airing — see what your deploy hangs out in public

1

The same line, as the CLI prints it

The garments above are this exact report: airing's scanner, bundled into this page, run on the sample project for the host you picked. No fixtures — click another host tag and this text changes too.

…

exactly what airing prints in your terminal · swipe the report →

2

Which host hangs out what

Every host CLI has its own idea of what to skip, and none of them read your .gitignore. These cells are computed live by airing's hostFilter(), a port of each CLI's real walker — every host name links to the upstream source it follows.

default behaviour when the folder you deploy contains these paths · swipe the table →

on the line served at a public URL · uploaded sent to the host's build machine, served only if your build copies it · basket skipped by the host

3

Before: stop the agent at the door

Coding agents run wrangler pages deploy . because it works. Give Claude Code a PreToolUse hook and airing reads every deploy command first: if the upload set would leak, the command is denied with the list and the fix. Clean deploys go through silently.

// once, so the hook starts in ms:
// npm i -g https://github.com/Blackman99/airing/releases/latest/download/airing.tgz
// .claude/settings.json
{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "command": "airing hook"
      }]
    }]
  }
}

Any other agent, or a human: put airing guard -- in front of the deploy. It scans exactly what that command would upload and runs it only if nothing leaks.

npx github:Blackman99/airing guard -- wrangler pages deploy dist

4

After: look up from the street

airing probe is the passer-by: it GETs about forty well-known paths on your live site (/.env, /.git/config, /backup.sql, source maps of the page's own scripts…), fingerprints the soft-404 first so an SPA's catch-all never counts as a hit, and reports names and fingerprints — never values. We keep a deliberately leaky page up so you can watch it work:

npx github:Blackman99/airing probe \
  https://blackman99.github.io/airing/leaky-demo/

Only probe sites you own. If it finds a key, rotate the key first — deleting the file doesn't un-download it.

5

In CI, and for agents over MCP

# after your build step
- uses: Blackman99/airing@v0
  with:
    path: .
    # optional, after deploy:
    probe-url: https://my-site.pages.dev

{
  "mcpServers": {
    "airing": {
      "command": "npx",
      "args": ["-y", "github:Blackman99/airing", "mcp"]
    }
  }
}

Read-only tools: scan_deploy, probe_url, host_rules.