MCP client). No key needed for the audits.

{ "mcpServers": { "hashtag-network": {
  "type": "http",
  "url": "https://hashtag.org/api/mcp"
} } }

2 · Say the words

In your editor chat, ask for either audit. Your agent pulls the playbook and works the phases in order, telling you where it is as it goes.

“run a vibe audit”

Code, security, caching, scaling, AI safety. 14 phases, 68 checks.

“run an seo audit”

Technical SEO plus AEO: will AI engines read, cite, and act on your site? 10 phases, 29 checks.

“run a performance audit”

Edge cache, TTFB, script weight, hydration, LCP, images, CLS, main-thread and budgets. 12 phases.

3 · Get graded, get the badge, get the fixes

When the phases are done, the findings are scored server-side into a hosted report you can share or put in your README. Every check ships with a fix recipe, and your agent offers them one at a time.

B

acme/storefront · vibe audit

Score 84/100 · 1 critical · 2 high · 4 medium

[![VIBE AUDIT](https://hashtag.org/api/vibe-audit/badge/…svg)](report)

The Vibe Audit

Built from the mistakes AI-assisted coding actually ships: leaked keys, missing auth, injected queries, in-memory state behind a load balancer, caches that never invalidate, agents with too much power. Includes the caching and scaling phases most repos have never been through.

  1. 1.Inventory
  2. 2.Repo hygiene
  3. 3.Secrets & config
  4. 4.Auth & access
  5. 5.Injection & validation
  6. 6.API security
  7. 7.Data layer
  8. 8.Concurrency & state
  9. 9.Errors & resilience
  10. 10.Caching
  11. 11.Scaling
  12. 12.Frontend correctness
  13. 13.AI-app safety
  14. 14.Tests, observability & deploy

The SEO Audit

Classic technical SEO plus the checks that decide your AI future: is the content in the HTML, can answer engines cite you, do you publish llms.txt and an agent surface a machine can act on. Search is splitting in two; this audit scores both halves.

  1. 1.Inventory
  2. 2.Crawlability & indexation
  3. 3.Rendering & agent-readability
  4. 4.Meta & titles
  5. 5.Structured data (JSON-LD)
  6. 6.AEO / agentic-web surfaces
  7. 7.Core Web Vitals
  8. 8.Internal linking
  9. 9.Local & entity presence
  10. 10.Verification

The Performance Audit

New this week. The speed problems vibe-coded apps ship without noticing: a Set-Cookie on the edge that kills your cache, a slow TTFB, megabytes of script, hydration that blocks the main thread, layout that jumps. It walks the render path front to back and hands you a performance budget to hold the line.

  1. 1.Inventory
  2. 2.Edge cache & Set-Cookie
  3. 3.TTFB
  4. 4.Script weight
  5. 5.Hydration
  6. 6.LCP
  7. 7.Images
  8. 8.CLS
  9. 9.Main-thread
  10. 10.Budgets
  11. 11.Hot paths
  12. 12.Guardrails

We ran it on ourselves first

The hashtag.org platform took its own vibe audit and published the result: a C at 79/100, findings and all. Four high, five medium, zero hidden. An audit you can trust is one its makers are willing to fail.

Real findings only, by design

The playbook forbids padding: a clean phase is reported clean, and a finding must name the file and the reason. Reports carry check ids and one-line notes, never your source code or secrets (anything key-shaped is scrubbed server-side too). That is what makes the grade worth putting in a README.

Want the findings fixed for you? Each report links to the hashtag.org build network, where bigger work (architecture, migrations, the whole list) can be taken on end to end.