lavanya776

QA Investigator AI — Testing skill for Claude Code

Testing community

AI exploratory QA agent: Claude Code + a custom MCP server drive Playwright and a controlled HTTP client to find, evidence and verify web app defects, with honest coverage metrics and HTML/JSON/Markdo.

How to install QA Investigator AI

This entry records only its repository, not the path inside it, so there is no exact command to give. Open lavanya776/QA-Investigator-AI and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What QA Investigator AI does

Alternatives in Testing

Regen API — Regenerate the OpenAPI spec and web API client after server API changes 2.5k ★
Spec Driven Development — Drive Kandev feature work through spec, plan, independent tasks, implementation, QA, and verification 697 ★
Design QA — Visual QA on an HTML/CSS implementation — checks responsive behavior at mobile/tablet/desktop, design token co 309 ★

README

QA Investigator AI

**An AI exploratory QA agent that investigates a web application the way a senior manual tester would. It plans by risk, collects evidence, confirms each defect by reproducing it, and writes an auditable report.**

![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6) ![MCP](https://img.shields.io/badge/Model%20Context%20Protocol-server-555) ![Playwright](https://img.shields.io/badge/Playwright-Chromium-2ead33) ![Node](https://img.shields.io/badge/Node.js-%E2%89%A520-339933) ![Claude Code](https://img.shields.io/badge/Claude%20Code-reasoning-d97757)

![QA Investigator UI: findings and coverage for the OrangeHRM investigation](docs/images/ui-findings.png)

What it is

QA Investigator AI pairs **Claude Code** (the reasoning) with a custom **Model Context Protocol (MCP) server** (the hands). Claude decides what the application is for, ranks risks, picks test techniques and judges expected against actual behaviour. The MCP server gives it a real browser, a controlled HTTP client, an evidence store, defect tracking with verification, coverage metrics and report generation.

It works on any website you are authorised to test. Nothing is hard-coded for one target, and it **does not generate brittle test scripts**: every browser or API action is a generic, one-off step.

Case study: OrangeHRM public demo

A read-only investigation of the public [OrangeHRM demo](https://opensource-demo.orangehrmlive.com/) covered the login page, the password-reset entry, navigation and the unauthenticated REST API.

Result	Value
Findings	6, all Confirmed by automated reproduction (2/2 attempts)
Severity	3 medium, 3 low, 0 high, 0 critical
Scenarios	18 planned, 18 executed: 9 passed, 1 partial, 5 failed, 3 blocked (with reasons)
Endpoint coverage	4 / 10 discovered endpoints
Mode	Read-only (GET/HEAD/OPTIONS), Chromium