Wyro

Wyro keeps a backend running: it watches the limits of the services your backend runs on, and checks every change before it merges. These docs cover the check, the part that is live today. It reads a repository into a map of routes, guards and tables, and tells you which routes reach your data without checking who is asking.

Four ways to run it

• A link. Put any public repository after wyro.in/scan and the report is a page you can share. No account.
• Inside your agent. One line gives Claude Code, Cursor or Codex the check as a tool, so the agent checks its own changes. Set it up.
• On every pull request. The GitHub Action fails a pull request that introduces a new finding, with a baseline for what already exists. Add the gate.
• On your machine. The CLI checks a directory and exits non-zero on problems. In a terminal it ends with a one-keypress menu: add Wyro to your agent, gate your pull requests, or record a baseline.

npx wyro-check

What it reads

TypeScript, JavaScript and Python. Routes from Express, Fastify, Hono, NestJS, Next.js route handlers and Server Actions, FastAPI, Supabase Edge Functions and browser calls to Supabase's Data API. Schemas from Prisma, Drizzle, TypeORM, Mongoose, SQLAlchemy and SQL, including row-level security policies.

When it cannot read a backend, it says so and exits with code 2. It never reports a clean result for code it did not understand.

What it catches

• Routes that reach a table without authenticating, and public writes
• Sensitive data (passwords, tokens, payments, personal data) readable by anyone
• Sensitive data flowing to a third-party call
• Row-level security that is off, or a policy that lets anyone write
• Routes that check who you are but not what you may touch

Each finding is ranked by risk, points at its file and line, and comes with a fix. Routes that are public on purpose can be marked so in the code, or recorded once in a baseline. See security and public reports for how findings on public pages are handled.