Skip to content
PropushHub

AI Developer Tool / Automated QA

AI QA Agent

An AI-powered software testing and production-readiness platform that connects a repository, frontend URL, and backend URL to inspect software and produce evidence-backed findings.

Note: AI QA Agent is an automated developer inspection and QA assistance platform. It assists engineering teams with automated checks and readiness reporting, and does not replace formal manual security audits or certified third-party penetration testing.

Open live demoSource codeCLI Package on npm
Project type
AI Developer Tool & Automated QA Monorepo
Status
Live Web Dashboard + Published npm CLI Agent
Built with
Next.js, TypeScript, Playwright, Node.js CLI

Overview

About AI QA Agent

Context

AI QA Agent was architected to bridge the gap between cloud dashboards and real local test execution. Instead of simulating test passes in a browser, the platform pairs a Next.js web dashboard with a local CLI agent (`agents/local-agent`) that runs real test suites, Playwright browser checks, API probes, and static security scans on the developer’s machine, reporting actual exit codes and command-audit trails.

The problem

Evaluating whether a web application is ready for production involves running unit tests, E2E browser checks, accessibility audits, API health probes, and secret/XSS scans—tasks that are tedious to coordinate manually and risky to hand over to unrestricted shell agents.

The solution

We engineered a 13-workspace TypeScript monorepo (`apps/web`, `agents/local-agent`, and 11 specialized `packages/*`) governed by a strict Command Policy Engine that classifies every command by risk (`READ` → `BLOCKED`), refuses direct pushes to `main`/`master`, and requires human approval before opening a GitHub pull request.

AI QA Agent is a multi-package monorepo engineering platform combining a Next.js + TypeScript web dashboard with an isolated Local Agent CLI (`@syedmuhammadali-dev/ai-qa-agent`). It connects a GitHub repository, frontend URL, and backend URL to execute real test suites, Playwright headless-browser smoke/accessibility (`axe-core`)/visual regression checks, API endpoint probing, static security scanning (XSS, CORS, exposed secrets), and command-policy gated auto-fix workflows—producing weighted production-readiness reports and SHA-256 verified exports.

Features

What it does

  • 01

    Isolated Local Agent CLI (`agents/local-agent`)

    Pairs with the web dashboard so shell commands, filesystem checks, and headless Playwright browsers execute safely in an isolated local environment rather than on a shared serverless runtime.

  • 02

    Command Policy & Patch Risk Classification

    Every command and AI-proposed patch is classified (`SAFE`, `REVIEW REQUIRED`, `DANGEROUS`). Dangerous patches cannot be auto-applied, and `git push origin main` is blocked at the policy layer.

  • 03

    Multi-Engine QA & Static Security Scanning

    Dedicated monorepo packages for `qa-engine`, `browser-agent` (Playwright smoke, axe-core accessibility, visual regression), `api-tester`, `code-analyzer` (circular dependencies, oversized files), and `security-engine` (static secret, injection, XSS, and CORS scanning).

  • 04

    Transparent Readiness Reports & Verified ZIP Export

    Computes a weighted production-readiness breakdown directly from real command-audit history, exportable as JSON, Markdown, HTML, or a cleaned ZIP archive with SHA-256 integrity verification.

How it works

Architecture and workflow

Structured as a pnpm TypeScript monorepo with `apps/web` (Next.js dashboard), `agents/local-agent` (CLI runner), and 11 modular packages (`ai`, `github`, `command-policy`, `qa-engine`, `browser-agent`, `api-tester`, `code-analyzer`, `security-engine`, `report-generator`, `project-analyzer`, `agent-core`), backed by Vitest unit/integration suites and Playwright E2E/visual tests.

  1. 01

    Connect Repository, URLs & Local Agent

    The developer links a GitHub repository, frontend/backend URLs, and pairs the local CLI agent from their terminal.

  2. 02

    Policy-Gated Inspection & Testing

    The local agent executes the project’s test suite, Playwright browser checks, API probes, and static security analyzers under the user’s selected permission mode.

  3. 03

    Evidence-Backed Diagnosis & Safe Patch Review

    Failures are analyzed using the user’s BYOK AI key; approved safe patches are written locally and verified against the regression suite.

  4. 04

    Report Export or Human-Confirmed PR

    Users export the readiness report (JSON/MD/HTML/ZIP) or review the diff plan to open a branch and pull request on GitHub.

Technology

Tools used

Dashboard & Monorepo

  • Next.js
  • TypeScript
  • pnpm Workspaces
  • Command Palette (Cmd/Ctrl+K)

QA & Analysis Packages

  • Playwright
  • axe-core
  • Vitest
  • Custom AST/Static Analyzers

Security & Governance

  • Command Policy Engine
  • Secret / XSS / CORS Scanner
  • SHA-256 ZIP Pipeline

Integrations

  • GitHub OAuth & REST Client
  • Firebase Emulator & Cloud
  • OpenRouter / Gemini / OpenAI

Challenges

Problems we solved along the way

  • Challenge 01

    Allowing automated test execution and patch verification without risking destructive shell commands

    Resolution: Built `packages/command-policy` to gate every command against risk tiers and enforce server-side blocks on dangerous operations and direct main-branch pushes.

  • Challenge 02

    Ensuring exported project archives never leak local credentials

    Resolution: Created a multi-stage export pipeline that scans for secrets, cleans artifacts, validates structure, and computes a SHA-256 checksum.

Related services

Need something similar?

Start a project

Want something like AI QA Agent? Let’s talk.

Share a few details and get a clear scope and a written quote. No obligation.

Get a free quote
Chat on WhatsApp
  • Free consultation
  • Written quote
  • Reply within 1 business day