mobius-page-audit

mobius-page-audit

A page's source tells you what it was written to do. This tells you what it does — including the requests fired by analytics tags, embedded widgets and third-party scripts that no one on the team wrote, and the controls that look fine but can't actually be operated.

When to use this

• Reviewing a page before it ships.
• "What is this page sending to third parties?" — analytics, pixels, session recorders, chat widgets.
• Checking whether anything sensitive is leaving in a request body.
• Verifying that a page's interactive elements are actually reachable.

Workflow

1. mobius_diagnose. If it isn't ready, relay the remediation and stop.
2. clear_logs, then load the page fresh — navigate_to followed by wait_for_navigation, so you capture the full load, not the tail of it.
3. get_capture_settings before drawing any conclusion from a quiet result. An empty network list because the category is off is not a clean page.

Third-party traffic

1. get_network_requests and group by origin. Anything not on the app's own domain is third-party — analytics, tag managers, ad/marketing pixels, session recorders, embedded chat, font and CDN hosts.
2. For each third-party destination, read the actual requestBody rather than assuming what a vendor collects. Look specifically for: full page URLs including query strings, referrer chains, user or account identifiers, email addresses, form field values, and anything that looks like a session token.
3. Note the ones that fire before any consent interaction — a tag that loads before the banner is answered is usually a compliance problem, not a preference.
4. export_har if the finding needs to be shared or attached.

What the page reports about itself

1. get_recent_errors for uncaught errors and unhandled rejections during load, and get_recent_logs for warnings worth surfacing — deprecations, CSP violations, failed resource loads, noisy debug output that shipped by accident.
2. Distinguish errors thrown by the app from errors thrown inside a third-party script. The second kind is still your problem if it breaks the page, but the fix is different.