Glossary

Every term SiteCMD uses with a specific meaning, in one place. If a word in the product or docs is doing more work than you think it is, it’s probably here.

Scan terms

Scan - A single run of SiteCMD’s check engine against a project. Produces a set of findings, a score, and updates the project’s history.

Run Scan - The user action that starts a scan. The top-bar button.

Live-site checks - The engine that fetches your URL and runs checks against the response. See Live-site checks.

Source audit / Code Scan - The engine that walks your linked source folder and analyzes files locally. See Source audit.

Polish signals - A subset of live-site checks for presentation and content-quality patterns such as inline-style density, excessive decorative gradients, repetitive punctuation, default page titles, and similar signals. These are heuristics, not proof of who or what created a site.

Probe checks - Live-site checks that make their own follow-up HTTP requests (fetching /robots.txt, alternate URLs for security headers, etc.). Slower than HTML parse checks but run concurrently.

HTML parse checks - Live-site checks that operate on the page SiteCMD already fetched. Essentially free per scan.

Scheduled scan - A scan configured to run automatically on a daily or weekly schedule, per environment. Runs in the background, even when the app window is closed. See Scheduled scans.

Session scan / multi-page scan - A single scan run that covers more than one page of a site, grouped together under a session ID so the pages report as one scan.

Pre-deploy scan - A scan mode for sites that aren’t live yet. Skips checks that only make sense against a deployed site and runs pre-deploy-specific checks instead. Any localhost URL triggers it automatically in the desktop app.

Issue terms

Finding - A single thing SiteCMD detected. Also called an issue.

Severity - How bad a finding is if it’s real. Critical, High, Medium, or Low. See Understanding findings.

Confidence - How sure SiteCMD is that a finding is real. Confirmed, High, or Needs review.

Status - Where a finding sits in your workflow. New, Ignored, Blocked, Verified, or Regressed.

Active findings - Findings in the New or Regressed status. These count toward your score.

Regressed - A finding that was verified as fixed and then detected again by a later scan. Counts toward the score like a new finding, labeled as a regression.

Dismissed - Informal catchall for findings set aside with Ignore or Block. These lifecycle choices affect the score; they do not prove the underlying risk disappeared.

Quick win - A finding whose fix guide marks the work as quick effort. Surfaced as a toggle on the Dashboard fix list.

Fix guide - Step-by-step instructions for resolving a finding, with an effort estimate (quick, moderate, or involved) and framework-specific steps when your stack is detected. Included in the complete free local workbench.

Fix prompt - An LLM-ready writeup of a finding, with enough context that an AI editor can act on it directly. Pulled by AI editors over MCP (get_fix_prompts) or exported from the issue.

Verified agent fix - The loop where SiteCMD briefs your coding agent on a finding, the agent makes the change, and SiteCMD re-runs the check to confirm it is fixed. Included without a local usage cap.

Score terms

SiteCMD Score - The headline number out of 100 that summarizes your project’s health. See The SiteCMD Score.

Impact - A per-finding prioritization weight derived from severity, confidence, failure-versus-warning state, and a bounded occurrence boost. The Issues list groups by severity first and uses impact within a severity. Impact is not a second SiteCMD Score.

Diminishing returns - The deduction model behind the score. The first issue of a severity costs the most; each additional one costs a little less. Keeps a long tail of small issues from collapsing the score to zero.

Security cap - The one hard cap on the score. An active finding must be Critical, belong to the audited cap-candidate list, and carry explicit High or Confirmed confidence to cap the score at 49. Needs-review and lower-severity findings never trigger it. See The SiteCMD Score for the current eligibility rules.

Engine and architecture terms

Project - A single website tracked in SiteCMD. Has a name, one or more URL environments, and optionally a linked source folder.

Environment - One URL associated with a project, tagged with a role: production, staging, development, or local. Each project has one or more environments.

Linked source folder - A directory on your machine that SiteCMD is allowed to read for the source audit. Linked per-project.

Risk category - How SiteCMD groups findings. Live-site checks use Security, Performance, SEO, Accessibility, Compliance, Config, and Polish. The source audit uses Security, Database Analysis, AI Safety, Architecture, Operations, Dependencies, and AI Setup.

Detected framework - The framework SiteCMD identified for your project based on package.json, lockfiles, hosting config, and other markers. Used to pick framework-specific fix steps.

Integration terms

Integration - A connected third-party service that SiteCMD reads data from.

Cross-source correlation - When a scan finding and an integration event happen in the same window and SiteCMD ties them together. Included in the complete free local workbench.

Webhooks - Outbound HTTP calls the connected service makes to a URL you give it. New findings and regressions on a connected site can be alerted by email or webhook; the local workbench uses desktop notifications instead. See Pricing & connected service.

AI and developer terms

MCP - Model Context Protocol, the standard SiteCMD’s AI integration speaks. See AI editor overview.

MCP server - sitecmd-mcp, the binary that exposes scan data to MCP-capable AI editors. Bundled with the desktop app.

Commercial and account terms

Local workbench - The complete desktop, scan, issue, integration, MCP, CLI, report, and verification product that runs on your machine for free.

Connected service - SiteCMD-operated hosted automation for a production site: deploy watches, scheduled scans, shared baselines, alerts, gate verdicts, and report delivery.

Connected production site - The future billable unit for the connected service. Public prices and included quantities are not set during the founder beta.

License key - A string an existing subscriber can paste into SiteCMD to restore the commercial credentials associated with an earlier purchase. It does not enable extra local finding detail.

Activation - Registering this machine with your license. Each license has a per-machine activation limit.

Offline grace period - The window during which existing connected-service or maintained-catalog credentials remain usable when SiteCMD cannot reach the license server. Local capabilities do not pause when the window ends.

Storage terms

Storage directory - The per-user directory where SiteCMD keeps its local data. See Privacy & data for exact paths.

Audit log - audit.log in the storage directory. JSONL record of sensitive operations. Local-only.

OS keychain / credential store - Where SiteCMD keeps API keys and OAuth tokens. Keychain on macOS, Credential Manager on Windows, GNOME Keyring / KWallet on Linux. Never in the SiteCMD database.