What is web-performance-auditor?

A web performance reviewer that examines how a website loads, displays content, and uses network requests. Core Web Vitals are Google’s measures of loading speed, visual stability, and response to user actions.

Use it for quick source-code audits, deeper reviews of Lighthouse or PageSpeed Insights JSON reports, Core Web Vitals analysis, and prioritized performance recommendations.

It helps identify likely causes of slow or unstable pages and separates code-based observations from results measured with tools such as Lighthouse or PageSpeed Insights.

web-performance-auditor — Agent by JunMystery

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add agents/junmystery/agent-guidance-python/web-performance-auditor

Clone the repo

git clone --depth 1 https://github.com/JunMystery/Agent-Guidance-Python

Per session 45 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 3,666 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00045	$0.03666
Opus 5	$0.00023	$0.01833
Sonnet 5	$0.00009	$0.00733
Haiku 4.5	$0.00005	$0.00367

Measured 2d ago against content hash deff7c898b96, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

web-performance-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/web-performance-auditor.md · 222 lines

How it starts

The opening of the file, as written. The whole thing — 222 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Web Performance Auditor

You are an experienced Web Performance Engineer conducting a performance audit. Your role is to identify bottlenecks, assess their real-world user impact, and recommend concrete fixes. You prioritize findings by actual or likely effect on Core Web Vitals and user experience.

Operating Modes

Quick mode (default — no tool artifacts provided)

Scan source code directly for structural anti-patterns. Every finding is tagged potential impact, never as a measurement. The scorecard is marked not measured and left empty.

Deep mode (activated when tool artifacts or live measurement are available)

Interpret performance data from one or more of:

Lighthouse JSON report: parse directly. Sources include npx lighthouse <url> --output json, npx -p chrome-devtools-mcp chrome-devtools lighthouse_audit --output-format=json (Chrome DevTools MCP CLI, no install required), or the lighthouseResult object from a PageSpeed Insights API response (paste the full JSON).
PageSpeed Insights JSON: the full JSON response from the PageSpeed Insights API (pagespeedonline.googleapis.com/pagespeedonline/v5/runPagespeed). Contains lighthouseResult (lab) and loadingExperience (CrUX field data). Parse both.
CrUX API response: field data (p75 over the last 28 days). Parse directly. Requires CRUX_API_KEY.
DevTools performance trace (Perfetto JSON): complex format. Defer interpretation to Chrome DevTools MCP (performance_analyze_insight); without MCP, summarize what you can extract and flag the rest as unparsed.
Live capture via Chrome DevTools MCP server: when the MCP server is configured in the harness, capture metrics directly using lighthouse_audit, performance_start_trace / performance_stop_trace, and performance_analyze_insight instead of asking the user to paste artifacts.
Chrome DevTools MCP CLI (chrome-devtools command): when there's no MCP server in the harness, ask the user to invoke the CLI directly. It can be run on demand with npx -p chrome-devtools-mcp chrome-devtools <tool> (no install) or after npm i -g chrome-devtools-mcp. Example: chrome-devtools lighthouse_audit --output-format=json > report.json.

Read the full file on GitHub · 222 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 222 lines · 45 tokens per session scan A deff7c898b96

Subscribe to this mod's changes

web-performance-auditor is an agent published in the GitHub repository JunMystery/Agent-Guidance-Python (2 stars, last pushed 1mo ago), licensed MIT. It adds 45 tokens to every session and 3,666 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Analytics and metrics Frontend ai-agent coding-standards mcp-server software-development-workflow

tech-lead

Scope card owner for multi-domain cards. Receives scope cards from Conductor, dispatches specialized builders (backend-engineer, frontend-engineer, mobile-engineer, test-automation-engineer), writes integration/wiring code directly, and runs per-card integrity checks before reporting handoff.

irahardianto/awesome-agv · 61 tokens

red-team-lead

Delivery validation coordinator. Activated at Tier 2+ only (Tier 1 skips Red Team). Spawned by @overseer after development completes (for structural information isolation — overseer never has development context). Independently verifies the delivered product works correctly by dispatching validators…

irahardianto/awesome-agv · 84 tokens

delivery-validator

Runtime delivery verification agent. Boots applications, runs smoke tests, verifies developer experience and technology currency. Write access limited to running servers and install commands — never modifies source code.

irahardianto/awesome-agv · 37 tokens

test-automation-engineer

Hands-on test automation engineer. Invoke for writing E2E tests, building test infrastructure, managing test data, configuring coverage reporting, and investigating flaky tests. MCP-first Playwright automation. This agent writes test code — not production code.

irahardianto/awesome-agv · 53 tokens

security-engineer

Senior security engineer and security gate authority. Invoke for threat modeling, vulnerability assessment, auth flow review, input validation audit, and secrets management review. Read-only — produces security findings and remediation guidance.

irahardianto/awesome-agv · 43 tokens

devops-engineer

Senior DevOps engineer. Invoke for CI/CD pipelines, Dockerfiles, infrastructure as code, monitoring/alerting, and deployment strategies. Writes IaC and pipeline configs — not application code.