New·Wyro inside Claude Code, Cursor and Codex →
Live · no account

Generating a backend is easy.
Checking one isn't.

Wyro reads the backend your coding agent wrote and shows which routes reach your data without checking who is asking. Paste a public GitHub repo. No account, nothing to install.

Express APIFastAPI appAdd it to your agent ↓Drop a v0 / Lovable / Bolt ZIP ↓

500+ public repositories checked · Rule-based, not a model · Same commit, same result

00:01AGENT_LOOP

Put the check inside your agent's loop

One line gives Claude Code, Cursor or Codex the check as a tool, and four slash commands: check, fix, map and ship. The agent runs it after it changes a route, a handler or the schema, reads what it broke, and fixes it before it hands the work back. Same code, same answer, so “fix it and check again” converges instead of arguing with another model.

No tool can write the baseline, so an agent cannot silence its own findings. Accepting one as known debt stays your call.

Set it up for your agent
$ claude mcp add -s user wyro -- npx -y wyro-check --mcp
 
> /mcp__wyro__fix
🛡️ Wyro · api · 41 routes · 12 tables
❌ 1 new error · POST /refunds → payments
…adds requireUser, checks again
✅ No new findings · 🟢 CI: would PASS
$
00:02CI_GATE

Then make it a gate

The GitHub Action fails a pull request that introduces a new problem: an unauthenticated route reaching a table, sensitive data flowing to a third party. Record what is already there as a baseline once, and only new findings ever fail the build, so you can switch it on today without fixing your history first.

Add the gate
# .github/workflows/architecture.yml
on: pull_request
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: DominicPaaul7/wyro-check-action@v1

Audit the backend your AI builder generated.

Drop the export from v0, Lovable or Bolt. Wyro maps every route to the data it reaches, checks which of them verify who is asking, and shows you what the code actually does — not what the prompt said it would.

Drop your ZIP here

or click to choose

ExpressNext.jsNestJSFastAPIPrismaDrizzle

Browser-only scan. The archive is unzipped and read by this page; the file never leaves your device and no account is created. Saving the result as a project is a separate, deliberate step — that one does upload the files, and stores them with your project. What we store

00:03THE_EXTENSION

The check that runs where you review

A browser extension. It reads the backend of whatever repository you are looking at and tells you what it actually does.

prisma/prisma-examples
Checking
Reading the repository…
01 / 04

Install it once

A button appears on every GitHub repository you open. No account, no configuration, nothing to connect.

  1. Install it once

    A button appears on every GitHub repository you open. No account, no configuration, nothing to connect.

  2. It reads the repository

    Drizzle, Prisma, Mongoose, TypeORM and SQLAlchemy schemas. Express routes, class routers, NestJS decorators and FastAPI. TypeScript, JavaScript and Python. Fetched from GitHub and parsed in your browser — nothing is uploaded.

  3. It names what it found

    Not a score and not a summary. The endpoint, the table it reaches, and the rule it breaks — so you can check the claim yourself in the file.

  4. And what it could not read

    Files it did not read and places it could not parse are listed, not skipped. A rule with nothing to look at is reported as not having run, and a project it cannot parse as unreadable rather than clean. That distinction is the whole tool.

Chrome · free · runs on your machine

Add it to your browser

Then open any GitHub repository and press Check with Wyro.

Add to Chrome

Listed on the Chrome Web Store, so it also installs in Edge, Brave and Arc. Repositories are read through GitHub and analysed in your browser — nothing is uploaded. Want to read the code before you install it? Download the exact build (1.8 MB).

The same check, three ways in.
No account at any of them.

github.com/prisma/prisma-examples
prisma-examplesCheck with Wyro
39 findings16 routes · 23 tables
No route in this backend authenticates: 11 routes reach Post and User with nothing in front of them.
POST /post has no validator or rate limiter attached.
PUT /publish/:id has no validator or rate limiter attached.

and 36 more · first 120 of 720 files

The widget. A button on every GitHub repository you open. It reads the backend in your browser and names the routes that reach your data without checking who is asking.

Add it to Chrome
wyro.in/scan/prisma/prisma-examples
32routes
24tables
25errors
POST/postno auth
PUT/publish/:idno auth
DEL/post/:idno auth

11 / 11 rules ran · all 720 files read

A check as a link. Put any public repository after /scan and the finding becomes a page — one you can paste into a pull request for someone who has installed nothing.

Open a live report
my-app.zip
v0LovableBolt

Unzipped in your browser

A ZIP from anywhere. Drag the export from v0, Lovable or Bolt onto this page. It is unzipped and read in your browser — nothing is uploaded unless you ask for it to be.

Drop one in

Why prisma-examples shows 16 routes in the widget and 32 on its link: the widget reads the first 120 files of a large repository so it answers in seconds, and prints that it stopped. The link, the CLI and the agent tool read every file.

00:04FAQ

The parts people ask about

Is it an AI?

No. Wyro is rule-based: it parses your code into a map of routes, guards and tables, then checks that map. The same commit always gets the same result, which is what lets an agent fix a finding and check again without the answer moving.

What does it read?

TypeScript, JavaScript and Python. Routes from Express, Fastify, Hono, NestJS, Next.js route handlers and Server Actions, FastAPI and Supabase; schemas from Prisma, Drizzle, TypeORM, Mongoose, SQLAlchemy and SQL with row-level security. If it cannot read your backend it says so. It never reports a clean result for code it did not understand.

What does it catch?

Routes that reach your data without authenticating, public writes, sensitive data readable by anyone, data flowing to a third party, row-level security that is off or open, and routes that check who you are but not what you may touch. Each finding is ranked by risk, points at the file and line, and comes with a fix.

What about routes that are public on purpose?

An open read of data that holds nothing private, in a backend that authenticates elsewhere, is reported as a warning, not an error. Mark a route public in the code, or record existing findings in a baseline, and CI fails only on new ones.

Does my code leave my machine?

Not with the CLI, the agent tool or the GitHub Action: they run where your code is. A /scan page reads a public repository through GitHub, and the browser extension reads it in your browser.

How often is a finding wrong?

We measure it. Wyro is benchmarked on 45 public backends written with coding agents, and every false alarm we confirm becomes a test so the same mistake cannot come back. When one maintainer went through 65 findings on their repository and showed they were wrong, the three parser gaps behind them were fixed the next day. A rule with nothing to look at is reported as not run, never as passed. If you hit a wrong finding, tell us on Discord.

Is it free?

Checking public repositories, the CLI, the agent tool, the extension and the GitHub Action are free. Paid plans add more projects and collaborators in the app, and a central CI policy your repositories cannot weaken.

Who builds it?

Dominic Paul, in Bengaluru. Wyro is built by one person for now: the checker, the CLI, the extension and this page are one codebase, and every question reaches the person who wrote it. Ask on Discord or at support@wyro.in.

Check the backend
your agent just wrote.

Paste a repository, add one line to your agent, or put the gate on your pull requests. None of them needs an account.

Check a repo →Add it to your agent