Skip to content

webmri: one-command anatomy of a website's public surface - #1

Merged
DhanushNehru merged 6 commits into
mainfrom
feat/initial-implementation
Nov 1, 2026
Merged

DhanushNehru merged 6 commits into
mainfrom
feat/initial-implementation

Conversation

@DhanushNehru

Copy link
Copy Markdown
Contributor

What this is

webmri is a single-binary Go CLI: point it at a URL and it returns an anatomy of what the site publicly serves over HTTP — stack fingerprints, design tokens, routes, forms and programmatic surface — with evidence (URL + exact signal) behind every claim, labelled observed or inferred.

webmri scan https://tailwindcss.com --out report.md --json report.json

Included

  • Concurrent, polite same-host crawler: sitemap discovery via robots.txt, page cap, bounded fetches, non-page links (media, archives, assets) skipped
  • Heuristic stack fingerprinting (frameworks, CMS, hosting, CDN, analytics, payments, monitoring) — every finding carries evidence
  • Design token extraction from inline styles and real stylesheets (:root custom properties, top colors, font families)
  • Route, form and API/docs/GraphQL surface capture
  • Markdown + JSON reports, measured performance snapshot per page
  • skills/webmri/SKILL.md so any AI agent can drive the tool
  • CI: vet, test and build on Go 1.23/1.24/1.25
  • CONTRIBUTING, issue/PR templates, MIT license

Verification

  • 26 tests green (go test ./...), including an end-to-end scan against a fixture server
  • Real runs measured 2026-11-01: example.com 1 page/73ms; go.dev 12 pages/777ms; tailwindcss.com 12 pages/1.2s (correctly detected Next.js, Tailwind, Vercel, Cloudflare with header/URL evidence); synthetic 200-page local site in 26ms
  • Benchmark numbers in the README are this tool's own measurements with caveats; no comparisons

Honest limits (in README too)

Static analysis of public pages only: no JavaScript execution, no logins, no private APIs. Fingerprints are heuristic hints, never guarantees. Routes are found pages, not an exhaustive map.

After merge

Suggested: 2-3 good-first-issues (proposed separately), repo topics already set.

Concurrent same-host crawler with sitemap discovery, heuristic stack
fingerprinting with per-claim evidence, design token extraction from
real stylesheets, route/form/API-surface capture, Markdown and JSON
reports.
Request Accept-Encoding: gzip explicitly (which also disables the
transport transparent decode), decode gzip ourselves, and surface
unsupported encodings (br, zstd, ...) and corrupt gzip as per-page
errors instead of silently storing compressed bytes. Tests cover
gzip decode, unsupported encoding, and corrupt gzip.
go install @latest does not work yet (no tags, main has no go.mod
pre-merge), so do not advertise it. Clone -b feat/initial-implementation
until this PR merges; clone the default branch afterwards.
@DhanushNehru
DhanushNehru merged commit bb14f29 into main Nov 1, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant