{ "markdown": "\n \n \n \"sniff\"\n\n\n

\n \"npm\n \"CI\"\n \"License\n \"Stars\"\n

\n\n

English · 简体中文 · 日本語 · Español · Français

\n\n

Point it at your running app. It walks your real user flows in a real browser and tells you what is actually broken, with proof.

\n\n

What it does · Install · Use it · What you get · Works in your editor · Good to know

\n\n\"sniff\n\n```bash\nclaude plugin marketplace add Aboudjem/10x\nclaude plugin install sniff@10x\n```\n\n## What it does\n\nMost linters read your source without ever running your app, and end-to-end frameworks ask you to\nwrite and maintain the tests yourself. sniff opens your running app in a real browser, clicks and\nfills things like a user would, and judges what actually happened.\n\n- **It finds 12 classes of bugs**, from HTTP 500 routes and dead links to placeholder data, dead\n submit buttons, forms wiped by the back button, stuck spinners, and mobile overflow.\n- **It proves every one.** Every finding carries the route and the ordered steps that produced it,\n plus the screenshot and the console or network excerpt the check captured. No steps, no finding.\n- **It has been measured.** On a fixture app planted with 21 bugs across all 12 classes, plus a\n clean control page, sniff finds 21 of 21 and reports nothing on the control page.\n\n## Install\n\nThe block above is the Claude Code path, through the [10x marketplace](https://github.com/Aboudjem/10x).\nFor any other agent, the Vercel skills CLI installs the same three skills:\n\n```bash\nnpx skills add Aboudjem/sniff\n```\n\nTo use it as a plain command line tool, with no editor involved:\n\n```bash\nnpx sniff-qa --url http://localhost:3000\n```\n\nThe npm package is `sniff-qa` and the binary it installs is `sniff`. Do not run `npx sniff`, which\nis an unrelated package.\n\n
\nNode version, project install, and CI\n\nNode.js 22 or newer. `npm install -D sniff-qa` adds it to a project's devDependencies, and\n`npx sniff-qa ci` writes a GitHub Actions workflow with browser caching and report artifacts.\n
\n\n## Use it\n\n**1. Start your app,** with whatever dev server your project already uses.\n\n```bash\nnpm run dev\n```\n\n**2. Walk it,** from a second terminal. sniff auto-detects a dev server on the common ports, so\n`--url` is optional, but passing it takes the guesswork out.\n\n```bash\nnpx sniff-qa --url http://localhost:3000\n```\n\n**3. Read the findings.** They print grouped by severity. Below is an abridged real run against this\nrepo's own planted-bug fixture, from `npx sniff-qa --url http://localhost:4321 --ci --max-pages 12`:\n\n```text\nsniff v0.8.0 walking http://localhost:4321\n\n 26 findings (+1 low-confidence hidden; use --all)\n\n CRITICAL (1)\n • [confirmed] Page returns HTTP 500\n /crash (route/broken-page)\n - Navigate to /crash\n - Server responded with HTTP 500\n fix: The route throws server-side. Check the server logs/handler for this path and return a valid page or a proper error page.\n shot: sniff-reports/crawl/_crash-desktop.png\n\n✓ Scan complete: 26 issue(s) found. Exit code 1 so CI fails on bugs; pass --fail-on none to always exit 0.\n```\n\nAdd `--report` for a self-contained HTML page you can send to someone. Run `npx sniff-qa doctor` if\nthe environment looks wrong.\n\n\"How\n\n## What you get\n\n\n \n \n \"The\n\n\n- **A terminal report** grouped by severity, each finding with steps, a fix, and a screenshot path.\n- **A shareable file**, a self-contained HTML report with `--report` or JSON with `--json`.\n- **An exit code**, non-zero when findings reach the `--fail-on` severity, so CI fails on real bugs.\n- **A confidence label** on each. `uncertain` is hidden from the terminal unless you pass `--all`.\n\nNew in 0.8.0:\n\n- `--caps scan,report` narrows the MCP server to the source scan and the saved-results reader, with\n no browser launch and no browser download.\n- `--storage-state auth.json` walks a logged-in app. Cookie and token values from that file are\n redacted from the text of every written report, though not from screenshot pixels.\n- An `assert` block in `sniff.config` caps findings by severity (`maxCritical`, `maxHigh`,\n `maxTotal`), enforced on the command line by the walk, the source scan, and discovery.\n\n## Works in your editor\n\nWorks in Claude Code, Cursor, Codex, Copilot, Gemini CLI, and 70+ other agents through\n`npx skills add`. The skills are Markdown, so they run on whatever model your editor points at.\n\n| Agent | One-line install |\n|:--|:--|\n| Claude Code | `claude plugin install sniff@10x` |\n| Any of 70+ agents | `npx skills add Aboudjem/sniff` |\n| Codex, Gemini CLI, OpenCode, Pi | `./install.sh codex` |\n| VS Code (Copilot) | `./install.sh copilot` |\n| Everything else | see [docs/editors.md](docs/editors.md) |\n\n
\nAdd it as an MCP server instead\n\n```bash\nclaude mcp add sniff-qa npx -- -y sniff-qa --mcp\ncodex mcp add sniff-qa -- npx -y sniff-qa --mcp\n```\n\nCursor, VS Code, Gemini CLI, Windsurf, Continue, OpenCode, and Zed take the same command as a JSON\nor TOML entry. Every per-editor snippet is in [docs/editors.md](docs/editors.md).\n
\n\n## Good to know\n\n> [!IMPORTANT]\n> No API key, no account, no signup, and no AI provider unless you set one up yourself. Walking and\n> scanning never edit your source. `sniff fix` is the only command that rewrites code, and only when\n> you run it.\n\n> [!NOTE]\n> A walk clicks buttons and submits real forms, so it can create real data. Point it at a dev or\n> staging app, not at production. The first walk also downloads a Chromium build and caches it, so\n> that one run needs internet access.\n\n- **It wants a running app.** With no dev server up it falls back to a source-only scan and tells\n you how to start the real walk. `npx sniff-qa scan` runs that scan on purpose.\n- **Dead-link checking follows external links,** so a walk makes requests to the third-party URLs\n your own pages already link to.\n- **A walk that finds bugs exits 1** on purpose, so CI fails the build. That is not a crash.\n `--fail-on none` turns off the severity gate, though an `assert` budget can still fail the run.\n\n## Learn more\n\n- [docs/editors.md](docs/editors.md), install and MCP snippets for every supported agent\n- [docs/authenticated-walks.md](docs/authenticated-walks.md), walking a logged-in app with `--storage-state`\n- [docs/assert-budgets.md](docs/assert-budgets.md), capping findings by severity in `sniff.config`\n- [docs/comparison.md](docs/comparison.md), how sniff differs from linters, link checkers, and E2E frameworks\n- [docs/faq.md](docs/faq.md), the questions this page does not answer\n- [CHANGELOG.md](CHANGELOG.md) · [CONTRIBUTING.md](CONTRIBUTING.md) · [LICENSE](LICENSE)\n\n---\n\n

Built by Adam Boudjemaa · Apache 2.0 · standing on Playwright and axe-core

\n", "bytes": 9172, "sha": "2e464bdd3f7aacaaecb4b0c8baa7bb2879b4673c9ae78411a513a318334f66ae", "repo_slug": "aboudjem/sniff", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_aboudjem_sniff_ea9eb766/readme" }