API and endpoint integrity audit across 10 dimensions (D1-D10) plus optional contract stability (D11) and optional OWASP API Security Top 10 (D12: BOLA/BOPLA/BFLA, mass assignment, JWT alg-confusion, GraphQL introspection). Covers validation, payloads, pagination, errors, caching, HTTP semantics, waterfalls, rate limiting, auth, documentation, and API-specific authorization security. Supports NestJS, Cloudflare Workers, FastAPI, and frontend call patterns. Optional GET probing on non-production targets. Flags: zuvo:api-audit full | [path] | --static | --security

CI/CD pipeline audit for speed, cost, reliability, and security. 10 dimensions (CI1-CI10): caching, parallelism, conditional execution, artifacts, secret handling, action pinning, timeouts, Docker optimization, test integration, and pipeline speed. Primary support: GitHub Actions. Detection-level: GitLab CI, CircleCI. Switches: zuvo:ci-audit full | [path] | --speed-only | --security-only

Apply fixes from content-audit findings. Reads audit JSON, classifies fixes by safety tier (SAFE/MODERATE), applies templates per fix type. Handles encoding artifacts (NBSP, mojibake), broken markdown, CMS migration debris, and typography issues. Modes: default (SAFE only), --auto (SAFE+MODERATE), --dry-run, --finding CC1-nbsp-present, --fix-type encoding-strip.

Database performance and safety audit. 70+ checks across 13 dimensions (DB1-DB13): query patterns, indexes, schema design, connections, transactions, migrations, caching, query optimization, ORM anti-patterns, observability, data lifecycle, DB security, and migration deployment safety. Code-level checks for all ORMs. Optional live analysis via PostgreSQL or MySQL connection. Switches: zuvo:db-audit full | [path] | [file] | --schema | --queries | --connections | --live <conn>

Process code review feedback with technical rigor. Activates when the user shares review comments, PR feedback, or asks to address reviewer suggestions.

Select refactor candidates with immutable git measurements, evidence-backed module families and temporary collision checks. Use for ranked refactor/test-debt triage, not implementation. DISCOVER saves reports without changing product code; REGISTER requires validated decisions. Worktree names are hints, test LOC is not coverage, and discovery scores are not execution priorities.

Test suite performance audit and optimization. Measures baseline timing, audits runner configuration against TP1-TP17 checklist, identifies the slowest tests, and produces an impact-ranked action plan. Modes: full audit (default), baseline (measure only), verify (compare to saved baseline), --no-run (config audit only), --path <dir> (monorepo scope).

Multi-agent UI review with 4 specialist perspectives: UX Researcher, Visual Designer, i18n/Multilingual QA, and Accessibility/Performance Auditor. Each agent scores independently from their expertise. Lead Designer synthesizes into prioritized fixes with exact code. Works with any stack: React, Astro, vanilla HTML/CSS, Tailwind, CSS-in-JS. Flags: [file/path], --screenshot, --mobile, --fix.

Free-tier B2B contact discovery orchestrator. Runs a 7-phase pipeline with interactive checkpoints, parallel-agent dispatch, graceful degradation when tools are missing, and atomic output writes.