allthepossibles.com

Check a page's HTML/CSS/copy/interaction for the patterns that make AI-generated work read as generic: default fonts, soft tech gradients, pill+arrow buttons, eyebrow labels, a composition with no real width/background variation across sections, uniform card grids, copy tells (AI vocabulary, negative-parallel framing, hedge words, heavy em-dash use), and experience gaps (a diagnosis with no next step, dead-end links).

Check marketing or outreach copy (an email, a landing-page draft, a pitch, a social post) for the tells that make it read as AI-generated: cliché vocabulary (delve, unlock, empower, seamlessly integrate, etc.

Check a source file or diff for AI 'tells' left in comments: narrating fulfilling a request instead of describing the code ("as requested," "I've added," "here's the updated version") and hedge words.

Check an MCP server for real risk signals before trusting it: unauthenticated transport, capability overreach (filesystem/shell/credential access with no scoping), and known-bad signatures.

Check a document or web page for hidden instructions before an agent reads, summarizes, or acts on it: invisible Unicode, obfuscated payloads, and (on Pro) a semantic pass for prompt-injection phrasing aimed at the model instead of the human reader.

Check a VS Code extension or a Claude Skill before installing or trusting it.

Check a structured output you're about to return or act on for degenerate-answer patterns a schema check can't see: invalid JSON, a placeholder value ('TBD', 'N/A', 'unknown') where a real answer should be, an array of byte-identical items (a common symptom of a loop that never advanced), or an expected field that's missing or empty.

Check a page's real Core Web Vitals: Google's Chrome UX Report field data (real users, 28-day window) plus a live Lighthouse lab run.

Check text for AI-writing tells (em-dashes, 'not just X but Y', rule-of-three lists, stock vocabulary like delve or seamlessly, hedge words, smart quotes, hidden Unicode) and return a score, each tell with its position, and a cleaned copy.

Estimate what an MCP server's tools/list costs in tokens on every session start, per tool, with the three most expensive tools and flags for oversized descriptions, base64 blobs and echoed schemas.

Lint a CLAUDE.

Generate install snippets for an MCP endpoint (Claude Code, Claude Desktop, Cursor, Codex, VS Code, curl) and probe the endpoint once to confirm it answers initialize and tools/list.

Read a site's robots.

Fetch a URL once and grade its response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, frame control, Referrer-Policy, Permissions-Policy, Cache-Control, cookie Secure/HttpOnly/SameSite flags, and server version leaks.

Fetch a URL and report what crawlers and link unfurlers see: title and meta description with lengths, canonical, lang, viewport, robots meta, h1s, Open Graph and Twitter card tags, favicon, JSON-LD types, the resulting preview card, and findings for anything missing or too long.

Turn a JSON sample (or an array of samples of the same shape) into a JSON Schema draft 2020-12 and a TypeScript type.

Explain a five-field cron expression in plain English, list the next runs in UTC, and warn about the cases Cloudflare Workers, GitHub Actions and crontab handle differently (nicknames, six fields, day-of-month plus day-of-week, sub-5-minute intervals, day 31).

Scrub a .

Trace a URL's redirect chain hop by hop (up to 10 hops, 8 s each) with status, location, timing and scheme per hop.

Check a site's sitemaps: discovers them from robots.

Decode a JWT's header and payload without verifying the signature (it never takes a secret).

Adversarial critique of a design, given as a description or a screenshot URL, with an optional PRD.

Generates the state space for a feature, form or screen across data, loading, permission, network, account, content, time, concurrency, outside dependencies, money, consistency and people, and lists the gaps most likely to cause real harm.

Breaks a user objective into the stages of a real journey and flags entry points and exit paths that have no designed arrival or recovery.

Per-string critique of interface copy: buttons, errors, empty states, confirmations, notifications.

Reads a PRD or design brief and extracts the unverified assumptions inside it, ranked by risk, each turned into a research question that could change a decision.

Finds concepts that carry different names across surfaces (UI strings, docs, API reference, support macros) and flags drift.

Check colour contrast.

Audit one page's static HTML for accessibility problems and name the WCAG 2.

Build a Nielsen ten-heuristics review worksheet for a screen or flow.

Look for the default AI-generated design look in a live page's markup and CSS: purple-to-blue gradients, gradient text, a default font stack, pill buttons with arrows, uppercase eyebrow labels, emoji headings, glassmorphism, glow blobs, equal card grids, stock marketing phrases and placeholder copy.

Review interface copy, one string per line, optionally prefixed with a type (button:, error:, empty:, tooltip:, placeholder:, heading:, toast:, label:).

Lint design critique.

Plan a design critique for a stage (concept, wireframe, visual, prototype, build, shipped): a framing statement, timed agenda, the questions that fit the stage, roles, and the kinds of feedback to turn away until a later stage.

Lint user research questions, one per line, for leading wording, double-barrelled questions, hypotheticals, predictions, loaded words, jargon, closed questions in an open interview, why-questions and unlabelled rating scales, with a suggested rewrite for each problem.

Usability arithmetic with formulas shown.

Lint a product analytics tracking plan (event names with optional properties, one per line like 'project_created (template, source)') for mixed naming styles, vague events, UI-element names, near-duplicate events, tense and order drift, and personal data in property names.

Pro.

Take a design token file (CSS custom properties like --color-text: #111;, a JSON object of colours, or W3C design tokens) and test every foreground-like token against every background-like token for 4.

Pro.

Explain what this server can do and suggest the three best first tasks for what the person has (a Figma link, a live URL, copy, a research plan, an event list).

Show the caller's plan (Free or Pro) and how many calls remain today on each tool.

Check target sizes and spacing against WCAG 2.

Lint design token names from a list, CSS variables or a JSON token file: mixed separators, colours named by hue where roles belong, values or locations in names, version words, duplicate values, abbreviation drift (bg and background) and irregular scales.

Score a DESIGN.

Diagnose setup problems.

Pro.

Pro.