How SiteCMD compares to the tools you already run
Most teams already have Lighthouse in Chrome, axe in a test suite, and a code scanner in CI. SiteCMD does not replace any of them on their own ground. It runs the live-site and source checks together, on your machine, and hands the result to your AI editor with the fix attached and a re-check behind it.
Lighthouse
Lighthouse scores one page load in a lab run: performance, accessibility, best practices, SEO. SiteCMD uses the same PageSpeed Insights data for Core Web Vitals and runs axe-core for accessibility, then adds what a page-load score cannot see: security headers and TLS across the site, exposed files, DNS and domain posture, broken links, structured data, and the source-code findings behind a symptom. Lighthouse tells you the page is slow; SiteCMD pairs that with the render-blocking asset, the deploy that introduced it, and a fix prompt. Keep Lighthouse for per-page lab scores. Run SiteCMD for the whole site and its code.
axe
axe-core is the accessibility engine, and SiteCMD bundles it: the deep accessibility pass in the desktop app runs axe-core's WCAG 2 A and AA rules against the rendered page and reports them beside SiteCMD's own checks for contrast, ARIA, focus order, headings, and landmarks. If you already run axe in your test suite, SiteCMD gives you the same rules on the live site, on a schedule, with each failure ranked against everything else wrong with the page. The manual testing that axe itself says it cannot replace stays manual.
Semgrep
Semgrep matches patterns in source with rules you choose, and it is excellent at that. SiteCMD's Code Scan is narrower and opinionated: 168 rules aimed at websites and at the code AI editors produce, such as a provider SDK shipped to the browser, a public route with no rate limit, unsafe request validation, N+1 query patterns, and debug code left in production, with framework detection for Next.js, Astro, Laravel, Django, WordPress, Drupal, and others. It needs no rule authoring, makes no registry requests while it runs, and never uploads your source. It also knows which live-site finding a code finding explains, which a code-only tool cannot. Keep your Semgrep rule set. SiteCMD adds the website-specific rules and the link to the live site.
Snyk
Snyk is dependency and container security as a service: it scans your manifests in its cloud and tracks vulnerabilities over time. SiteCMD's Updates page covers the dependency half locally. It parses lockfiles for 8 ecosystems, checks versions against the public registries and the OSV vulnerability database, sends only package names and versions, and ranks what to upgrade first. It does not do container scanning, license compliance workflows, or a hosted team dashboard. If your policy needs Snyk's reporting, keep it. If you want vulnerable packages surfaced next to the rest of your site's findings without uploading a manifest, SiteCMD does that.
Where each tool fits
| Tool | Best at | What SiteCMD adds |
|---|---|---|
| Lighthouse | Lab scores for one page load in Chrome | Site-wide security, DNS, links, structured data, and the code behind a slow page |
| axe | WCAG rule checks in a test suite | The same axe-core rules on the live site, on a schedule, ranked with everything else |
| Semgrep | Pattern matching with rules you write | Website-specific rules with no authoring, tied to the live-site finding they explain |
| Snyk | Hosted dependency and container security | Local lockfile checks against public registries and OSV, no manifest uploaded |
What SiteCMD does not do
- It is not a penetration test. It finds misconfiguration, exposed files, missing headers, and common unsafe patterns in code; it does not reason about your business logic.
- It does not scan containers, images, or infrastructure, and it keeps no hosted dashboard of your local scans unless you connect a site yourself.
- The CLI ships without a browser engine, so Core Web Vitals and the axe-core deep scan run in the desktop app and in hosted scheduled scans on connected sites, not in CI.
- It runs 390+ deterministic checks and no model. If a problem needs judgment, SiteCMD hands the evidence to your editor; it does not guess for you. Every check is readable at the public repository.