There’s a ritual every digital consultant knows by heart. You arrive at a client’s office (or you connect remotely to their environment) and before you can do a single minute of actual diagnostic work, you spend the first hour fighting the setup. You need Node.js, but their machine doesn’t have it. You need Lighthouse, but npm is blocked by their corporate proxy. You need to check the MarTech stack, but the browser extensions you rely on are flagged by IT security. You install things. You configure things. You make a mental note to uninstall everything when you’re done.
And then, when the audit is finally over, you spend another 20 minutes cleaning up, hoping you didn’t accidentally break something in their environment, hoping you didn’t leave credentials in a temp folder, hoping the next consultant who sits at that machine doesn’t find your leftovers.
It’s a ridiculous amount of friction for work that should be fast and clean. So we built Prismo.
It bundles a portable Node.js runtime, Anthropic’s Claude Code as the AI reasoning engine, and a library of pre-built diagnostic frameworks covering website performance, SEO, MarTech stacks, security, and system health. It works on Windows, macOS, and Linux without touching the host machine’s software environment.
That’s the one-sentence version. But to understand why we built it this way (and what’s actually happening under the hood) it’s worth going deeper.
The problem we were actually solving
If you do on-site consulting, you know the install-and-uninstall dance. But even if you work remotely, the problem is real: the tools you use for digital audits are fragmented, environment-dependent, and inconsistent across your team.
Think about what a thorough technical audit of a client’s digital presence actually requires. You need a Lighthouse runner for Core Web Vitals (which is why we also built a dedicated Lighthouse Dashboard for continuous monitoring). You need something to inspect HTTP headers and SSL certificates. You need to parse the page source to detect MarTech tags, consent management platforms, and data layer implementations. You need to check robots.txt, sitemap structure, canonical tags, and structured data. You need to look at security headers, cookie flags, and CORS policies. And ideally, you want all of this to produce a structured, client-ready report, not a pile of terminal output you have to manually organize.
In practice, most consultants cobble this together from a mix of browser extensions, online tools, and CLI utilities that they’ve accumulated over years. The setup is personal, fragile, and non-transferable. When a junior consultant joins the team, they spend days replicating your environment. When you’re on a client machine, you can’t replicate it at all.
The advice we kept seeing was either too vague (“just use ChatGPT for your audits”) or too complex (“build a Docker container with all your tools”). There had to be something in between (something portable, self-contained, and genuinely useful in the field).
That’s where Prismo was born.
The architecture: how portability actually works
Making a complex toolkit truly portable is harder than it sounds. The naive approach — just copy your scripts to a USB drive — breaks immediately because of three real-world constraints:
- exFAT doesn’t support symlinks. Most USB drives are formatted as exFAT for cross-platform compatibility. But Node.js, npm, and npx rely heavily on symlinks. If you try to run Node directly from an exFAT drive, it fails.
- USB drives are often mounted with
noexec. On Linux especially, USB drives are frequently mounted with thenoexecflag, which prevents executing binaries directly from the drive. - USB I/O is slow. Running a Node.js application from a USB drive is painfully slow compared to running from local disk.
Prismo solves all three problems with the same approach: when you launch it, it automatically extracts the correct Node.js runtime into /tmp/prismo-node-runtime on the local machine. This is a temporary directory that gets cleaned up when you eject the drive. The USB carries the compressed runtime archives for every supported platform (Windows x64, Linux x64, macOS Intel, macOS Apple Silicon), and the launcher detects which one to use based on the OS and architecture it finds.
The AI engine follows the same pattern. Claude Code’s CLI is stored on the USB, and a lightweight wrapper script is created in /tmp that points to the local Node binary. Everything runs from local disk at full speed, but the source of truth — the engine, the prompts, the credentials, the reports — stays on the USB.
When you eject, Prismo’s safe-eject routine flushes all write buffers, removes the temporary files, and gracefully unmounts the drive. The host machine is exactly as it was before you plugged in.
The AI layer: not just prompts
There’s a meaningful difference between “using AI” and building something that uses AI well. Prismo uses Claude Code not as a chatbot you talk to, but as an autonomous reasoning engine that executes structured consulting workflows.
Here’s what that means in practice. When you select “Website Performance Audit” from the menu, Prismo doesn’t just ask Claude “can you audit this website?” It loads a detailed, proprietary prompt that defines the AI’s role, methodology, and output format with precision. The performance audit prompt, for example, instructs the engine to:
- run Lighthouse for both mobile and desktop configurations (for continuous tracking, you can use our self-hosted performance monitoring dashboard);
- apply specific Core Web Vitals thresholds (LCP under 2.5s, INP under 200ms, CLS under 0.1);
- analyze page weight by asset category (HTML, CSS, JavaScript, images, fonts, third-party);
- check server delivery factors: TTFB, HTTP version, compression, caching headers, CDN presence;
- identify render-blocking resources and quantify their impact;
- classify every finding with a severity level (CRITICAL, HIGH, MEDIUM, LOW) based on defined criteria;
- produce a structured Markdown report with a specific schema.
The AI doesn’t improvise the structure. It follows a consulting framework that we designed based on years of doing these audits manually. The value isn’t in the AI model itself, it’s in the structured thinking that sits between the raw input and the useful output.
This is the same lesson we learned building FlowAudit: anyone can call an API and get a response. The hard part is designing the analytical framework that makes the response genuinely useful.
The evidence layer: grounding AI in reality
One of the risks of AI-powered audits is hallucination, the model making confident statements about things it can’t actually verify. We addressed this by building a data collection layer that runs before the AI analysis.
For web audits, the collect-web.sh script (or its Windows equivalent) silently gathers hard evidence from the target URL before the AI even starts. It collects:
- Full HTTP response headers, including all redirect chains.
- Precise timing breakdowns: DNS lookup, TCP connection, TLS handshake, time to first byte, total transfer time.
- SSL certificate details: issuer, validity dates, certificate chain.
- Raw HTML source (first 200 lines, which is where all the important tags live).
- All meta tags, canonical links, and Open Graph properties.
robots.txtesitemap.xmlcontent.- Security headers (or their absence).
- Server technology disclosure from response headers.
This raw evidence is then passed to the AI along with the audit prompt. The AI reasons over real data, not assumptions. When it tells you that your Content Security Policy header is missing, it’s because it saw the actual HTTP headers. When it flags a pixel firing before consent, it’s because it found the script tag in the raw HTML.
For system audits, the same principle applies. The Windows collector (collect-win.ps1) gathers OS metadata, hardware specs, disk usage, running services, event log errors, network configuration, listening ports, and user accounts before the AI starts its analysis.
The 15 audits, explained honestly
Prismo ships with 15 pre-built audit types. Here’s what each one actually does, without the marketing language:
System Health
System Diagnosis [1] runs a full health check of the machine you’re on. It checks CPU usage, RAM, disk space, running services, Windows Update status, and recent error logs. Useful as a first step when a client says “the computer is slow” or “something is wrong but I don’t know what.”
Log Analysis [2] takes a log file you point it at and identifies errors, warnings, and anomalous patterns. You give it the path to /var/log/nginx/error.log oppure C:\Windows\System32\LogFiles\... and it produces a structured summary with suggested fixes.
Network Diagnostics [3] checks interfaces, DNS resolution, routing tables, listening ports, firewall rules, and connectivity. Useful when a client has “internet problems” that turn out to be a misconfigured DNS server or a firewall rule blocking outbound traffic.
Web & Performance
SEO
Technical SEO Audit [7] covers the foundations: robots.txt configuration, sitemap structure and validity, canonical tag implementation, hreflang for international sites, structured data (Schema.org), mobile-friendliness, SSL, redirect chains, and crawlability issues.
On-page SEO Analysis [8] goes deeper into a specific page: title tag length and keyword placement, meta description quality, heading hierarchy, content-to-code ratio, image optimization, internal linking patterns, and Open Graph implementation.
Competitive SEO Snapshot [9] compares a client’s site against 2-3 competitors on visible SEO signals: content strategy, keyword targeting, technical maturity, structured data usage, site speed, and mobile optimization.
MarTech & Data
Security
Utilities
Client profiles: building institutional memory
One of the features we implemented after month of use is the client profile system. As a consultant, you often return to the same clients over months or years. Without a system for capturing context, every visit starts from scratch. You re-explain the tech stack, re-discover the same issues, and re-write the same caveats in your reports.
Prismo solves this with simple JSON profiles stored in toolkit/clients/ on the drive. A profile looks like this:
When you set the active client in prismo.config.json, this context is automatically surfaced in the banner and passed to the AI engine. The AI knows the client’s stack, knows what was found in previous audits, and can give advice that’s relevant to their specific situation rather than generic recommendations.
What Prismo is not
Getting started
The setup is a one-time process that takes about 10 minutes and requires a Windows machine with internet access.
Prepare the USB (once):
# Insert USB drive (e.g., drive E:)
.\setup-usb.ps1 -UsbDrive E
This downloads Node.js runtimes for all supported platforms, the Claude Code engine, Lighthouse, and pa11y onto the drive. Total size is about 900MB, so use a drive with at least 2GB free (4GB recommended). The script shows a progress bar and handles retries automatically.
Use it on any machine:
On Windows, double-click launch.bat. On macOS or Linux, run bash /path/to/usb/launch.sh. Prismo will verify file integrity via SHA256 checksums, set up the runtime, detect your system, ask you to choose a language (Italian, English, or French), and show the main menu.
Pick an audit, get a report. That’s it.