Crawde Review Standard v2

Scoring Breakdown

Grading

Category Details

Engineering Metrics (New in v2)

Every v2 review includes a dedicated Engineering Metrics table with measured data points:

• • Load Time (ms) — measured from request to response
• • HTTPS — yes/no
• • Compression — gzip/brotli detected from Content-Encoding
• • Cache Headers — Cache-Control or ETag present
• • Security Headers — count of 6 key headers detected
• • SEO Elements — count of 9 key elements detected
• • Alt Text Coverage — images with alt text vs total images
• • ARIA Labels — count found in page source
• • Privacy Policy / Terms of Service — link detected on page

Review Process

1. 1. Submission — A URL is submitted via the API or web form.
2. 2. Crawling — The engine fetches the main page and discovers up to 10 subpages via link analysis.
3. 3. Page Analysis — Each page is analyzed for structure, content, forms, buttons, links, headings, load time, HTTPS, console errors, security headers, SEO elements, compression, caching, and accessibility indicators.
4. 4. Feature Discovery — Features are auto-discovered from navigation, headings, CTAs, pricing, and page content. Each is cross-referenced against actual functionality.
5. 5. AI Evaluation — All collected data (including measured engineering metrics) is evaluated by GPT-4o following the v2 scoring rubric.
6. 6. Report Generation — A structured markdown report is generated with scores, findings, and recommendations.
7. 7. Delivery — Results are available via API, web view, and optionally delivered via webhook callback.

API

Submit a Review

POST https://crawde.com/api/reviews
Content-Type: application/json

{
  "url": "https://yoursite.com",
  "callbackUrl": "https://yoursite.com/api/crawde-review",
  "callbackSecret": "your-secret",
  "email": "you@example.com"
}

Response (202 Accepted):
{
  "id": "review-uuid",
  "status": "pending",
  "checkUrl": "https://crawde.com/api/reviews/{id}",
  "viewUrl": "https://crawde.com/reviews/{id}"
}

Callback Webhook Payload

POST {callbackUrl}
Content-Type: application/json
X-Crawde-Event: review.completed
X-Crawde-Signature: hmac-sha256-hex (if secret provided)

{
  "event": "review.completed",
  "reviewId": "...",
  "url": "https://yoursite.com",
  "status": "completed",
  "overallScore": 85,
  "grade": "B",
  "verdict": "One-line summary",
  "markdownReport": "# Full markdown report...",
  "sections": [...],
  "progressAnalysis": {
    "claimedFeatures": [...],
    "testedFeatures": [...],
    "untestedFeatures": [...],
    "accuracyPercent": 80
  },
  "commonSenseCheck": {
    "passed": true,
    "notes": [...]
  }
}

Receive Reviews: Endpoint Implementation

To automatically receive reviews, implement a POST endpoint on your server. The endpoint should:

• • Accept POST requests with JSON body
• • Verify the X-Crawde-Signature header using HMAC-SHA256 with your callback secret
• • Return 200 to acknowledge receipt

Code Patch Protocol (CPP)

The Code Patch Protocol is an optional extension that allows Crawde to go beyond reviewing and actually generate code patches to fix identified issues. The protocol uses end-to-end encryption so that source code is never exposed in plain text during transit.

1. Well-Known Configuration

Serve a JSON file at /.well-known/crawde-review:

{
  "patchEnabled": true,
  "codeEndpoint": "/api/crawde/code",
  "patchEndpoint": "/api/crawde/patch",
  "publicKey": "<your ECDH P-256 public key, base64>",
  "signingPublicKey": "<your ECDSA P-256 public key, PEM>"
}

2. Code Endpoint

Crawde sends a POST with its public keys. Your server should respond with encrypted source files:

// Request from Crawde
POST /api/crawde/code
{
  "crawdeEcdhPublicKey": "<base64>",
  "crawdeSigningPublicKey": "<PEM>"
}

// Your response
{
  "ecdhPublicKey": "<your ECDH public key, base64>",
  "signingPublicKey": "<your ECDSA public key, PEM>",
  "payload": {
    "ciphertext": "<AES-256-GCM encrypted JSON of files, base64>",
    "iv": "<initialization vector, base64>",
    "authTag": "<GCM auth tag, base64>",
    "signature": "<ECDSA signature of ciphertext, base64>",
    "signerPublicKey": "<PEM>",
    "contentHash": "<SHA-256 hex of plaintext>"
  }
}

The encrypted plaintext should be a JSON array: [{"path": "src/app.ts", "content": "..."}]

3. Patch Endpoint

Crawde sends encrypted patches back to your server:

// Crawde sends
POST /api/crawde/patch
{
  "crawdeEcdhPublicKey": "<base64>",
  "crawdeSigningPublicKey": "<PEM>",
  "payload": {
    "ciphertext": "<encrypted patch array, base64>",
    "iv": "<base64>",
    "authTag": "<base64>",
    "signature": "<base64>",
    "signerPublicKey": "<PEM>",
    "contentHash": "<hex>"
  }
}

// Decrypted payload structure:
[
  {
    "path": "src/app.ts",
    "patch": "--- a/src/app.ts\n+++ b/src/app.ts\n@@ -10,3...",
    "explanation": "Fix: Added null check for user input"
  }
]