Generating a backend is easy.
Checking one isn't.
Wyro reads the backend your coding agent wrote and shows which routes reach your data without checking who is asking. Paste a public GitHub repo. No account, nothing to install.
Rule-based, not a model · Same commit, same result · Findings ranked by risk, each with a fix
Put the check inside your agent's loop
One line gives Claude Code, Cursor or Codex the check as a tool, and four slash commands: check, fix, map and ship. The agent runs it after it changes a route, a handler or the schema, reads what it broke, and fixes it before it hands the work back. Same code, same answer, so “fix it and check again” converges instead of arguing with another model.
No tool can write the baseline, so an agent cannot silence its own findings. Accepting one as known debt stays your call.
Set it up for your agentThen make it a gate
The GitHub Action fails a pull request that introduces a new problem: an unauthenticated route reaching a table, sensitive data flowing to a third party. Record what is already there as a baseline once, and only new findings ever fail the build, so you can switch it on today without fixing your history first.
Add the gateAudit the backend your AI builder generated.
Drop the export from v0, Lovable or Bolt. Wyro maps every route to the data it reaches, checks which of them verify who is asking, and shows you what the code actually does — not what the prompt said it would.
Drop your ZIP here
or click to choose
ExpressNext.jsNestJSFastAPIPrismaDrizzle
Browser-only scan. The archive is unzipped and read by this page; the file never leaves your device and no account is created. Saving the result as a project is a separate, deliberate step — that one does upload the files, and stores them with your project. What we store
The check that runs where you review
A browser extension. It reads the backend of whatever repository you are looking at and tells you what it actually does.
Install it once
A button appears on every GitHub repository you open. No account, no configuration, nothing to connect.
Install it once
A button appears on every GitHub repository you open. No account, no configuration, nothing to connect.
It reads the repository
Drizzle, Prisma, Mongoose, TypeORM and SQLAlchemy schemas. Express routes, class routers, NestJS decorators and FastAPI. TypeScript, JavaScript and Python. Fetched from GitHub and parsed in your browser — nothing is uploaded.
It names what it found
Not a score and not a summary. The endpoint, the table it reaches, and the rule it breaks — so you can check the claim yourself in the file.
And what it could not read
Files it did not read and places it could not parse are listed, not skipped. A rule with nothing to look at is reported as not having run, and a project it cannot parse as unreadable rather than clean. That distinction is the whole tool.
Add it to your browser
Then open any GitHub repository and press Check with Wyro.
Add to ChromeRepositories are read through GitHub and analysed in your browser — nothing is uploaded. Prefer to inspect it first, or not using Chrome? Download the build (1.8 MB) and load it unpacked.
The same check, three ways in.
No account at any of them.
and 36 more · read 120 of 720 files
The widget. A button on every GitHub repository you open. It reads the backend in your browser and names the routes that reach your data without checking who is asking.
Add it to Chrome11 / 11 rules ran · 720 files read
A check as a link. Put any public repository after /scan and the finding becomes a page — one you can paste into a pull request for someone who has installed nothing.
Open a live reportUnzipped in your browser
A ZIP from anywhere. Drag the export from v0, Lovable or Bolt onto this page. It is unzipped and read in your browser — nothing is uploaded unless you ask for it to be.
Drop one inThe parts people ask about
Is it an AI?
No. Wyro is rule-based: it parses your code into a map of routes, guards and tables, then checks that map. The same commit always gets the same result, which is what lets an agent fix a finding and check again without the answer moving.
What does it read?
TypeScript, JavaScript and Python. Routes from Express, Fastify, Hono, NestJS, Next.js route handlers and Server Actions, FastAPI and Supabase; schemas from Prisma, Drizzle, TypeORM, Mongoose, SQLAlchemy and SQL with row-level security. If it cannot read your backend it says so. It never reports a clean result for code it did not understand.
What does it catch?
Routes that reach your data without authenticating, public writes, sensitive data readable by anyone, data flowing to a third party, row-level security that is off or open, and routes that check who you are but not what you may touch. Each finding is ranked by risk, points at the file and line, and comes with a fix.
What about routes that are public on purpose?
An open read of data that holds nothing private, in a backend that authenticates elsewhere, is reported as a warning, not an error. Mark a route public in the code, or record existing findings in a baseline, and CI fails only on new ones.
Does my code leave my machine?
Not with the CLI, the agent tool or the GitHub Action: they run where your code is. A /scan page reads a public repository through GitHub, and the browser extension reads it in your browser.
Is it free?
Checking public repositories, the CLI, the agent tool, the extension and the GitHub Action are free. Paid plans add private repositories in the app, a central policy your repositories cannot weaken, and history.
Check the backend
your agent just wrote.
Paste a repository, add one line to your agent, or put the gate on your pull requests. None of them needs an account.