| name | laravel-auditor-development |
| description | Integrate and apply the Laravel Auditor package in Laravel applications: installation, setup, the MCP tools, and the audit workflow. Use when setting up Laravel Auditor or wiring it into a Laravel app.
|
| metadata | {"agent":"any"} |
Laravel Auditor Development
Use this skill when a Laravel application needs to install, configure, or apply the Laravel Auditor package. Auditor does not scan the app. After setup, the user asks their AI agent to use the laravel-audit skill.
Primary goals
- Install Laravel Auditor as a development dependency.
- Run the appropriate setup command (Boost-based or standalone).
- Verify setup with the diagnostics command.
- Use the audit workflow skill to perform an audit.
Workflow
1. Install the package
composer require --dev mrpunyapal/laravel-auditor
2. Set up resources
When Laravel Boost is installed, expose Auditor resources through Boost:
php artisan boost:install
(or php artisan boost:update after package updates).
When Boost is not installed, use the standalone installer:
php artisan auditor:install --agents=claude_code
php artisan auditor:install --agents=claude_code,opencode
The installer is idempotent and safe. It detects the Laravel application context, detects whether Boost is installed, prepares Auditor's agent-facing resources, and reports what it created or updated.
Non-interactive runs resolve agents from --agents, then laravel-auditor.agents, then project markers. When none of those resolve, no agents are wired. A .github directory alone is not treated as Copilot. Pass --force to refresh Auditor-owned resources, including an existing laravel-auditor MCP entry.
3. Verify setup
php artisan auditor:status
4. Inspect the available rules and project facts
php artisan auditor:rules
php artisan auditor:context --list
php artisan auditor:context project_info
5. Run an audit
Ask the agent to use the laravel-audit skill to perform a structured, evidence-based audit of the application.
6. Render a report
If the agent produced a JSON findings file:
php artisan auditor:report --example
php artisan auditor:report --findings=storage/auditor-findings.json --format=markdown
Supported formats: markdown, json, text, sarif. Finding schema: publish tag laravel-auditor-schema.
7. Optional MCP
php artisan auditor:mcp -q
Register that stdio command with the agent so it can call project_info, routes, models, migrations, database_schema, dependencies, configuration, policies_authorization, jobs_events_schedules, tests, and subsystems. Use -q so Artisan boot output cannot break MCP stdio framing.
With Laravel Boost installed, the same context tools are registered automatically inside Boost's MCP server (via boost.mcp.tools.include); no extra setup is needed.
References
- Install:
composer require --dev mrpunyapal/laravel-auditor
- Boost path:
php artisan boost:install / php artisan boost:update
- Standalone path:
php artisan auditor:install (--dry-run, --force, --agents=)
- Diagnostics:
php artisan auditor:status
- Rules:
php artisan auditor:rules (--domain=, --json, --applicable)
- Context:
php artisan auditor:context (--list, {collector}, --output=)
- Reports:
php artisan auditor:report (--findings=, --example, --format=markdown|json|text|sarif, --output=)
- CI:
php artisan auditor:ci --findings=storage/auditor-findings.json --fail-on=high
- Facade:
LaravelAuditor::collect('routes'), LaravelAuditor::rules(), LaravelAuditor::context(), LaravelAuditor::project()
- Config:
resources_target, agents, context.composer_audit (on), context.test_listing (off)
- Config publish tag:
laravel-auditor-config
- Resource publish tag:
laravel-auditor-resources
- Schema publish tag:
laravel-auditor-schema
- Example publish tag:
laravel-auditor-examples
- Audit workflow skill:
laravel-audit (laravel-audit-dsa for subsystem / P0–P3 ranking)
Examples
Ask the agent:
Use the laravel-audit skill. Discover this Laravel app, scope the relevant domains, and report only findings with file, route, or schema evidence.
A finding should include rule_id, severity, confidence, summary, why_it_matters, evidence, and recommendation.
Full audit prompt:
You are auditing the Laravel application in this project using the Laravel Auditor methodology.
- Use the laravel-audit skill. Follow its Discover → Scope → Verify → Report workflow.
- Start by calling the context MCP tools to gather deterministic facts BEFORE reading code:
project_info, routes, models, migrations, database_schema, dependencies, configuration, policies_authorization, jobs_events_schedules, tests, subsystems.
- Scope the relevant domains (security, database, architecture, testing, ...). Pick the domains with the most risk signal and go deep.
- For every potential finding, verify against actual files, routes, or schema. Never report a guess.
- Report findings ranked P0–P3, each with: file/route/schema evidence, the rule violated, why it matters, and a concrete fix.
- Be read-only. Do not modify any application code.
Discover-only quick pass:
Start with a Discover phase only: run all 11 context tools, summarize what this app is (framework versions, database, route surface, model list, test coverage), and flag any immediate red flags in 3-5 bullets. Do not write findings yet.
Anti-patterns
- Do not require Boost just to use Auditor.
- Do not run
php artisan auditor:install when Boost is installed unless a standalone path is explicitly wanted.
- Do not modify application code during setup or during an audit.
- Do not treat Auditor as an autonomous scanner that invents findings without evidence.
