Open-source CLI · GitHub Action · runs in your browser

Will your app make it across the border?

marz reads your code and tells you which services are blocked, sanctioned or unavailable in Iran, China and Russia: Firebase, Google Maps, reCAPTCHA, OpenAI, Stripe, YouTube and more. It cites a source for each verdict and suggests alternatives that work there.

curl -fsSL https://mrzroot.github.io/marz/install.sh | sh

Single binary, no dependencies. The installer resumes broken downloads and checks SHA-256. Then run marz in your project.

DEPARTURES · your-app--:--

ServiceToStatus

Statuses from marz's knowledge base, updated 2026-10-16

Scan right here

This is the real marz scanner compiled to WebAssembly. Edit the sample files, paste your own, or open a folder. Nothing is uploaded; it all runs in your browser.

Open a folder… Loading scanner…

Four commands

`marz`

Scans code and 12 manifest formats: npm, pip, Poetry, Go, Flutter, Gradle, Maven, CocoaPods, Composer, Bundler, Dockerfiles and compose files. Output as text, JSON, Markdown or SARIF, with --fail-on for CI.

$ marz --country IR --fail-on high
CRITICAL Firebase (backend)
   IR ⊘ sanctioned
   src/firebase.ts:6 shop-demo.firebaseapp.com
   IR: → Supabase · Appwrite · Liara / ArvanCloud

`marz probe`

Run it from inside the country. It tests DNS, TCP, TLS and HTTP step by step and recognises the Iranian filter's 10.10.34.x DNS answers, block pages, Cloudflare 1009, CloudFront geo-blocks and the AI APIs' "unsupported country" errors.

$ marz probe --from . -v
✖ generativelanguage.googleapis.com  geo-blocked
    Google: user location is not supported
✓ api.anthropic.com  ok  (HTTP 401: wants a key)

`marz check`

Live evidence from OONI's measurements inside each country. Real output from 2026-10-16:

$ marz check www.youtube.com --country IR,RU
IR  blocked: 4762 measurements,
    93% anomalous, 3250 confirmed
RU  likely blocked: 49598 measurements,
    55% anomalous

`marz fix fonts`

The most common issue, fixed for you: it downloads the Google Fonts woff2 subsets into your web root and rewrites your <link> and @import tags.

$ marz fix fonts --write
public/index.html
  - https://fonts.googleapis.com/css2?family=Inter…
  + ./fonts/inter-a3675e7a.css
Self-hosted 7 font file(s) (213 KB)

What the statuses mean

blockedFiltered by the state censor.
sanctionedThe provider refuses users or developers from the country.
unavailableThe service doesn't operate or sell there.
degradedThrottled, slow or unreliable.
unknownNo reliable public data. marz says so instead of guessing; run probe.
okWorks, as far as public sources say.

In every pull request

The GitHub Action adds a Markdown report to the job summary, can upload SARIF to code scanning, and fails the build at the severity you choose.

- uses: mrzroot/marz@v0.1.0
  with:
    countries: IR,CN
    fail-on: high
    sarif: true

Is there anything like it?

The closest tool checks deployed sites for China only. Nothing else we found reads your repository and covers sanctions as well as censorship.

	Reads your code	Countries	Sanctions too	Sources and alternatives	Live probe	Open source
marz	✓ code + 12 manifests	IR CN RU	✓	✓	✓	✓ MIT
China Site Scanner	deployed site's HTML/JS	CN	✗	✓	✗	✗
voidly-check-action	✗ you list domains	many	✗	✗	✓ API	✓
StackBreak lab	✗	CN	✗	✗	✓	✓
CheckFiltering	✗	IR	✗	✗	DNS	✓

Honest limits: marz knows 30-odd services, not everything. Censorship changes, so unknown means "probe it". It is not legal advice about sanctions.