FAQ

Is the free local workbench actually useful?

Yes. Free is not a trial. The complete local workbench is free: unlimited local sites, scans, and history; every Web Scan and Code Scan check; the axe-core browser pass; full issue detail and evidence; complete fix guidance; correlation; integrations; MCP; CLI; reports; exports; and local verification. There is no local information-depth gate.

The connected service is separate. It runs scans after production deploys and between local sessions, maintains a shared hosted baseline, sends regression alerts, returns CI gate verdicts, and delivers hosted reports while your laptop is closed. Founder-beta access is comped.

See Pricing & connected service.

How much does it cost?

The complete local workbench is free and stays that way. Connected-service access is comped during the founder beta.

Public connected-service prices and allowances are not set yet. The future billable unit is a connected production site, and plans are intended to be flat bundles with no metered overages. The pricing pass follows measured founder-beta cost and value rather than a guessed launch price.

See Pricing & connected service for the commercial boundary.

What platforms does it run on?

macOS (Apple Silicon and Intel), Windows (64-bit), and Linux (64-bit). The desktop app needs a graphical environment; the standalone sitecmd CLI does not, so headless servers and CI runners use the CLI (see Can SiteCMD run on a server (headless)? below).

See Installation.

Does it require an internet connection?

For scans, yes. SiteCMD has to be able to reach your URL to scan it.

The dashboard, local issue list, scan history, source audit, reports, and MCP server do not depend on a SiteCMD-hosted backend. Existing licenses may validate periodically for connected-service or catalog credentials, with an offline grace period for temporary outages. Connected sites use SiteCMD’s hosted service only after you explicitly configure them.

See Privacy & data for the full breakdown of what’s local vs. networked.

Where does my data live?

Local projects stay on your machine. Your SQLite database, scan history, project configuration, and integration cache are in your operating system’s app-data directory.

The connected service does not mirror the whole local database. For a site you explicitly connect, it stores the production URL, selected route scope, release identifiers, finding contract, baseline state, and delivery state needed to run the hosted workflow.

See Privacy & data for the exact paths.

Is SiteCMD a security scanner?

It checks a lot of security-relevant things (headers, SSL, exposed files, dependency CVEs, common authentication and authorization gaps in source). It is not a replacement for a proper security audit by humans. If you handle sensitive data, get a real audit.

What SiteCMD catches well: misconfiguration, common patterns of bad code, missing best-practice security headers. What it doesn’t catch: business logic flaws, novel attack vectors, anything that requires creative reasoning about your specific application. The check catalog lists the engine counts and every polish signal by id.

Does SiteCMD upload my source code?

No. The source audit runs entirely on your machine. The only outbound requests it makes are dependency lookups (sending package names and versions to public registries), and those don’t include your source.

See Privacy & data.

Can my AI tool use SiteCMD?

Yes, if it supports MCP. Cursor, Claude Code, Windsurf, VS Code (native MCP, used by Copilot’s agent mode), Cline, Codex CLI, Zed, and JetBrains IDEs all do. The AI sees your scan findings, can pull fix prompts tailored to specific checks, and can verify its work by comparing scans before and after.

The MCP server is part of the complete free local workbench. Your AI editor can read full issue detail, retrieve fix prompts, compare scans, inspect correlations, and request verification without a paid local gate. The server is bundled with the desktop app and runs locally. See AI editor overview.

Does it work with WordPress / Next.js / Astro / Django / [my framework]?

The live-site scan works with anything that serves HTML over HTTP. There’s no framework requirement.

The source audit detects and applies framework-specific checks for: Next.js, Nuxt, SvelteKit, Svelte, Gatsby, Astro, Remix, Angular, React, Vue, Express (JavaScript/TypeScript), Drupal, WordPress, Laravel (PHP), Django, Flask, FastAPI (Python), and others. If your framework isn’t detected, the source audit still runs the framework-agnostic checks.

How long does a scan take?

Most scans finish in seconds. A scan on a small static site is essentially instant. A scan on a large site with many probe targets and a deep source folder can take longer (tens of seconds to a few minutes).

The slowest part is usually probe checks (each one is a network round-trip to your server). They run concurrently, so the total time is bounded by your slowest probe, not the sum.

Will SiteCMD slow down my computer?

In active use, no more than a browser does. The scan engine is the most CPU-intensive part, and it only runs while a scan is happening.

The background scheduler runs a minute-tick check (very cheap) but only triggers an actual scan when one’s scheduled to run. Your laptop won’t notice.

Can I run SiteCMD in CI?

Yes. The current release includes a standalone sitecmd CLI for macOS, Windows, and Linux. It can run the live-site Web Scan, run Code Scan against the checkout, enforce score or severity thresholds, compare against the previous web scan, and return CI-friendly exit codes. Install it and follow the examples in Quality gates in CI.

Local sitecmd scan runs Web Scan and local sitecmd audit runs the complete Code Scan. On a site you have connected, sitecmd gate and sitecmd connected --submit add shared baseline or deployment context to Code Scan. Core Web Vitals and the axe-core accessibility deep scan do not run in the CLI, which ships without a browser engine; they run in the desktop app and, on a connected site, in the hosted scheduled scans. A CLI gate is one layer of release verification rather than a complete substitute for a browser-layer scan.

Can my team share scan results?

The local workbench does not mirror a shared cloud dashboard. You can share from it through:

• Reports - export PDF or HTML reports and share via email, chat, or your intranet.
• CSV export of the activity timeline from the Activity page.

The connected service adds shared hosted baselines, gate verdicts, alerts, and report delivery for sites you explicitly connect. It is not a general-purpose hosted copy of your desktop database.

Does SiteCMD work offline?

For everything except network scans, third-party integrations, and connected-service operations, SiteCMD works offline. Reviewing past scans, triaging, using local fix context, and exporting reports all work without an internet connection.

Can SiteCMD run on a server (headless)?

Yes. The standalone CLI runs without a graphical environment and is suitable for CI runners, scheduled jobs, and other headless hosts. It runs live-site Web Scans and free local Code Scans with sitecmd audit. On a connected site, sitecmd gate and sitecmd connected --submit add hosted baseline or deployment context. Core Web Vitals and the axe-core accessibility deep scan need a browser engine the standalone CLI binary ships without; they run in the desktop app and, on a connected site, in the hosted scheduled scans.

See CLI reference for installation, supported commands, and current limits.

What if I lose my license key?

Existing subscribers can find a license key in the email LemonSqueezy sent at purchase. If you cannot find that email, sign in at the SiteCMD billing portal with the purchase email.

What if I switch computers?

For an existing license, deactivate the old machine in SiteCMD or through the LemonSqueezy customer portal, then activate the new machine with the same key. The portal shows the activation allowance attached to that purchase.

See License & billing.

Can I get a refund?

Founder-beta connected-service access is comped, so there is no beta purchase to refund. Existing purchases keep the refund and cancellation terms shown at purchase; existing subscribers can cancel future renewals through the billing portal.

See License & billing.

Is SiteCMD open source?

Yes. The desktop app, local scan engine, MCP server, and CLI are published under the Apache License 2.0 at github.com/brambleworks/SiteCMD. The connected service and commercial intelligence catalogs remain operated services rather than part of the public repository.

Is SiteCMD available now?

Yes. Signed desktop installers are available from the download page for macOS, Windows, and Linux.

Who is SiteCMD for?

Indie developers and small agencies, site owners who maintain their own sites, and AI-first builders who use Claude, Cursor, Windsurf, or Codex.

If you maintain a single static site that never changes, SiteCMD is more than you need. If you maintain sites that get updated regularly, get touched by multiple people, or get features added by an AI assistant, SiteCMD is built for you.