# Backwatch features

What Backwatch does today in the free CLI, and the one thing that's coming.

## Sign-in, the way each host does it

Backwatch follows the chain a host walks before a login page: the 401 challenge, protected-resource metadata, the authorization server and PKCE. On your own server, --register proves each host's callback can register, and lists every client it created.

[How each host signs in](https://backwatch.dev/hosts.md)

## 132 checks, four questions

Can agents read your site, find your server, sign in and call tools, and find you where they look? Every verdict comes with the evidence it was reached on. A check that can't be resolved is shown as unresolved and left out of the score.

[Every check](https://backwatch.dev/checks.md)

## A fix prompt for every failure

Each failing check comes with plain text you paste into Claude Code, Codex or Cursor: what the scan saw, what good looks like, and how to verify the fix.

[See a sample report](https://backwatch.dev/r/sample.md)

## Fail the deploy that breaks sign-in

The first run writes a baseline. After that the job fails only when a check gets worse, so existing gaps don't block you. The report lands in the run's summary.

[Set up the CI gate](https://backwatch.dev/ci.md)

## One page per question

MCP Inspector, the sign-in checker, the llms.txt checker and nine more. Each runs a focused set of checks, from your terminal today and from the page at launch.

[All free tools](https://backwatch.dev/tools.md)

## Watched every day

The hosted monitor will run the same checks on a schedule and tell you when one breaks, and whether it was your deploy or the host. Join the waitlist to hear when it's ready.