{"service":"Abbox","updated":"2026-11-10","docs":{"security":"https://www.abbox.com/docs/security","install":"https://www.abbox.com/docs/install","agents":"https://www.abbox.com/docs/agents","privacy":"https://www.abbox.com/privacy"},"pricing":{"price":"Free during early access. No card needed. We'll announce any pricing well before it starts.","limits":["Agent access tokens: 20 per workspace","Viewer sessions: 30 minutes each; sign-in and viewer links work once, within 5 minutes","Website reports for sites without an account: up to 5 pages each, 3 per visitor per hour","Google PageSpeed: a page is checked at most once a day, or every 5 minutes when you ask again","PostHog numbers: refreshed at most every 10 minutes","Analyses: one per push to the connected branch"]},"does":["Maps each page of a Next.js (App Router) website from its code: components, buttons, forms, texts, links, analytics events, files and lines","Shows what changed in each merge, marked on the page, including modals and states behind clicks","Puts real PostHog usage on the buttons and pages it belongs to (read-only)","Runs Google PageSpeed on live pages and ties problems to source lines","Lists the answers your Express backend can give each call, and mocks them to preview hidden states","Explains any element in plain words, and opens fixes as pull requests on new branches when asked","Answers coding agents over MCP, read-only"],"does_not":["Write to your backend, database, PostHog or main branch; merge pull requests","Read Google Analytics, Search Console, Sentry, Hotjar or support tickets","Analyse frameworks other than the Next.js App Router, or backends other than Express (Laravel and others can be connected, but aren't analysed yet)","Record sessions, follow individual visitors, or read what people type","Run your tests or deploy your code"],"interface":{"mcp":"https://api.abbox.com/mcp","transport":"streamable-http","auth":"Authorization: Bearer abx_… (read-only, one workspace)","manifest":"https://www.abbox.com/.well-known/mcp.json"},"environment_variables":[{"name":"ABBOX_TOKEN","where":"Your shell, for the Claude Code plugin","what":"The read-only access token (abx_…) the plugin sends to Abbox's MCP server."},{"name":"ABBOX_INSPECTOR=0","where":"Your build (Dockerfile, CI)","what":"Builds without the inspector, even in production mode."},{"name":"ABBBOX_INSPECTION_MODE=production","where":"Set by npm run build in production mode","what":"Includes the inspector in a live build. Spelled with three Bs."},{"name":"ABBBOX_INSPECTOR=1","where":"Set by npm run dev:abbox","what":"Includes the inspector in local development."}],"errors":[{"error":"401 \"Use an Abbox access token: Bearer abx_…\"","next":"Send the header Authorization: Bearer abx_… with a token from https://www.abbox.com/agents."},{"error":"\"This Abbox token is unknown or was revoked\"","next":"Create a new token at https://www.abbox.com/agents and replace the old one."},{"error":"\"No project \"x\". This workspace has: …\"","next":"Call list_projects and pass one of the names or ids it returns."},{"error":"\"No page at /x in … code. Its pages: …\"","next":"Pass one of the listed routes, or a real address that matches one (/projects/42 for /projects/$id)."},{"error":"\"… hasn't been analysed yet\"","next":"Connect the repository on the project page; the first analysis takes a few minutes."},{"error":"\"PostHog isn't connected\" or \"PostHog access ended\"","next":"Connect or reconnect PostHog in the project's Analytics section (link in the answer)."},{"error":"\"Speed (Google PageSpeed): being checked now\"","next":"Call get_page_context again in about a minute."},{"error":"CLI: \"Could not find an App Router root layout\"","next":"Run the command in the folder with your Next.js package.json (for a monorepo, e.g. frontend/)."},{"error":"CLI: \"Port 4319 is in use\"","next":"Run npx @abbox/cli watch --port 4320."},{"error":"Viewer: \"Can't reach your local changes\"","next":"Keep npx @abbox/cli watch running and open the link it printed; allow local network access if the browser asks."}],"security_contact":"kamran.elchuzade@abbox.com","backend_and_database":{"reads":[],"writes":[],"note":"Abbox never calls your backend or database to change anything."},"access":[{"id":"github","name":"GitHub, through the Abbox Connect app","grant":"You install the Abbox Connect GitHub App on your account or organization and choose the repositories it may use.","permissions":["Metadata: read","Contents: read and write","Pull requests: read and write","Webhook events: push, installation_repositories"],"reads":["The code of the repositories you select, at each commit Abbox analyzes","Push events, so every push to the connected branch is analyzed"],"writes":["Only when someone in your workspace asks: Fix it, a design change, or Add the inspector","Commits only to a new branch whose name starts with abbox/ (abbox/fix-…, abbox/inspector-install-…), then opens a pull request from it"],"never":["Push to an existing branch, including main","Merge, close or approve pull requests","Change repository settings, secrets, issues or workflows"],"why":"Write access to contents is how GitHub lets an app create a branch with commits. Pull request access lets it open the pull request your engineers review.","revoke":"Uninstall Abbox Connect, or remove repositories from it, in GitHub settings → Applications (organizations: Settings → GitHub Apps). Protecting main with required reviews makes merging without review impossible for anyone."},{"id":"posthog","name":"PostHog (optional)","grant":"You sign in to PostHog with OAuth on your project page and choose one PostHog project.","permissions":["query:read","project:read"],"reads":["Totals for the last 60 days: event and page-view counts per page path, how they change over time, which pages visitors move between","Device type, referring domain and country counts behind page views","Exception types with the first 160 characters of their messages"],"writes":[],"never":["Session recordings","Person profiles, emails or any individual visitor's events","Changes to your PostHog project"],"why":"So the viewer's Tracking tab shows real usage on the buttons and pages it belongs to.","revoke":"Disconnect on the project page: Abbox deletes the tokens and asks PostHog to revoke them. Deleting the project or account does the same."},{"id":"inspector","name":"The Abbox inspector on your website (optional)","grant":"You add the open npm package @abbox/inspector with `npx @abbox/cli init`, review the changes and deploy them. It is pinned to an exact version.","permissions":["Your site can be shown in a frame by https://viewer.abbox.com, https://abbox.com and https://www.abbox.com (Content-Security-Policy frame-ancestors). Builds made with ABBOX_INSPECTOR=0 add nothing","In production builds the inspector only accepts messages from the Abbox viewer origin it was built with"],"reads":["Only while your site is open inside the Abbox viewer, in that browser tab: the page address and title","The element someone selects: its tag, up to 160 characters of its text, and its source file and line","The last minute of activity in that tab: clicks, pages visited, form submissions, errors and requests (method, address without its query string, status, timing), sent only when someone reports a bug"],"writes":["Highlights elements and applies temporary styles inside the viewer","To preview a hidden state (a modal, an error), replays clicks and answers your API's requests with mocked responses, while blocking every request that would change data (non-GET fetch and XHR, form posts, beacons)"],"never":["Run for your visitors: outside the Abbox viewer it only waits for a message from the viewer and does nothing else","Make network requests of its own or contact Abbox's servers","Read what is typed into fields, passwords, cookies, or request and response bodies"],"why":"It lets the viewer link what you see on your real site to the code behind it, and preview states that only appear after clicks.","revoke":"Run `npx @abbox/cli@latest uninstall` in the app folder, commit and deploy: it removes everything init added and keeps your own edits. Or build with ABBOX_INSPECTOR=0. Known limits: the page address sent to the viewer currently includes its query string, and WebSocket messages are not blocked during previews."},{"id":"agents","name":"Your coding agents (optional)","grant":"Someone in your workspace creates an access token on the Connect your coding agent page and adds it to Claude Code, Cursor or VS Code. Tokens are read-only, belong to one workspace, and can be revoked there at any time.","permissions":["Read this workspace's projects through Abbox's MCP server (https://api.abbox.com/mcp)","Nothing else: a token can't call any other part of Abbox"],"reads":["What Abbox already shows you: each page's code map, PostHog totals, Google PageSpeed results, search checks and recent changes, as short summaries"],"writes":[],"never":["Change anything in Abbox, GitHub, PostHog or your website","Reach another workspace's projects","Keep the token itself: Abbox stores only a one-way hash of it"],"why":"So a coding agent can check a page before changing it, and check a deploy after, with the same facts your team sees in the viewer.","revoke":"Revoke the token on the Connect your coding agent page. Deleting the account removes every token."}],"stored":[{"what":"Account: email address and a hash of your password","where":"Database (Supabase)","kept":"Until you delete your account"},{"what":"Projects, repository connections, analysis and comparison records","where":"Database (Supabase)","kept":"Until you delete the project or account"},{"what":"Analyses of your code (pages, components, texts, analytics calls) and AI descriptions of them","where":"File storage (Amazon S3, Frankfurt)","kept":"Until you delete the project or account"},{"what":"Conversations, bug reports, fix records and page speed results","where":"Database (Supabase)","kept":"Until you delete the project or account"},{"what":"PostHog tokens, encrypted; the totals read from PostHog","where":"Database; totals in server memory","kept":"Tokens until you disconnect; totals for 10 minutes"},{"what":"Viewer sessions","where":"Database","kept":"Expire after 30 minutes; sign-in links after 5 minutes"},{"what":"Agent access tokens: a one-way hash, a name and when each was last used","where":"Database (Supabase)","kept":"Until revoked, or the account is deleted"}],"processors":["Amazon Web Services, in the EU: API servers and file storage in Frankfurt, and AI models through Amazon Bedrock, which processes prompts only in AWS EU regions. Your code is not used to train models.","Supabase: database.","Vercel and Cloudflare: host and deliver abbox.com and the viewer.","GitHub and PostHog: only the access you grant above."],"deletion":["Delete project, at the bottom of a project page: removes the project's records, analyses, AI descriptions, conversations, its PostHog connection (revoked at PostHog) and its stored files.","Delete account, on the Account page: does the same for every project, then removes your workspace, repository connections, agent tokens, sessions and sign-in.","Neither changes your code or GitHub: run `npx @abbox/cli@latest uninstall` in your web app to remove everything init added, and uninstall Abbox Connect on GitHub."]}