I wanted to stop controllers calling external services, however deep in the call graph. So I built a PHPStan extension (still in beta): mark external calls as 'slow', forbid 'slow' in controllers, and let it flag violations. Probably has many other uses too. https://github.com/DaveLiddament/phpstan-effect-system