Your tokens define
the system.
A hardcoded hex color, a duration that doesn't match a motion token, a component shipped without its disabled state, all things a design system quietly loses over time. Maddox scans real source code against your real tokens and posts what drifted on every pull request.
What it checks
Colors
Every hex literal in your source (or a live page's rendered HTML/CSS) is matched against your real tokens by exact value, then by RGB distance for near-misses.
Motion
Durations and easings used in code are checked against your real motion tokens, duration against duration, ease against ease, never cross-compared. Source-scan only.
Component states
An explicit contract you write, not inferred, that flags a component missing a state it's required to handle: disabled, loading, error, and more. Source-scan only.
Component-state checking runs against a contract you write yourself, a JSON file naming which states each kind of component must cover. Maddox confirms the state is referenced in the file; it doesn't yet verify it renders correctly, that's a static source check, not a visual one. Every color/font-size/spacing near-miss gets a suggested fix — the exact token reference to swap in — which you can also apply straight to the source file with one flag.
Ground truth
@theme CSS
A Tailwind v4 @theme block — the default, always available.
Tokens Studio
A Tokens Studio / W3C Design Tokens JSON export, with alias resolution.
Figma Variables
Pulled directly from a Figma file's Variables via the REST API. Requires an Enterprise Figma plan.
Any combination can be used together — Figma Variables take precedence over Tokens Studio, which takes precedence over @theme CSS, since that's the order a real design-to-code pipeline runs in.
How it runs
Point it at your source
Give it your app directory and the CSS file holding your @theme block. No SDK install, no build step changes.
Or scan a live URL
Point it at a deployed page instead, and it checks what's actually shipped — not just what's in the repo. Catches a stale build or a silently-dropped token a source-only scan can't see.
Run it locally or in CI
One CLI command. Wire it into a GitHub Action and get a drift report posted as a PR comment on every change.
See it on the dashboard
Every scan uploads its findings, grouped by the real route they belong to: file, line, severity, and the nearest token, so drift is traceable back to the exact commit that caused it.
Pricing
Free
Unlimited projects, dashboard history, and CI Action. 5 CLI scans a month. No card required.
Pro
Unlimited CLI scans.