Pricing

from $750.00 / 1,000 trace set auditeds

Try for free

Go to Apify Store

OTel Instrumentation Coverage Auditor

Try for free

Find what isn't instrumented: dark dependencies, broken context propagation, uninstrumented time, missing resource metadata and log correlation gaps across a fleet of OpenTelemetry traces, with a prioritized fix plan.

Pricing

from $750.00 / 1,000 trace set auditeds

Rating

0.0

(0)

Developer

Justin Hagerty

Actor stats

Bookmarked

Total users

Monthly active users

11 days ago

Last modified

Changelog — OTel Instrumentation Coverage Auditor

0.1.0 — unreleased

Since the first draft

Storage input for large exports: traceDatasetId (one span or export document per item, up to 200,000 items), traceRecordKey + traceKeyValueStoreId (JSON or Collector JSON Lines text), and datasetId / recordKey / keyValueStoreId inside traceSets entries. Storage is read lazily, only for sets the budget covers. Unreadable storage produces a free failed item.
Baseline / regressions: baseline (previous dataset items or {services: {name: score}} summaries) and baselineDatasetId add data.regressions (score deltas, regressed/improved/new/missing services, new and resolved findings). Improvement-plan actions touching regressed services get 1.5× priority and list regressed_services.
clockSkewMs input (default 100 ms, 0–60,000) for propagation-break matching.
Billing: the budget check now covers the combined USD cost of a set's primary units plus the correlation check (via session.can_continue), so the correlation check is skipped when only the audit fits.
False-positive tuning, with healthy-fleet regression fixtures (healthy_fleets.json):
- Service-mesh proxy spans (Envoy / Istio / Linkerd) are collapsed instead of being reported as services (no more META/SCOPE/COV-PROP-010 findings for sidecars; calls through a mesh pair up again).
- Route coverage (COV-GAP-003) no longer counts an async consumer below a PRODUCER as the request's own remote call, and treats requests that are faster by about the skipped call's duration as cache hits.
- Instance comparison (COV-GAP-004) compares instances on the routes they both served.
- Standalone jobs (INTERNAL roots, no SERVER/CONSUMER spans) are no longer reported as isolated (COV-TOPO-008).
Span lists may now contain JSON / JSON Lines strings next to span objects.
SDK version table refreshed (2026-10 snapshot) and about 70 SaaS / managed-API host suffixes added (payments, messaging, identity, AI APIs, managed databases, observability backends).

Initial version

Trace parsers: OTLP/JSON ExportTraceServiceRequest (hex or base64 IDs, legacy instrumentationLibrarySpans, Tempo batches, JSON Lines from the Collector file exporter), Jaeger JSON, Zipkin v2 (including shared spans) and a simplified span list. Formats can be mixed within a trace set.
Optional logs (OTLP/JSON or simplified) and metrics (OTLP/JSON resources or simplified) for correlation checks.
Peer resolution and dependency graph (JSON + Mermaid): paired child spans, db.system, messaging.system, peer.service, a learned host index and DNS-label matching. Hosts are classified as internal, SaaS or external.
55 rules (COV-*) across topology, propagation, gaps, resource metadata, instrumentation scopes, span semantics, logs/metrics correlation and data quality. See RULES.md. All results are phrased as suspected coverage gaps and carry a confidence value.
Propagation-break matching across traces: one-to-one, by timing (100 ms skew), route and method, plus parent IDs that appear in a different trace.
Uninstrumented-time detection using an interval union of child spans (concurrency-safe). Per-route coverage is checked by downstream type and broken down by service.version.
Per-service coverage scores with a propagation/depth/metadata/correlation breakdown, and a fleet coverage score.
Prioritised improvement plan (effort, impact, generic and per-language hints for Java, Python, Node.js, Go and .NET).
Pay-per-event: coverage-audited ($0.75 per trace set of up to 10,000 spans, plus one more event for each further started 10,000 spans) and correlation-check ($0.25, only when logs or metrics were correlated). Unparsable sets and per-service items are free.

Third-Party Scripts Auditor

phoenix2810/third-party-scripts-auditor

Audit a public page for third-party scripts, stylesheets, and iframes. Classifies by known provider, flags render-blocking, missing SRI, non-HTTPS sources, and known trackers. Returns score, grade, and recommendations.

Sanskar Jaiswal

HTTP Security Headers Auditor

phoenix2810/http-security-headers-auditor

Audit a public website's HTTP security response headers in one API call. Returns a letter grade, numeric score, per-header analysis, and actionable recommendations. Built for security teams, devops, and site migration QA.

Sanskar Jaiswal

Content-Security-Policy Auditor

phoenix2810/csp-auditor

Deeply audit a public URL's Content-Security-Policy and Content-Security-Policy-Report-Only headers. Parses directives and sources, flags unsafe-inline, unsafe-eval, non-HTTPS sources, wildcards, missing default-src and frame-ancestors, nonces, hashes, and deprecated directives.

Sanskar Jaiswal

Dependency SBOM Auditor

timely_quarterstaff/dependency-sbom-auditor

Parse a dependency manifest (package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, Gemfile, composer.json) from text or a public raw URL into a clean dependency list + a CycloneDX SBOM (JSON). Deterministic, no AI. Optional free keyless OSV.dev advisory enrichment. SSRF-guarded.

Ahmed Moussa

Dependency License Auditor

junipr/dependency-license-auditor

Audit dependency manifests for license types, unknown licenses, and policy risk.

junipr

Website SEO, Accessibility & AI Readiness Auditor

feeng/website-seo-ai-readiness-auditor

🔎 Crawl websites and turn technical SEO, accessibility, security, performance, broken-link, structured-data, robots.txt, llms.txt, and AI crawler signals into prioritized 0–100 audit scores and client-ready reports.

Daniel S.

Internal Link Opportunity & Anchor Risk Auditor

invincible_nova/internal-link-opportunity-anchor-risk-auditor

Crawl one public website and return deterministic, review-ready internal-link suggestions with exact source sentences, anchor text, confidence components, and anchor-risk warnings.

Sergei Pechenov

App Review Monitor — Google Play & App Store Alerts

vasram/app-review-monitor

Monitor new Google Play & App Store reviews for your apps: instant Slack/Discord alerts, daily digests, release canary & competitor pain radar. Deterministic tagging, no API keys, no AI bills.

Vasram Sonagara

Product Data Extractor API — Price, Title, Images & Stock

highbrow_fame/product-page-extractor-api

Name, brand, price, currency, stock, rating, images, SKU/GTIN and variants from a product page's schema.org JSON-LD, microdata or Open Graph tags. One JSON record per URL. Product Data Extractor API.

yestrue

AccessDepth WCAG 2.1 AA Auditor

vast_walnut_qrq/accessdepth-wcag-auditor

Accessibility audit per URL: axe-core baseline plus a real keyboard-navigation simulation (tab order, focus traps, keyboard-only reachability) that static scanners miss. For WCAG 2.1 AA, EAA and ADA compliance.