Actuant now audits your app after every deploy
Actuant
Get early access

Changelog

What shipped, and when.

Entries go up when something reaches production — not when it’s planned. Anything still on the roadmap is labelled as such wherever it’s mentioned.

Actuant now audits your app after every deploy

An audit is a photograph. It was true the moment it ran, and your next deploy can undo any of it without saying so — which is how apps drift from launch-ready back to broken without anyone noticing for weeks. Actuant now watches instead. Connect your Vercel account, say which project deploys your app, and every production deploy is re-audited on its own. It compares the new run against the last one and only writes to you when something got worse: a header that vanished, a sitemap that started 404ing, a score that dropped. Nothing changed means nothing arrives. Deploying somewhere else is fine too — every app gets a plain webhook URL you can call from any CI step, or from your coding agent once it has finished shipping.

  • Connect Vercel, pick the project, and it starts watching — two clicks from any audit
  • Promotions and rollbacks count, not just new deploys: they change what is live too
  • A cheap fingerprint runs first, so a deploy that changed nothing costs about two cents
  • Alerts are earned, not scheduled — a new critical is sent at once, anything softer has to be seen twice before it reaches you
  • Any CI or agent can trigger a check with a POST, no Vercel required

Security findings are now sealed at the data layer

Anyone can point Actuant at any URL, so security findings stay hidden until an account proves it controls the domain. That rule was applied by each page and endpoint individually, and a review found four places that had not applied it — an app's overview screen, the growth suggestions written from it, and two internal helpers that fed the fix engine. The gate no longer depends on being remembered: the queries themselves return redacted data, so a surface added tomorrow inherits it by default rather than by discipline. The same review widened what counts as evidence. A report says what it found in four places, not one, and only two were covered; the cross-page findings and the written summary over them are now covered as well.

  • Redaction moved into the data layer, so no read path can skip it
  • Findings, the model-written summary and the run narration are redacted too, not just the scorecard
  • The gate reads a check's category from the engine rather than from the stored row, so an older report cannot slip through
  • Security fixes now require a verified domain, and a patch run says so instead of quietly doing less

Audit and fix your app from your editor, over MCP

Actuant now runs as an MCP server, so your coding agent can drive the whole thing without leaving the terminal. Point Claude Code, Cursor or Codex at Actuant and it can audit your deployed app in a real browser, open the fixes as pull requests, submit to launch directories and check your AI-search visibility — the entire loop, in the editor you're already in. Signing in is a browser consent flow; there are no keys to paste.

  • MCP endpoint at /api/mcp — Streamable HTTP, OAuth 2.1
  • Audit, whole-site scan, fix-as-pull-request, directories and AI-visibility, all as tools
  • Works with Claude Code, Cursor, Codex and the Claude app
  • The audit hands back a live browser link mid-run, so you can watch it work

Browser sessions now expire on their own clock

Audits and live assist run in a real cloud browser, billed by the minute and released by the process that opened it. That process can be killed from the outside, and when it was, nothing released the session. Every session now declares its own lifetime when it starts, enforced server-side, so it ends whether or not we survive to end it. A daily sweep catches anything that outlives even that. Nobody was ever charged for the difference, but the exposure was real and it's closed.

  • Sessions carry a server-enforced expiry instead of relying on cleanup
  • Live assist handovers no longer die halfway through a sign-in
  • One switch, one dialog primitive, and real success/warning colours across the app
  • The landing page shows a real audit of this site instead of an illustration