Home

Welcome to the documentation for rhythm (one CLI for every Rhythm tool) and for the three tools that run on it: Tuner, the WordPress & PHP security scanner; Soundcheck, which checks a whole site before and after a change and shows what broke; and Echo, which captures everything a site sends, seals staging so nothing reaches real people and shows what each form or order sends before and after a change. Everything lives here; the tools' READMEs link back to these pages.

The Rhythm set: safe, works, says

Tool	Asks	Looks at	Start with
🔒 Tuner	Is my site safe?	what an attacker can find: leaks, known vulnerabilities, weak config	Your first scan
✅ Soundcheck	Does it still work?	what visitors see and do: errors, layout, forms, cache, speed	Your first check
📣 Echo	Is it still saying what it should?	everything the site sends: email, SMS, webhooks, chat, analytics, payments	Your first run

They work on the same change: Tuner says a plugin needs updating, Soundcheck shows what the update did to the pages and Echo shows what it did to the messages. Run Soundcheck with --echo and it submits the real forms and compares what each one sent.

Start in one minute

macOS · Linux	Windows (PowerShell)
curl -fsSL https://rythm.sh/install | sh	irm https://rythm.sh/install.ps1 | iex

rhythm tuner scan yoursite.com                    # what's out of tune: leaks, CVEs, weak config
rhythm soundcheck snapshot staging.yoursite.com   # before a change: record how every page works
rhythm soundcheck compare                         # after it: what broke
rhythm echo up                                    # seal staging: nothing the site sends reaches anyone
rhythm echo compare                               # after a change: what the site no longer sends

New here? For security, follow Your first scan. Before your next plugin update or deploy, follow Your first check. To seal a staging site and check its emails, SMS and webhooks, follow Your first run.

Find your way

Get started Install Updating Uninstall Verifying releases	Use Tuner Overview Your first scan Reading results Choosing checks Requests and politeness Output and reports Batch scans Local scans	Tuner in depth Known vulnerabilities PHP advisories CI and code scanning Writing checks Check packs Finding reference CLI reference FAQ and troubleshooting	Use Soundcheck Overview Your first check Reading results Discovery Page health Visual changes Interactions Forms and flows Cache Speed CI Configuration CLI reference FAQ and troubleshooting Benchmark
Use Echo Overview Your first run Connectors Sealing staging Messages and checks Actions and compare With Soundcheck Replay Deliverability	Echo in depth CI Configuration API CLI reference FAQ and troubleshooting Benchmark

Current PHP advisories

Important

PHP2Shell (CVE-2026-109618, CVE-2026-109619) and CVE-2026-115560 (session upload progress) affect PHP itself, so every WordPress and PHP site is in scope. See PHP advisories for what to check and how Tuner covers each one.

The project

Responsible use	check only sites you own or may test; what the tools never do; personal data in Echo's captures
Security policy	report a vulnerability in Rhythm, Tuner, Soundcheck or Echo privately
Contributing	set up, commit conventions, pull requests
Release process	how releases, check packs and Echo's npm and Composer packages ship
Architecture	how rhythm, the kit and the tools fit together

Repositories: rhythm · tuner · soundcheck · echo · community files