LoupeKit — Web Tech & AI Vibe-Code Inspector Edge extension security report

LoupeKit is a developer's inspector for the page you already have open. It answers four questions, and it only ever looks at the tab you are on, when you ask it to. WHAT IS THIS BUILT WITH Detects 1700 technologies — frameworks, UI kits, icon systems, bundlers and module loaders, JavaScript libraries, CDNs, caches, web servers, load balancers, server-rendered frameworks, CMS and commerce platforms, payment processors, analytics, marketing and advertising tags, error tracking and session replay, live chat, consent banners, bot management, the form backend a contact form posts to, and the metadata a page declares about itself — and shows how each one was identified: a DOM marker, an asset URL, the generator meta tag, a page global, a namespaced CSS variable, or a header on the page's own response. Versions are read wherever the page states one. Open any row for what it is, what exactly matched, its confidence and a link to its documentation. Includes a client-side page pulse — DOM size and depth, scripts, stylesheets, images, third-party origins and paint timings — with the script, stylesheet, image and third-party lists opening in a sortable window of their own, plus a one-click Markdown report. HOW MUCH OF THIS IS VIBE-CODED An audit scores the page from 0 to 100 across five weighted categories: DOM and HTML artifacts, CSS and utility-class verbosity, JavaScript runtime artifacts, copywriting patterns, and accessibility. Sixty-six heuristics, each explaining the measurement that triggered it and offering a concrete refactor you can copy. The scoring model is calibrated so hand-written pages score low — a tool that flags careful work is worse than no tool. Four page diagnostics sit beside the tools: which selectors are fighting hardest to win, every stacking context and the property that created it, everything that moved after the page painted, and every form field's constraints with the message each one produces. All four read the page and hand back a ranked list; clicking a row scrolls to the element and selects it. The form check is the one that writes anything — each field is filled, checked and restored within the same pass, nothing is submitted, and password and payment-card fields are skipped entirely. The colour picker magnifies an image of the tab, because no API reads a rendered pixel from a document. That image is captured on the same one-tab grant everything else uses, handed straight to the lens, and discarded when it closes. Arrow keys move the sample point one pixel at a time, which a pointer cannot do on a scaled display. Where the browser provides one, a second button hands over to its own screen-wide eyedropper for colours outside the page. INSPECT AND EXTRACT Hover any element for its box model, computed typography, colours and a WCAG contrast verdict measured against the real background behind the text. Four page overlays: element selection, distance guides, rulers and a wireframe view. Edit text, spacing, colour and borders live to try an idea — edits touch the page in front of you only, are undoable, and are never saved or uploaded. A second view extracts the palette, the font matrix and every SVG and image on the page, with SVG available as JSX. FIX THE SMALL THINGS A Tailwind class optimizer that deduplicates, resolves conflicts, merges spacing and sorts. A copy sanitizer that finds AI phrasing and proposes plain replacements. A viewport tester that loads the page in real iframes at real device widths, so breakpoints actually fire. PRIVACY Nothing runs in the background and no page is read until you click. LoupeKit requests no permission for any specific website at install: the inspection code is injected into the tab you are on, at the moment you ask, using the activeTab permission. One optional setting, off by default, opens the panel automatically on page load; turning it on asks your browser for access to every site, and turning it off gives that access back. It changes when the panel appears, never what is collected. Inspection, extraction and the live editing tools run entirely in your browser and send nothing on their own. A few readings do ask a server, each behind its own button, and each sends the least it can be asked with. A Vibe Audit sends counts rather than content: the hostname, heading text and a set of numbers, with email addresses and long identifier strings redacted before they leave the page. Vulnerability dating sends the detected package names and version numbers — no hostname, no URL, nothing that identifies the site. The Server tab's readings and the field-data lookup send the page's address, because asking our server to fetch a page, cannot be done without naming it; the query string is removed before anything is sent, and the address is never stored or logged. Input field values and body copy are never read at all. The full field list is published at https://loupekit.com/privacy. PRICING Three audits free, no account and no sign-up. After that a one-off or monthly Pro unlock removes the limit. Everything else — stack detection, the inspector, extraction and the tools — is unlimited and free. Buying Pro does use an account, because a purchase produces a licence key held against it — the key is what carries Pro across browsers, up to three at a time, and everything free works without one.