A reusable, prompt-based audit framework for Claude Code (and other AI coding agents). Drop it into any project and get structured, prioritized audit reports that help you take the project to production-ready.
→ See a sample report to preview what the kit produces.
Built by Mehedi at Coder71 Limited.
The kit audits any web project across four areas:
| Audit | Covers |
|---|---|
| Production Readiness | Feature completeness, architecture, QA, performance, scalability, business readiness |
| SEO / AEO / GEO | Technical SEO, answer-engine optimization, AI-search (generative engine) discoverability, content strategy, structured data |
| Security / DevOps | AuthN/AuthZ, API security, secrets, dependencies, CI/CD, monitoring, backups, infrastructure |
| UI/UX / Animation | Design system, page-level UX, user flows, responsiveness, accessibility (WCAG 2.2 AA), animation |
Every finding is prioritized (P0–P3), backed by evidence from your actual codebase, and written to a report in .ai/reports/ — the audits never modify your code. You review the findings, approve what you want, and only then ask the agent to implement.
Choose one of the two modes per project (using both causes duplicate commands):
Install once, use in every project. In the Claude Code terminal:
/plugin marketplace add webmehedi/ai-project-audit-kit
/plugin install ai-project-audit-kit@coder71
Using the desktop app or IDE extension? The interactive /plugin dialog is terminal-only, so run the CLI equivalent from any terminal instead:
claude plugin marketplace add webmehedi/ai-project-audit-kit
claude plugin install ai-project-audit-kit@coder71Don't have the claude CLI? (e.g. you only use the desktop app) — click to expand
If running claude --version in a terminal says "command not found", install the CLI first. It shares the same account and settings as the desktop app, so plugins installed through it appear everywhere.
macOS / Linux:
curl -fsSL https://claude.ai/install.sh | bashWindows (PowerShell):
irm https://claude.ai/install.ps1 | iexOr via npm (requires Node.js 18+):
npm install -g @anthropic-ai/claude-codeThen verify with claude --version, run the two claude plugin ... commands above, and restart the desktop app.
Either way the plugin installs at user scope (~/.claude), shared across the CLI, desktop app, and IDE extensions. No files to copy; reports and project context are still written to .ai/ inside whichever project you run the audits in.
Important
Restart Claude Code after installing. Plugins only load when a session starts, so the /audit-* commands will not appear in sessions that were already open. In the terminal, exit and run claude again. In the desktop app, quit it completely (Cmd+Q on Mac — closing the window is not enough), reopen, and start a new conversation. Then type /audit to see the commands.
Best when you want the kit versioned inside the repo or customized per project:
git clone --depth 1 https://github.com/webmehedi/ai-project-audit-kit.git your-project/.ai && rm -rf your-project/.ai/.git(Or click Use this template on GitHub to create your own copy of the kit first.)
The workflow is the same everywhere: discover → audit → review → implement → verify. Pick your track:
Open Claude Code in the project you want to audit. The slash commands work in both install modes.
1. Run project discovery:
/audit-discover
This inspects your repository, fills in .ai/PROJECT-CONTEXT.md, and writes a discovery report. Review the context file and correct anything the agent couldn't verify.
2. Run the audits:
/audit-master
Or run a single area with /audit-production, /audit-seo, /audit-security, or /audit-ui — or /audit-quick for a fast, top-10-findings scan of everything.
3. Review the reports in .ai/reports/, decide what to fix, then:
/audit-implement
4. Verify the fixes:
/audit-verify
5. Before launch: run /audit-production again on the latest project state as a final readiness review.
The kit is plain Markdown — any agent that can read files and follow instructions can run it. Install with Option B (copy the kit into your project as .ai/; the plugin and slash commands are Claude Code-only), then paste these prompts into your AI chat, in order:
1. Run project discovery:
Read .ai/PROJECT-DISCOVERY.md and execute it.
Review the generated .ai/PROJECT-CONTEXT.md and correct anything the agent couldn't verify.
2. Run the audits — the full set:
Read .ai/MASTER-AUDIT.md and execute it.
Or a single area:
Read .ai/audits/01-production-readiness.md and execute it.
Read .ai/audits/02-seo-aeo-geo.md and execute it.
Read .ai/audits/03-security-devops.md and execute it.
Read .ai/audits/04-ui-ux-animation.md and execute it.
3. Review the reports in .ai/reports/, decide what to fix, then:
Implement only the findings I approved from the audit reports in .ai/reports/. Do not make unrelated changes.
4. Verify the fixes:
Re-inspect each implemented finding from the audit reports and verify it is actually resolved. Mark each as Resolved, Partially resolved, or Not resolved with evidence, and write a verification report to .ai/reports/.
5. Before launch:
Read .ai/audits/01-production-readiness.md and execute it against the latest project state as a final readiness review.
Plugin users (Option A) get these automatically. Copy-mode users (Option B) can install them per project:
mkdir -p your-project/.claude/commands && cp your-project/.ai/commands/*.md your-project/.claude/commands/Then use:
/audit-discover— project discovery/audit-master— full coordinated audit/audit-production,/audit-seo,/audit-security,/audit-ui— individual audits/audit-quick— fast single-pass scan, top 10 findings only/audit-implement— implement approved findings only/audit-verify— verify implemented fixes against the original findings
Plugin users also get an auto-triggering skill: asking Claude "is my project production-ready?" or "audit this project" invokes the kit without needing to know the command names.
.ai/ (or the plugin install directory)
├── README.md ← this file
├── .claude-plugin/ ← plugin + marketplace manifests
├── .github/ ← CI validation + issue templates
├── PROJECT-CONTEXT.md ← shared project facts (filled by discovery)
├── PROJECT-DISCOVERY.md ← discovery agent prompt
├── MASTER-AUDIT.md ← orchestrator for all four audits
├── audits/
│ ├── 01-production-readiness.md
│ ├── 02-seo-aeo-geo.md
│ ├── 03-security-devops.md
│ └── 04-ui-ux-animation.md
├── commands/ ← Claude Code slash commands
├── skills/ ← auto-triggering skill (plugin mode)
├── reports/ ← generated audit reports land here
│ └── templates/ ← report structure templates
├── examples/ ← sample report output
├── assets/ ← social preview image
├── CHANGELOG.md
└── LICENSE
- P0 Critical — blocks production or creates severe risk
- P1 High — should be fixed before launch
- P2 Medium — important improvement
- P3 Low — future improvement / polish
- Inspect first; audit before implementation; implement only after explicit approval.
- Never invent project facts — unverifiable information is marked
UNKNOWN. - Never expose secrets: no printing of API keys, passwords, tokens, or private keys. Found secrets are reported by location and type only.
- No destructive operations, no unrelated refactors, no generic advice without project-specific evidence.
- Prefer small, reversible changes; re-audit affected areas after implementation.
The kit is plain Markdown prompts with no Claude-specific dependencies — see the non-Claude track in Quick start for the full step-by-step. Paths inside the prompts assume the kit lives at .ai/ in your project root; adjust the prompts if you place it elsewhere.
- Keep generated audit reports in
.ai/reports/, date-stamped (YYYY-MM-DD-master-report.md), so audit history is preserved (commit them or gitignore them — your choice, but be consistent per project). - Never commit real secrets or sensitive production data into the
.ai/directory. - Record each audit in the Audit History table in
PROJECT-CONTEXT.md.
Issues and pull requests are welcome — especially new audit dimensions (e.g., i18n, mobile-app readiness, compliance) and improvements to existing prompts.
Created by Mehedi (Coder71 Limited).
MIT © 2026 Coder71 Limited — see LICENSE.