What will this Istio config do to my traffic?
Paste or drop the Istio YAML for a service or a namespace - VirtualServices, DestinationRules, Gateways, PeerAuthentications, AuthorizationPolicies, and the Service and Deployment behind a host if you have them. Your browser reads every resource and checks it: routes to subsets no DestinationRule defines, canary weights that do not add up to 100, catch-all routes that shadow the ones below them, retries that cannot fit their timeout, fault injection and mirroring left on - and, for mutual TLS, the posture of every scope, DestinationRules that switch mTLS off toward a STRICT server and DENY policies that plaintext callers walk straight past. Free, before you sign in, and nothing is uploaded. Then pick a lane: the traffic audit writes the YAML fix for each finding, or the mTLS check writes the rollout to STRICT - checked against your paste before you trust it.
The services and hosts in the examples are invented. The first three are traffic audits, the last three mTLS checks; each comes with a saved model reply, so you can see the whole page without signing in or spending a credit.
The traffic audit confirms or dismisses every flag below, adds what rules cannot see, gives the YAML fix for each finding and says what each host's requests get today.
What this does, and what it does not
The check is a reading of the text, not a cluster: nothing talks to Kubernetes or istiod, and nothing knows which other resources exist. Each document is parsed with its line numbers, short host names are resolved against the namespace of the rule that names them (as Istio does), and each flag carries the catalogue id it comes from and the line it points at. Cross-resource checks only see what you paste: paste the DestinationRule with the VirtualService to have subsets checked, the Service and Deployment to have subset labels matched against real pods, and the root-namespace PeerAuthentication to have the mesh default read instead of assumed.
The paid lanes see your paste and the page's facts, and are told what the page cannot know. Every quote, line, posture mode and fix they return is checked against your paste. A paste stays in this browser unless you run a lane - never paste private keys or Secrets. Derived from the agent skills @wshobson/istio-traffic-management and @wshobson/mtls-configuration (wshobson/agents, MIT). Sources are listed in llms.txt.