GitHub Packages · MIT · Node ≥ 18
Inventory every third-party tracker, pixel and SDK your built static site loads, with vendor, company and category, and gate CI on an approved-vendor list.
Inventory the third-party trackers, pixels and SDKs on your built static site: 45 known vendors with company and category (advertising, analytics, session replay, social, tag managers), unknown domains, tracking pixels, approved-vendor gate, JSON/CSV inventory. SARIF, allowlist with expiry, GitHub Action. Zero deps.
1 Point the @mrlouiswright scope at GitHub Packages in .npmrc
@mrlouiswright:registry=https://npm.pkg.github.com2 Install
npm i -D @mrlouiswright/tracker-wardenPublished to GitHub Packages, not npmjs.com. GitHub Packages needs a GitHub token with read:packages to install, even for public packages: add //npm.pkg.github.com/:_authToken=${GITHUB_TOKEN} to .npmrc or run npm login --registry=https://npm.pkg.github.com.
$ npx tracker-warden dist --base-url https://acme.exampletracker-warden — https://acme.example2 page(s); 10 third parties: advertising, analytics, fonts, other, session-replay, social, tag-manager, unknown, video MEDIUM about.html:1 LinkedIn Insight Tag (LinkedIn) [advertising, sells/shares data] on 1 page(s), e.g. /about.html [tracker-advertising] ↳ fix: Make sure it is disclosed in your privacy policy and only loads after consent.MEDIUM about.html:1 AddThis (Oracle) [social, sells/shares data] on 1 page(s), e.g. /about.html [tracker-social] ↳ fix: Make sure it is disclosed in your privacy policy and only loads after consent.MEDIUM index.html:3 Tracking pixel for Meta Pixel (Meta) on 1 page(s), e.g. / [tracker-pixel] ↳ fix: Load pixels only after consent, or remove them.MEDIUM index.html:3 Meta Pixel (Meta) [advertising, sells/shares data] on 1 page(s), e.g. / [tracker-advertising]
Privacy notices, cookie banners and DPIAs all start with the same question: which third parties does the site actually load? Tags get added through templates, CMS embeds and marketing snippets, and the list drifts. tracker-warden reads every built HTML page, finds third-party scripts, inline SDK snippets (“fbq(”, “gtag(”, _hsq, ...), tracking pixels, iframes, stylesheets and media, matches them to a vendor database, and produces an inventory plus findings with the file, line, severity and a concrete fix.
CLI, library and GitHub Action. Node.js 18+, zero runtime dependencies. Works on any static build output (Astro, Next.js “output: 'export'”, Eleventy, Hugo, Jekyll, Docusaurus, VitePress, plain HTML) and runs offline: point it at the folder your build writes. By Louis Wright.
45 common vendors (Google Analytics/Ads/Tag Manager, Meta, TikTok, LinkedIn, X, Pinterest, Snap, Microsoft, Criteo, Taboola, Hotjar, Clarity, FullStory, Mixpanel, Segment, Amplitude, Heap, Plausible, Fathom, HubSpot, Intercom, YouTube, Vimeo, Google Fonts, Stripe, reCAPTCHA, Cookiebot, OneTrust, AddThis, Disqus, ...) with company, category, whether the vendor sells or shares data and whether it is cookieless.
<script src>, inline snippets by signature, <iframe>, <link> stylesheets and resource hints, <img> pixels (1x1, hidden, inside <noscript>), media and embeds. Unknown third-party domains are reported too.
advertising, session replay and social widgets (medium), tracking pixels (medium), analytics/tag managers/marketing (low), unknown script domains (low), other third parties such as fonts, CDNs, video, maps, payments (info).
list your reviewed vendors in approved; anything else is reported high, and approved trackers drop to info.
--inventory vendors.json or vendors.csv for your records of processing, DPIA or privacy policy (see policy-drift-warden).
# Example
npx tracker-warden dist# Example
npx tracker-warden dist --inventory vendors.csv# Example
npx tracker-warden dist --approved plausible,stripe,google-fonts --fail-on high# Example
npx tracker-warden public --first-party cdn.example.net --format sarif > trackers.sarifpermissions:
contents: read
security-events: write # only needed for the SARIF upload
jobs:
tracker-warden:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
with: { persist-credentials: false }
- run: npm ci && npm run build # produce the static site first
- uses: MrLouisWright/tracker-warden@v1
with:
path: dist
fail-on: high
sarif: tracker-warden.sarif
- uses: github/codeql-action/upload-sarif@v3
if: always()
with: { sarif_file: tracker-warden.sarif }| Flag | Description |
|---|---|
| Site | |
--base-url <url> | Public URL of the site, e.g. https://example.com (default: inferred from canonical/og:url) |
--include <globs> | Only check these pages (file or URL path globs, comma-separated) |
--exclude <globs> | Skip these pages |
--clean-urls | Pages are served without .html (about.html -> /about) |
| Inventory | |
--inventory <file> | Write the vendor inventory as JSON, or CSV if the name ends in .csv |
--approved <vendors> | Approved vendor ids/names/domains; anything else is reported high |
--first-party <hosts> | Extra hosts that count as first party (your CDN, subdomains) |
| Common | |
-c, --config <file> | JSON config (default: .tracker-warden.json or "trackerWarden" in package.json) |
-f, --format <fmt> | text (default) | json | sarif | markdown |
--json <file> | Also write a JSON report |
--sarif <file> | Also write SARIF 2.1.0 |
--markdown <file> | Also write Markdown (e.g. for a job summary) |
--fail-on <sev> | critical | high | medium | low | info | none (default: high) |
--list-rules | Print rules and default severities |
--no-fixes | Hide fix suggestions in text output |
--no-color | Disable colours |
Full reference, config file format and API in the README.
Support this project
I build free, open-source tools that help developers ship safer websites. Every coffee helps keep them maintained, documented and free for everyone.
Buy me a coffee (opens Stripe in a new tab)Secure checkout by Stripe
