Local-first website resilience, accessibility, failure-mode and visual regression testing with Playwright and MCP.
See what breaks before your users do.
HauntView photographs your website under 25 different conditions — mobile layout, JavaScript disabled, images blocked, fonts failing, offline, broken links, missing security headers, and more. Every finding carries proof. The tool refuses to flag a defect it cannot prove.
haunt)Install globally via npm to run rites directly from your terminal:
npm install -g hauntview
# Run testing rites against any URL
haunt https://example.com
# Run specific profiles directly via flags
haunt https://example.com --mobile --desktop --offline --broken-links
# Run an entire category of tests via shortcuts
haunt https://example.com --a11y
haunt https://example.com --resilience
# Run profiles by comma-separated tags
haunt https://example.com --tag mobile,resilience
# Configure default export format, destination, and concurrency
haunt setup
# Check Node version, installed browsers, and system concurrency capability
haunt doctor
git clone https://github.com/kingjethro999/hauntview.git
cd hauntview
pnpm install
pnpm dev # Victorian Parlour Web UI at http://localhost:3000
pnpm mcp # MCP server (stdio) for Kiro integration
Requirements: Node 22 LTS, pnpm 9+. Playwright browser engines (Chromium, Firefox, WebKit) are installed automatically.
HauntView is packaged as an installable Kiro Power under power/ following the Agent Plugins specification. It bundles all 25 testing profile tools, specialized skills (haunt-a-website, exorcise-findings, setup), and automatic conversational activation keywords.
https://github.com/kingjethro999/hauntview
Once installed, simply ask Kiro in chat:
"Test my site on mobile and check for broken links on http://localhost:3000"
"Audit accessibility and prefers-reduced-motion on https://example.com"
"Exorcise findings from the last run and verify the fix"
Kiro will automatically activate the Power, execute the test rites in headless browsers, analyze visual diff plates and DOM snapshots, and guide you to fix issues with verified evidence.
If you prefer configuring MCP directly in your workspace, add .kiro/settings/mcp.json:
{
"mcpServers": {
"hauntview": {
"command": "pnpm",
"args": ["mcp"],
"disabled": false
}
}
}
Then ask Kiro in chat:
@hauntview run tests on https://yoursite.com— it will invokerun-test-profile, extract structured findings, and help you fix them without leaving the IDE.
haunt / hauntview), interactive setup wizard, doctor diagnostic, and opt-in profile concurrency.┌────────────────────────────────────────────────────────────────────────┐
│ FACES │
│ Web UI (Next.js) CLI (`haunt`) MCP Server REST API │
│ Parlour Interface Node.js CLI Kiro/Claude Endpoints │
│ Zustand Store Zero Web Bloat stdio/SSE /api/test │
└────────────────────────────────────┬───────────────────────────────────┘
│ (direct / HTTP / stdio)
┌────────────────────────────────────▼───────────────────────────────────┐
│ CORE │
│ Orchestrator (`HauntViewEngine`) Concurrency Resolver │
│ System Capability Evaluator 25 Resilience Profiles │
│ BrowserPool (Playwright) FindingClassifier │
│ ScreenshotManager VisualDiff (pixelmatch) │
│ ReportFactory (HTML/MD/Zip) Safety & SSRF Validator │
└────────────────────────────────────┬───────────────────────────────────┘
│
┌────────────────────────────────────▼───────────────────────────────────┐
│ DUAL STORAGE MODEL │
│ │
│ Client-Side Web Storage (Private) Server-Side Storage (Headless) │
│ --------------------------------- ------------------------------ │
│ • zustand/persist -> localStorage • SQLite via better-sqlite3 │
│ • Zero cross-visitor leakage • `.hauntview/data/hauntview.db`│
│ • Device-local privacy • Used by CLI, MCP, and Server │
│ • Survives server redeployments • Structured run & finding data │
│ • Rehydrates reports on restart • Export outputs to configured │
│ • Manual "Clear History" button destination directory │
└────────────────────────────────────────────────────────────────────────┘
HauntView intentionally separates storage based on environment:
localStorage via Zustand):
persist middleware (app/lib/crypt-store.ts).hauntview.onrender.com), test reports are private to each user's device and never bleed between visitors..hauntview/data/hauntview.db).zustand, window, or browser DOM APIs, keeping the package lean and portable.HauntView includes an opt-in concurrency engine that executes browser rites in parallel using a bounded worker pool:
| Execution Mode | Concurrency Amount | Duration (25 Profiles) | Memory Footprint |
|---|---|---|---|
| Sequential (Default) | 1 (off) | ~70 – 80s | ~600 MB peak |
| Concurrent (Optimal) | 2 – 4 workers | ~25 – 30s | ~1.5 – 2.5 GB peak |
To prevent system freezing or OOM conditions, HauntView calculates safe hardware limits at runtime:
maxConcurrency = 1). The setup wizard disallows enabling concurrency, and the CLI clamps manual overrides.haunt setup refuses values higher than the hardware maximum with a detailed explanation of your machine's CPU/RAM specs.--concurrency, --concurrency-amount) / API request body (concurrency, concurrencyAmount) / MCP tool argumentsHAUNT_CONCURRENCY=1, HAUNT_CONCURRENCY_AMOUNT=n)~/.config/hauntview/config.json)concurrency: false, concurrencyAmount: 2)hauntview.onrender.com)HauntView's public demo instance runs on Render's $7/month Starter plan with 0.5 vCPU and 512 MB RAM (Render's free tier provides only 0.1 CPU, so we use the paid Starter tier to provide dedicated 0.5 CPU). Concurrency is strictly disabled on the hosted instance to protect container stability. Requests to /api/test with concurrency enabled are rejected with HTTP 400. Full 25-rite runs take ~70 seconds on Render. For fast concurrent testing (~20s), please install the CLI or run locally via MCP.
See docs/CONCURRENCY.md for full details.
HauntView implements an automated workspace-wide versioning workflow:
VERSION file defines the project version.0.0.9 → 0.1.00.99.9 → 1.0.0VERSIONpackage.jsonpower/plugin.jsonsrc/version.tssrc/version.ts)scripts/bump-version.mjs before every commit. The hook detects and skips bumps during git amend, rebase, and merge operations to avoid version drift.pnpm run version:check to verify that all carrier files match VERSION.pnpm run setup:hooks to reinitialize Git hooks for development.HauntView provides full, first-class support for both Windows and Unix operating systems:
msedge channel, testing real Windows High Contrast mode (forced-colors) and Edge PWA integration.C:\...), UNC network paths (\\server\share), backslashes (\), forward slashes (/), and Windows environment variables (%USERPROFILE%, %APPDATA%, %LOCALAPPDATA%, %TEMP%).cmd.exe) and adapts icons automatically (Unicode emojis in modern terminals, clean ASCII fallbacks in legacy shells).SIGINT), SIGTERM, and SIGBREAK on Windows so no orphaned chrome.exe processes linger in Task Manager.%APPDATA%\hauntview on Windows, ~/Library/Preferences/hauntview on macOS, and $XDG_CONFIG_HOME/hauntview on Linux.| ID | Viewport | What it checks |
|---|---|---|
mobile-iphone15 | 390×844 | Touch targets, responsive layout, font sizes |
mobile-android | 360×800 | Touch targets, responsive layout |
tablet-ipad | 1024×1366 | Viewport-fit, double-tap delay, landscape overflow |
desktop-1080p | 1920×1080 | Layout shift, CSS optimization |
desktop-4k | 3840×2160 | High-DPI images, typography legibility, container width |
mobile (canonical) | 390×844 | Canonical mobile rite |
tablet (canonical) | 820×1180 | Canonical tablet rite |
desktop (canonical) | 1280×800 | Canonical desktop rite |
| ID | What it checks |
|---|---|
a11y-screenreader | lang, landmarks, heading order, skip links, ARIA roles |
a11y-keyboard | Positive tabindex, non-semantic clickables, focus outlines |
a11y-visual | Luminance contrast ratios (WCAG AA), color-only state, forced-colors |
a11y-cognitive | DOM complexity, autoplay, form complexity, readability |
| ID | Locale | What it checks |
|---|---|---|
i18n-rtl | ar-SA | dir="rtl", logical CSS properties, Arabic fonts |
i18n-cjk | ja-JP | CJK font stack, line-breaking, ruby annotations |
i18n-mixed | hi-IN | Devanagari fonts, ligatures, diacritics |
| ID | Engine | What it checks |
|---|---|---|
browser-webkit | WebKit | WebKit engine baseline |
browser-firefox | Gecko | -webkit-* without standard fallbacks, Gecko console errors |
browser-edge | Blink/Edge | Windows High Contrast, forced-colors, PWA manifest |
browser-legacy | IE11 compat | CSS custom properties, Grid, ES6+ in inline scripts |
| ID | Severity range | What it checks |
|---|---|---|
image-failure | warning / info | All images blocked — missing alt, missing width/height |
font-failure | warning | All web fonts blocked — fallback layout shift |
js-disabled | warning / info | JS off — blank content vs. <noscript> fallback |
reduced-motion | warning | prefers-reduced-motion: reduce — animations still running |
offline | info | Service worker absent, no offline fallback page |
broken-links | warning / info | Same-origin links probed — 404/410/5xx/auth |
network-resilience | warning | All XHR/fetch aborted — page errors or blank content |
security-hygiene | warning / info | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, mixed content |
form-resilience | warning / info | Empty form submit — validation feedback present/absent |
Every finding carries at least one piece of verified evidence (screenshot, dom, request, header, metric, axe, console). The engine refuses to raise a finding without proof.
| Situation | Severity | Confidence |
|---|---|---|
| Missing alt attribute | warning | observed |
| Font fallback layout shift | warning | measured |
| JS-disabled blank page, no noscript | warning | observed |
| Animations under reduced-motion | warning | observed |
| No service worker / offline fallback | info | observed |
| 404/410/5xx same-origin link | warning | observed |
| 401/403/429 link (inconclusive) | info | observed |
| Missing CSP / X-Frame-Options / HSTS | warning | observed |
| Missing X-Content-Type-Options / Referrer-Policy | info | observed |
| Form submits without validation | warning | heuristic |
Rule: Findings with heuristic confidence may never exceed warning severity.
curl -X POST http://localhost:3000/api/test \
-H "Content-Type: application/json" \
-d '{
"url": "https://example.com",
"profiles": ["image-failure", "security-hygiene", "broken-links"],
"concurrency": true,
"concurrencyAmount": 2,
"includeScreenshots": true
}'
hauntview/
├── VERSION # Single source of truth for workspace version
├── bin/
├── dist/ # Compiled standalone CLI bundle (dist/cli.js)
├── scripts/
│ ├── bump-version.mjs # Version rollover bump engine
│ ├── check-version.mjs # Carrier sync validation
│ ├── build-cli.mjs # esbuild CLI packager
│ └── postinstall.mjs # Safe browser setup hook
├── src/
│ ├── version.ts # Exported version constant
│ ├── types/
│ │ ├── contracts.ts # Zod schemas + CanonicalFinding
│ │ ├── finding-utils.ts # buildFinding, assertions
│ │ ├── profiles.ts # Profile types
│ │ └── results.ts # Report types
│ ├── core/
│ │ ├── browser-pool.ts # Playwright pool
│ │ ├── screenshot-manager.ts
│ │ ├── finding-classifier.ts
│ │ ├── profile-manager.ts # 25 profiles configured
│ │ ├── visual-diff.ts # pixelmatch ectoplasm diff
│ │ ├── report-store.ts # SQLite persistence
│ │ ├── system-capability.ts # Hardware assessment & heuristic
│ │ ├── platform.ts # Cross-platform Windows/Unix abstractions
│ │ └── concurrency-resolver.ts # Priority resolver & hosted guard
│ ├── cli/ # HauntView CLI
│ │ ├── index.ts # Entrypoint & command routing
│ │ ├── runner.ts # haunt <url> runner & reporters
│ │ ├── setup.ts # haunt setup interactive wizard
│ │ ├── doctor.ts # haunt doctor diagnostic
│ │ ├── browsers.ts # Playwright browser verification
│ │ └── config.ts # Persistent config store
│ ├── profiles/ # 25 profile implementations
│ ├── reports/ # HTML, Markdown, and Zip export pipeline
│ ├── mcp/ # MCP server (stdio / SSE)
│ └── engine.ts # Master orchestrator with settled pool
├── app/ # Next.js Victorian Parlour Web UI
│ ├── api/test/route.ts # REST API with hosted concurrency guard
│ ├── lib/crypt-store.ts # Private localStorage Zustand store
│ ├── components/ # Kiroween design system components
│ └── docs/ # Interactive developer manual
├── docs/
│ ├── ARCHITECTURE.md # Architecture specification
│ ├── CLI.md # Comprehensive haunt CLI guide
│ ├── CONCURRENCY.md # Concurrency architecture & benchmarks
│ ├── CONTRACTS.md # Auto-generated contract reference
│ └── KIRO_USAGE.md
├── power/ # Kiro Power bundle (plugin.json, skills)
├── jest.config.js
└── package.json
MIT — see LICENSE file.
HauntView demonstrates comprehensive spec-driven development with Kiro: Zod contracts, steering documents, hooks, property-based tests, and MCP integration — all in a single local-first tool.
FAQs
Local-first website resilience, accessibility, failure-mode and visual regression testing with Playwright and MCP.
The npm package hauntview receives a total of 1,773 weekly downloads. As such, hauntview popularity was classified as popular.
We found that hauntview demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Threat Research
/Security News
Compromised maintainer accounts pushed malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2, reusing SleepyDuck’s Ethereum-addressed C2 infrastructure.
Security News
Socket has released a free Certified Patch for a critical Rails Active Storage vulnerability, giving developers time to upgrade to a secure Rails version.
Security News
/Threat Research
A malicious Ruby gem runs a credential-stealing worm during installation, poisons AI coding tools, and can wipe files when a stolen GitHub token is revoked.