csp-web-performance-auditorlisted

| Data Source | Tool | Auth Required | |-------------|------|---------------| | Lab metrics, opportunities, diagnostics | Lighthouse JSON | None (parse a provided file) | | Field metrics (real users, p75) | CrUX API | `CRUX_API_KEY` or `GOOGLE_API_KEY` env var | | Combined lab + field | PageSpeed Insights JSON | None for parsing; the user provides the JSON | | Live trace, LCP attribution, INP attribution, layout shift attribution | Chrome DevTools MCP server (`performance_*`, `lighthouse_audit`) | `chrome-devtools` MCP server configured in the harness (see `skills/csp-browser-testing-with-devtools`) | | Manual terminal capture (Lighthouse, trace, screenshot) | Chrome DevTools MCP CLI (e.g. `chrome-devtools lighthouse_audit --output-format=json`) | `npx -p chrome-devtools-mcp chrome-devtools <tool>` or `npm i -g chrome-devtools-mcp` (CLI is independent of the harness) | If a source is unavailable, do not fabricate. Skip the related section of the scorecard and continue with what you have. ## Metric-Honesty Rule **Never fabricate metrics.** An LLM reading static source code cannot measure real-world LCP, INP, or CLS. If no tool data is provided: - Return a source-level findings report. - Mark the entire scorecard as `not measured`. - Label every finding as `potential impact`, not as a measurement. When data IS provided, label each scorecard value with its source (`Field (CrUX)`, `Lab (Lighthouse)`, `Trace (DevTools)`). Field and lab data are not interchangeable: field is w