Dark Pattern Scanner
Detect deceptive design patterns in websites, UI code, and marketing copy.
Taxonomy (7 categories, 35 pattern types)
| Category |
Severity Range |
What to look for |
| Forced Action |
Critical–Medium |
Forced continuity, forced registration, forced sharing, forced consent, gamification coercion |
| Misdirection |
Critical–Medium |
Visual misdirection, trick questions, bait-and-switch, disguised ads, false hierarchy |
| Obstruction |
Critical–Medium |
Roach motel (hard to cancel), confirmshaming, exit obstruction, complex processes |
| Scarcity |
High–Medium |
False stock counts, false demand, false limited edition |
| Sneaking |
Critical–High |
Hidden costs, sneak into basket, hidden subscriptions, drip pricing |
| Social Proof |
Critical–Medium |
Fake reviews, fake activity notifications, misleading metrics, false authority |
| Urgency |
Critical–High |
Fake countdowns, false urgency language, fake deal expiry, pressure selling |
Scanning Workflow
1. Gather the target
Determine what to scan based on user input:
- Live website URL → Use browser tool to navigate, take a screenshot, and extract the page snapshot (DOM).
- Code files → Read the component/page source code.
- Copy/text → Accept pasted text directly.
- Screenshot → If the user provides one, analyze visually.
2. Run the scan
Check the target against every pattern type. For each, look at:
- Text content — Match against keyword patterns listed in references/patterns-reference.md.
- Visual design — Check for visual hierarchy manipulation (e.g., bright accept vs. grey reject buttons in cookie banners).
- Interaction flow — Check for obstruction (e.g., multi-step cancel, exit popups).
- Pricing/checkout — Check for hidden costs, drip pricing, sneak-into-basket.
- Timer/counter elements — Check for fake countdowns, fake stock counts, fake activity.
3. Keyword detection
For text-based scanning, search for these high-signal phrases (case-insensitive):
Urgency: act now, hurry, last chance, limited time, expires in, don't miss out, ends today, flash sale
Scarcity: only X left, almost sold out, low stock, selling fast, few remaining, limited stock
Social Proof (fake): just purchased, just bought, people viewing, people looking at, in their cart, minutes ago
Sneaking: service fee, processing fee, handling fee, added to your cart, subscribe & save (pre-selected)
Confirmshaming: no thanks, I don't want, I prefer paying, I hate saving
Forced Action: sign up to, create an account to, register to continue, auto-renew
Misdirection: as low as, starting at, additional charges apply
4. Generate the report
Output a structured report with:
## Dark Pattern Scan Report
**Target:** [URL or description]
**Scan date:** [date]
**Patterns found:** X
### Findings
| # | Pattern | Category | Severity | Evidence | Fix |
|---|---------|----------|----------|----------|-----|
| 1 | [name] | [cat] | [sev] | [quote/screenshot] | [recommendation] |
### Summary by Category
| Category | Count | Highest Severity |
|----------|-------|-----------------|
| ... | ... | ... |
### Risk Score
**Overall:** [Low / Medium / High / Critical]
- Critical patterns: X
- High patterns: X
- Medium patterns: X
### Recommendations
1. [Most critical fix first]
2. [...]
5. Risk scoring
Calculate risk from findings:
| Condition |
Risk Level |
| Any critical pattern found |
Critical |
| ≥3 high patterns |
High |
| 1–2 high patterns or ≥3 medium |
Medium |
| Only medium or no patterns found |
Low |
Scanning Code Components
When scanning React/HTML code, look for:
- Pre-checked checkboxes:
defaultChecked, checked={true}, defaultValue
- Timers:
setInterval, countdown, setTimeout in UI context
- Exit intent:
beforeunload, mouseleave event handlers
- Fake activity: Random name generators,
Math.random() for "people viewing"
- Confirmshaming: Decline button text containing guilt language
- Visual hierarchy: Compare CSS of accept vs reject buttons (size, color, opacity)
- Hidden costs: Fees revealed only in final checkout step
- Auto-add to cart: Items added without explicit
onClick from user
Reference
Full taxonomy with IDs, examples, keywords, and prevention strategies is in:
src/lib/mcp/data/dark-patterns.ts
Source: "Unmasking Dark Patterns" (arXiv:2406.01608v1) + Mathur et al. (2019), Gray et al. (2023)
1---2name: dark-pattern-scanner3description: Scan websites, UI code, copy, or e-commerce pages for dark patterns (deceptive design). Use when the user says "scan for dark patterns," "check for deceptive design," "dark pattern audit," "UI manipulation check," "check for confirmshaming," "detect urgency tricks," "scan for sneaking," or asks to review any webpage, component, or copy for manipulative UX tactics. Covers all 7 categories from academic research: Forced Action, Misdirection, Obstruction, Scarcity, Sneaking, Social Proof, and Urgency.4---56# Dark Pattern Scanner78Detect deceptive design patterns in websites, UI code, and marketing copy.910## Taxonomy (7 categories, 35 pattern types)1112| Category | Severity Range | What to look for |13| -------------- | ------------------ | ----------------------------------------------------------------------------- |14| Forced Action | Critical–Medium | Forced continuity, forced registration, forced sharing, forced consent, gamification coercion |15| Misdirection | Critical–Medium | Visual misdirection, trick questions, bait-and-switch, disguised ads, false hierarchy |16| Obstruction | Critical–Medium | Roach motel (hard to cancel), confirmshaming, exit obstruction, complex processes |17| Scarcity | High–Medium | False stock counts, false demand, false limited edition |18| Sneaking | Critical–High | Hidden costs, sneak into basket, hidden subscriptions, drip pricing |19| Social Proof | Critical–Medium | Fake reviews, fake activity notifications, misleading metrics, false authority |20| Urgency | Critical–High | Fake countdowns, false urgency language, fake deal expiry, pressure selling |2122## Scanning Workflow2324### 1. Gather the target2526Determine what to scan based on user input:2728- **Live website URL** → Use browser tool to navigate, take a screenshot, and extract the page snapshot (DOM).29- **Code files** → Read the component/page source code.30- **Copy/text** → Accept pasted text directly.31- **Screenshot** → If the user provides one, analyze visually.3233### 2. Run the scan3435Check the target against every pattern type. For each, look at:36371. **Text content** — Match against keyword patterns listed in [references/patterns-reference.md](references/patterns-reference.md).382. **Visual design** — Check for visual hierarchy manipulation (e.g., bright accept vs. grey reject buttons in cookie banners).393. **Interaction flow** — Check for obstruction (e.g., multi-step cancel, exit popups).404. **Pricing/checkout** — Check for hidden costs, drip pricing, sneak-into-basket.415. **Timer/counter elements** — Check for fake countdowns, fake stock counts, fake activity.4243### 3. Keyword detection4445For text-based scanning, search for these high-signal phrases (case-insensitive):4647**Urgency:** `act now`, `hurry`, `last chance`, `limited time`, `expires in`, `don't miss out`, `ends today`, `flash sale`4849**Scarcity:** `only X left`, `almost sold out`, `low stock`, `selling fast`, `few remaining`, `limited stock`5051**Social Proof (fake):** `just purchased`, `just bought`, `people viewing`, `people looking at`, `in their cart`, `minutes ago`5253**Sneaking:** `service fee`, `processing fee`, `handling fee`, `added to your cart`, `subscribe & save` (pre-selected)5455**Confirmshaming:** `no thanks, I don't want`, `I prefer paying`, `I hate saving`5657**Forced Action:** `sign up to`, `create an account to`, `register to continue`, `auto-renew`5859**Misdirection:** `as low as`, `starting at`, `additional charges apply`6061### 4. Generate the report6263Output a structured report with:6465```markdown66## Dark Pattern Scan Report6768**Target:** [URL or description]69**Scan date:** [date]70**Patterns found:** X7172### Findings7374| # | Pattern | Category | Severity | Evidence | Fix |75|---|---------|----------|----------|----------|-----|76| 1 | [name] | [cat] | [sev] | [quote/screenshot] | [recommendation] |7778### Summary by Category7980| Category | Count | Highest Severity |81|----------|-------|-----------------|82| ... | ... | ... |8384### Risk Score8586**Overall:** [Low / Medium / High / Critical]87- Critical patterns: X88- High patterns: X 89- Medium patterns: X9091### Recommendations92931. [Most critical fix first]942. [...]95```9697### 5. Risk scoring9899Calculate risk from findings:100101| Condition | Risk Level |102| -------------------------------- | ---------- |103| Any critical pattern found | Critical |104| ≥3 high patterns | High |105| 1–2 high patterns or ≥3 medium | Medium |106| Only medium or no patterns found | Low |107108## Scanning Code Components109110When scanning React/HTML code, look for:111112- **Pre-checked checkboxes:** `defaultChecked`, `checked={true}`, `defaultValue`113- **Timers:** `setInterval`, `countdown`, `setTimeout` in UI context114- **Exit intent:** `beforeunload`, `mouseleave` event handlers115- **Fake activity:** Random name generators, `Math.random()` for "people viewing"116- **Confirmshaming:** Decline button text containing guilt language117- **Visual hierarchy:** Compare CSS of accept vs reject buttons (size, color, opacity)118- **Hidden costs:** Fees revealed only in final checkout step119- **Auto-add to cart:** Items added without explicit `onClick` from user120121## Reference122123Full taxonomy with IDs, examples, keywords, and prevention strategies is in:124`src/lib/mcp/data/dark-patterns.ts`125126Source: "Unmasking Dark Patterns" (arXiv:2406.01608v1) + Mathur et al. (2019), Gray et al. (2023)
LeonMelamud