8 free devtools I kept using in 2026 (and 1 I ditched)

Eight: a CLI UX linter, an AI CLI generator, a CSV-to-endpoint builder, a prose flow linter, a trace context validator, a retry/idempotency contract builder, a CSP/SRI policy builder, and a regex tester. All free, all browser-based, none of them ask for an account. I ditched a hosted mocking service for the CSV builder in February and haven't looked back. The table near the bottom lists each dealbreaker.

Straight up: the devtools collection I link to below is one I built. I'd bookmarked eleven separate tools across four browsers, and half of them wanted an email address before they'd print output. Mine wants nothing. No signup, no upload, everything runs in the tab, and it costs zero. If you know a better set, tell me in the comments and I'll swap mine out.

Why my devtools shelf collapsed in March

On March 9, 2026 I shipped an internal CLI for our support team. Fourteen subcommands, decent help text, tests green. Two days later the support lead sent me a screenshot of --dry-run printing absolutely nothing and asked, politely, whether that was intentional.

It wasn't. The flag existed and did its job, but it wrote to stderr and left the exit code alone, so from the outside it looked dead. That's a UX bug. I had no tooling that would ever have caught it. My linter checks JavaScript. CI checks types. Neither one knows what a confusing command line looks like.

So I went looking that week, and what I found was a pile of single-purpose browser tools of wildly uneven quality. Some were excellent. Some were regex testers wrapped in three ad slots. Several wanted an account before they'd process a 40-character input string, which I still think is rude.

Here's the list that survived six months of actual use, including the one I stopped opening.

The five I open most weeks

These five earn real explanation. The other three get a row in the table and a sentence, because that's proportional to how often I touch them.

cli-ux-linter

Paste your --help output, get back a list of things that will confuse a human being. It flags undocumented exit codes, value-taking flags with no placeholder, subcommands missing a one-line summary, and inconsistent verb tense across those summaries.

• On my 14-subcommand CLI it found 9 issues. Three of them I'd have shipped forever.
• The --dry-run problem was issue #2, phrased as "flag documented as an action with no described observable output."
• It doesn't execute your binary. You paste text, it reads text. I like that it's upfront about the limit instead of pretending.

ai-cli-generator

Describe the command you want in a sentence, get an argparse, commander, or clap scaffold back. I reach for it on throwaway scripts where writing the flag plumbing costs more than the actual logic.

• Best result I've gotten: "read a directory of json, filter by a jq-ish path, write csv" produced a working Python argparse skeleton on the first try.
• Roughly 1 in 4 of my prompts needs a second pass. That ratio has been stable since June.
• The help text it generates is better written than mine. Honestly that annoyed me for about a day.

csv-endpoint-builder

Drop in a CSV, get a mock REST spec back: routes, filter params, pagination shape, and a sample payload. This one changed how I unblock frontend work.

• Last Tuesday a frontend dev was stuck waiting on our invoices service. 6 minutes from CSV export to a /v1/invoices spec they could code against.
• Column type inference handles ISO dates correctly and treats id columns as strings, which is the right call more often than not.
• It replaced a Postman collection I'd been hand-maintaining since 2024.

trace-context-validator

Paste a traceparent and tracestate pair, find out why your spans are orphaned. This one paid for itself in a single sitting.

• It caught an all-zero span id coming from a proxy that claimed to be "adding" trace headers. Our distributed traces had been quietly broken for what I estimate was six weeks.
• It also checks tracestate key ordering, which I didn't know was a spec rule until the tool told me.

If you want the same check in CI rather than a browser tab, the core of it is small enough to just write:

// traceparent-check.js
// usage: node traceparent-check.js "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"
const SHAPE = /^([0-9a-f]{2})-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/;

function check(header) {
  const m = SHAPE.exec(String(header || '').trim());
  if (!m) return { valid: false, reason: 'expected version-traceid-spanid-flags' };

  const [, version, traceId, spanId, flags] = m;
  if (version === 'ff') return { valid: false, reason: 'version ff is forbidden' };
  if (/^0+$/.test(traceId)) return { valid: false, reason: 'trace id is all zeroes' };
  if (/^0+$/.test(spanId)) return { valid: false, reason: 'span id is all zeroes' };

  return {
    valid: true,
    version,
    traceId,
    spanId,
    sampled: (parseInt(flags, 16) & 1) === 1,
  };
}

console.log(JSON.stringify(check(process.argv[2]), null, 2));

That's the whole all-zero check that saved us. Thirty seconds of reading, six weeks of bad data.

csp-sri-policy-builder

Paste your page's script and style origins, get a Content-Security-Policy header plus subresource integrity hashes for your pinned CDN assets.

• Our CSP was 2,904 characters of accumulated unsafe-inline guilt. The builder got it down to 611 and named the exact two inline blocks that needed a nonce.
• It emits the report-only variant alongside the enforcing one, which most generators skip and which is the only sane way to roll a policy out.

All eight, compared

All of these live together at aidevhub.io/tools/dev. The pricing column is short because nothing here charges anything.

Tool	Best for	Pricing	The one dealbreaker
cli-ux-linter	Auditing --help before users see it	Free	Reads pasted text only, can't run your binary
ai-cli-generator	Scaffolding argparse / commander / clap	Free	About 1 in 4 outputs needs a manual fix
csv-endpoint-builder	Mock REST endpoints from a spreadsheet	Free	No auth simulation, so you can't test 401 paths
openprose-flow-linter	Finding stalled logic in READMEs and docs	Free	Opinionated about passive voice, can't be disabled
trace-context-validator	Orphaned spans and broken traceparent	Free	W3C format only, no B3 or Jaeger headers
retry-idempotency-contract-builder	Writing retry rules down before you code them	Free	Outputs a spec, not client code
csp-sri-policy-builder	Tightening CSP, generating SRI hashes	Free	SRI needs the asset URL publicly reachable
regex-tester	Fast iteration with a match explanation	Free	JS flavor by default, PCRE quirks will bite

The three I didn't break out above still keep their bookmarks. openprose-flow-linter is what I run a README through when a section feels wrong and I can't articulate why. retry-idempotency-contract-builder made me write down that our webhook consumer keys idempotency on event_id rather than payload hash, which is exactly the sort of decision that lives in one person's head until they leave. And regex-tester is a regex tester; it's quick, it explains the match tree, and it never once asked me about a Pro tier.

The one I ditched and why

For about eight months I paid for a hosted API mocking service. I won't name it. Small team, they were always decent about support. Here's what killed it anyway.

Every mock lived on their infrastructure. Which meant every mock needed an account, and every account needed a seat, and by January our seat count had crept to 6 and the invoice read $91.64 a month for what were, functionally, fancy JSON files. Defensible, maybe. Then in February they took a 4-hour outage and three of our frontend devs sat idle, because their local dev servers pointed at mocks that stopped resolving.

That's the real problem with hosted tooling for local work. Your ability to type code becomes coupled to somebody else's uptime, for a task that has no business touching the network at all.

I moved it to csv-endpoint-builder output plus a 40-line Express stub committed to the repo. Took one afternoon. The specs now sit in git next to the code they describe, so they show up in diffs and in review. I did lose the shareable-link feature and I genuinely miss it. Not $91.64 worth.

FAQ

Q: Do any of these upload my data?

A: No. Everything runs client-side in the tab, which is the main reason I built the set this way. Paste a production traceparent or a real CSV and nothing leaves your machine. Check the network tab if you don't believe me; that's a reasonable thing to be skeptical about.

Q: Is ai-cli-generator really useful, or is it a wrapper around a prompt?

A: It's a wrapper around a prompt with a lot of structure behind it. I'd say the value is the structure, since my own freehand prompts produce worse flag naming and worse help text. If you already write great CLI scaffolds by hand, skip it.

Q: Why is there no linting or formatting tool in this list?

A: Because you already have those and they're already good. This list is deliberately the gaps: the checks that no standard toolchain runs for you.

Q: What would you add next?

A: An OpenAPI diff viewer that explains breaking changes in plain language. I've looked at four and none of them tell me whether a change actually breaks an existing client. If that exists and I've missed it, I'd like to know.

Written with AI assistance and human review. Try the tool at aidevhub.io/tools/dev.