Run a full backend diagnosis — scans routes, checks contracts, audits errors, env vars, security, and performance. Generates documentation and updates the issue ledger. This is the main entry point.

Analyze a project for the first time to understand what it does. Scans routes, package.json, database schema, and README to build a project understanding. Run this before any diagnosis.

Update the project understanding with user-provided corrections or additions.

Get the current project understanding.

Scan and parse all API routes in a Next.js project. Returns the full API surface: endpoints, HTTP methods, parameters, and file locations.

Verify frontend-backend contracts. Finds all API calls in frontend code and cross-references them against backend route definitions. Detects mismatches, dead endpoints, and phantom calls.

Audit error handling across all API routes. Checks for try/catch coverage, consistent error response formats, unhandled promise rejections, and missing global error handlers.

Scan environment variable usage. Cross-references process.env references against .env files, checks for missing NEXT_PUBLIC_ prefixes, and detects undefined variables.

Check security posture. Detects auth middleware gaps, CORS misconfigurations, missing input validation, and known vulnerability patterns.

Detect performance anti-patterns. Finds N+1 queries, unbounded database calls, missing pagination, and payload bloat (backend returns more data than frontend uses).

Audit Prisma schema and database usage. Parses schema.prisma, cross-references database calls against the schema to find nonexistent models/fields, suggests missing indexes, and checks for migration drift.

Audit Next.js Server Actions. Finds all 'use server' functions and checks for missing validation, error handling, auth checks, and unprotected database calls.

Get the auto-generated living API documentation for the project. Returns the full route map with request/response types, auth requirements, and frontend consumers.

Get the issue ledger — tracks every issue from discovery through fix. Filter by status, severity, or category.

Apply a proposed fix for a specific issue. Only fixes backend code — never touches frontend files.

Run safety validation on a project path. Validates the path is safe to scan, ensures .backend-doctor/ is in .gitignore, and prunes old reports. Call this before any diagnosis to verify the project is safe to analyze.

Run live HTTP tests against discovered API endpoints. SAFETY: Only GET endpoints are tested. DELETE is never called. POST/PUT/PATCH are skipped (no safe payload generation). Only localhost URLs are accepted.

Query the API graph with natural language. Builds a graph of routes, models, frontend components, and middleware, then queries it. Examples: "unprotected routes", "routes that write to users", "unused models".

Get common patterns across projects. Shows the most frequently encountered issues for a given framework. Data is stored locally only — never sent externally.

Generate code patches for all open issues in the ledger. Returns unified diffs that can be applied with git apply. Does NOT auto-apply — returns patches for review.

Run an incremental diagnosis — compares current state against the last saved report. Highlights new issues, fixed issues, and health score changes. Runs a full analysis but highlights what changed — new issues, fixed issues, and health score delta.

Quick check — shows which files changed since the last diagnosis and how long ago it ran. Does NOT re-run analysis. Use this to decide if a full re-run is needed.

Scan project dependencies for known vulnerabilities, deprecated packages, and security issues. Checks package.json against a built-in vulnerability database and optionally runs npm audit. No network required for basic checks.

Audit rate limiting and caching patterns. Detects rate limiting packages and code patterns, finds auth endpoints without rate limiting, identifies GET endpoints with DB calls but no caching, and flags cacheable endpoints missing Cache-Control headers.

Detect and audit API versioning patterns. Finds path-based (/v1/, /v2/) and header-based (X-API-Version) versioning, identifies version gaps (routes in v1 but not v2), and flags inconsistent versioning across endpoints.

Visualize the middleware chain for all routes. Detects global middleware (app.use), Next.js middleware, and inline middleware. Shows execution order, identifies ordering issues (CORS before auth), and flags unprotected mutation endpoints.

Scan codebase for hardcoded API keys, tokens, passwords, private keys, and connection strings. Uses pattern matching for 25+ provider-specific secret formats (AWS, Stripe, GitHub, OpenAI, Anthropic, etc.) and checks .gitignore for env file exclusion.

Audit a deployed website or API from the outside — checks security headers (HSTS, CSP, X-Frame-Options, etc.), server information leakage, caching configuration, HTTPS redirect, error page information disclosure, and response time. No source code needed.

Deep HTTP security header analysis with A-F letter grading. Checks CSP (unsafe-inline/eval, wildcards), HSTS (max-age, includeSubDomains, preload), COEP, COOP, CORP, Permissions-Policy, and more. No source code needed — just a URL.

CORS misconfiguration detection. Tests preflight requests, origin reflection, wildcard + credentials conflicts, overly permissive methods, and missing max-age. Catches the exact issue found on coach.tetr.com. No source code needed.

TLS/certificate analysis. Checks certificate chain, expiry (warns at 30 days, critical at 7), protocol version (TLS 1.2+), cipher strength, HTTP→HTTPS redirect, and HSTS preload. No source code needed.

Cookie security audit. Checks Secure, HttpOnly, SameSite flags on all cookies. Detects session tokens without HttpOnly, SameSite=None without Secure, overly broad cookie scopes. No source code needed.

DNS and infrastructure analysis. Resolves A/AAAA/CNAME/MX/NS/TXT records, detects CDN provider, checks SPF/DMARC/CAA records for email and certificate security. No source code needed.

Error response analysis. Probes with 404s, malformed input, long URLs, wrong content types, and SQL injection patterns to detect stack trace leakage, framework disclosure, database error exposure, and debug mode. No source code needed.

Authentication surface analysis. Discovers login endpoints, detects auth mechanisms (password, OAuth, OTP), checks for CSRF tokens, tests rate limiting on auth endpoints, and probes for account enumeration. No source code needed.

API surface discovery from frontend JavaScript. Crawls HTML for script tags, extracts API endpoint URLs from JS bundles, probes each endpoint to map auth requirements and response behavior. No source code needed.

Compare current API routes against a saved baseline to detect breaking changes: removed endpoints, removed methods, changed parameters, removed validation or auth. Saves a baseline on first run.

Audit database migration files for destructive operations (DROP TABLE, DROP COLUMN, type changes), missing rollback/down migrations, and schema drift. Supports Prisma, Knex, Drizzle, TypeORM, and raw SQL.

Deep GraphQL security audit — checks for introspection exposure, missing query depth/complexity limits, N+1 query patterns (DataLoader absence), missing field-level authorization, and batching attack vectors. Supports Apollo, Yoga, Mercurius, NestJS, and Pothos.

Calculate a technical debt score (0–100) from all audit findings. Estimates remediation effort in hours per category, assigns a letter grade (A+ to F), tracks score over time, and generates prioritized recommendations. Run after run_diagnosis for best results.

Trace types across application layers: frontend → route handler → service → repository → database. Finds type mismatches between layers, identifies routes accessing DB directly without service layer, and maps the full type chain for each endpoint.