Skip to content

AI Compass / Knowledge cards

Have your own website checked from the outside

Checked Automation Website Prompting

An agent that only reads the code doesn’t see what happens in the browser. REA (“Reverse Engineer Anything”) is an open-source tool with which an agent such as Claude Code opens a page in the browser and records what it loads and sends. It comes as an MCP server, an interface that gives the agent additional tools, together with a skill. The skill instructs the agent to tie every statement to evidence and to label it “seen”, “suspected” or “unknown”.

What it is for

You find errors, slow spots, a broken mobile view and exposed keys before others do. The labels show you which points in the report you can trust.

Steps

  1. Read the skill and the installation instructions before anything runs. REA puts a skill in the global Claude folder.
  2. Install it, according to the README with npx rea-agents setup (Node.js 22.19 or later). In Claude Code, check with /mcp whether REA is connected.
  3. Write the audit brief: link to the page, what it is supposed to do, “check from the outside only, don’t read the code”, report with the labels seen / suspected / unknown.
  4. Have speed and layout checked, including at phone size.
  5. Have it check for exposed keys and passwords, with the report sorted by danger.
  6. For the code behind it, optionally use Cloudflare’s security-audit skill. It works with several review agents and an independent cross-check.
  7. Work through the findings and check again. What is only “suspected” counts as a bug only once there is evidence.

Limits

Sources

Status

Checked 16 Oct 2026 · Maturity new (tools available, not tested by me)

Want to try this with your team? That’s what the AI Lab is for. See the AI Lab