Know beforeyour clients do.

I build free, open-source tools that check a site after every change and show what broke.

Install the set
  • macOS, Linuxcurl -fsSL https://rythm.sh/install | sh
  • Windowsirm https://rythm.sh/install.ps1 | iex

Every download is checked against signed checksums.

How to verify (opens in a new tab)

TunerIs my site safe?

Finds leaked secrets, exposed files, known CVEs and weak configuration on WordPress and PHP sites.

Detects, never exploits. Masks secrets it recognises.

Start
  • rhythm tuner scan yoursite.com

Tuner Source on GitHub (opens in a new tab)AGPL-3.0

Tuner scanning a test site on this machine: an exposed .env file with its two secrets named and masked, an exposed debug log, plain HTTP and missing headers, scored 41 of 100.
SoundcheckDid my change break anything?
Snapshots your site in a real browser, then shows what broke after an update or deploy.
Errors, dead buttons, forms, cache leaks, keyboard traps, layout and speed.
Start
  • rhythm soundcheck snapshot staging.yoursite.com
  • rhythm soundcheck compare --open
Soundcheck Source on GitHub (opens in a new tab)MIT
Soundcheck comparing a test site after an update: an Add to cart button that no longer does anything, a new JavaScript error on five pages and a new block at the top of three.
EchoIs my site still saying what it should?
Captures every email, SMS, webhook and API call your site sends, then shows what changed after an update.
Seals staging from real people. Shows what fires before cookie consent. WordPress, Laravel and Next.js.
Start
  • rhythm echo up
  • rhythm echo install wordpress /var/www/staging
Echo Source on GitHub (opens in a new tab)MIT
Echo comparing a test site after an update: three broken messages, a contact form email that is no longer sent, an SMS with an unfilled name placeholder and a webhook that lost three fields.
SightreadWhat will this update really change?
Reads each plugin, theme, Composer and npm update against its official source.
Ranks what is new in plain words. Never runs the code.
Start
  • rhythm sightread all /var/www/yoursite
Sightread Source on GitHub (opens in a new tab)MIT
Sightread reviewing three plugin updates on a test site: two routine and one on hold, where a new owner added a daily task that sends site data to a new host and runs the code it gets back.
RoadieIs my staging a safe copy of production?
Copies production to staging with every customer pseudonymised, live keys swapped and side effects off.
Then checks the finished copy and signs a pass or fail report.
Start
  • rhythm roadie demo
  • rhythm roadie plan --from shop.sql --to staging.sql
Roadie Source on GitHub (opens in a new tab)MIT
Roadie copying a made-up shop to staging, then checking the copy: no real-looking emails, phones, names or addresses, no live keys and no production URLs left, a pass with nothing found.
Also open source
tacetWhy is Claude Code rereading all that?
Makes Claude Code use fewer tokens on any project.
Same answers, lower cost, every saving measured.
Install tacet
  • macOS, Linuxcurl -fsSL https://rythm.sh/tacet/install.sh | sh
  • Windowsirm https://rythm.sh/tacet/install.ps1 | iex
  • npmnpm i -g @rhythmsh/tacet
Start
  • cd your-project && tacet init
tacet Source on GitHub (opens in a new tab)Read the noteMIT
Contribute
Issues, pull requests and discussions are welcome on each tool.
The tools find it.The workflow fixes it.
Discuss a workflow