Laravel Auditor is a new dev-dependency package by Punyapal Shah that gives AI coding agents (Claude Code, Codex, Cursor, Copilot, Gemini CLI, Junie, Zed, opencode) a structured methodology for auditing Laravel apps. Rather than running checks itself, it installs skills, guidelines, and 75 rules with stable IDs across security, performance, architecture, database, testing, and Laravel conventions, plus eleven read-only context collectors (routes, models, schema, policies, jobs, tests) exposed via MCP or Artisan. Findings come back as structured JSON with severity, confidence, evidence, and fix recommendations, and can be rendered as Markdown, JSON, CLI text, or SARIF for CI pipelines with configurable fail thresholds. It requires PHP 8.3+ and Laravel 12 or 13, installs via Composer, and is explicitly noted as being in early development.
Table of contents
# What the Rules Cover# Read-Only Project Facts# Findings and Reports# InstallationQuestions this post answers
How can I get an AI coding agent to audit my Laravel app without hallucinated vulnerabilities?
Laravel Auditor is a dev dependency that gives agents like Claude Code, Codex, or Cursor a written audit methodology, 75 rules with stable IDs, and read-only tools that report deterministic facts about routes, models, schema, policies, and jobs instead of letting the model guess. It follows a Discover, Scope, Verify, Report workflow and outputs findings as structured JSON with severity, confidence, and evidence. daily.dev surfaces packages like this for developers wiring AI agents into their Laravel security workflow.
What Laravel and PHP versions does the laravel-auditor package require?
It requires PHP 8.3 or higher and Laravel 12 or 13, and installs as a dev dependency via composer require --dev mrpunyapal/laravel-auditor, followed by running artisan auditor:install with an --agents flag to target a specific AI coding agent such as claude_code. Track package requirements like these on daily.dev before adding new Laravel tooling to a project.
How do I get SARIF security findings from an AI audit into a pull request?
Laravel Auditor's auditor:report command can render findings in SARIF format from a JSON findings file, which can then be uploaded so results show inline on a pull request. The same findings file can also be turned into an exit code with auditor:ci --fail-on=high for CI pipelines, or rendered as Markdown, JSON, or CLI text. daily.dev helps developers keep up with CI security tooling like SARIF-based reporting workflows.