LatchDog check for CI and AI coding agents

A free, zero-dependency Node script (Node 18+). Run it after a deploy and it checks your live app. On findings it prints each one with a fix prompt you can paste into your AI tool, and it exits non-zero so your build or agent knows to stop.

• No account: it runs LatchDog's free public check of the URL you give it (the same check as the home page, with the same limit of a few checks per site per hour).
• With a deploy hook: if you set LATCHDOG_DEPLOY_HOOK, it calls your app's deploy hook instead and waits for that deep scan's result. Deploy hooks come with plans that include deploy scans (see pricing) and a verified app (deploy hooks).

Run it

curl -fsSL https://latchdog.com/latchdog-check.mjs -o latchdog-check.mjs
node latchdog-check.mjs --url https://yourapp.com

Options: --fail-on critical|high|medium|low|never (default high), --json for machine-readable output, --strict to fail when LatchDog can't be reached (by default that's only a warning, so an outage on our side never blocks your deploy).

Exit codes: 0 passed, 1 findings at or above --fail-on, 2 usage error, 3 with --strict, when LatchDog is unreachable, rate-limited, or couldn't finish the scan.

GitHub Actions

- name: LatchDog check
  run: |
    curl -fsSL https://latchdog.com/latchdog-check.mjs -o latchdog-check.mjs
    node latchdog-check.mjs --url https://yourapp.com --fail-on high
  env:
    LATCHDOG_DEPLOY_HOOK: ${{ secrets.LATCHDOG_DEPLOY_HOOK }}  # optional

In GitHub Actions, findings show up as annotations on the run.

For AI coding agents

Add this to your agent's instructions (AGENTS.md, .cursorrules, CLAUDE.md or similar):

After deploying, run: node latchdog-check.mjs --url <live URL> --json
If it exits 1, fix each finding using its fixPrompt, deploy again, and re-run. Never print or commit secret keys.

What it sends and shows

It sends only the URL (or calls your deploy hook). Results show only a masked form of any key LatchDog finds, never the full key. Keep your deploy hook URL in CI secrets: anyone with it can trigger scans of your app and read their results.

JSON API

POST /api/check with {"url": "https://yourapp.com"} runs the free public check and returns the result as JSON. GET /hooks/deploy/<token>/status returns the latest scan for a deploy hook's app.

Not yet on npm or the GitHub Marketplace. For now, download it from this site as shown above.