Sniff

One command. Eight checks. Zero config.
_{Source bugs, dead links, API endpoints, accessibility, visual regression, performance, AI exploration, and cross-referencing. All in one pass.}

What is this?

You ship features. But did you actually test them?

sniff is an AI-powered QA tool that scans your project for real problems: leftover debugger statements, dead links, API endpoint issues, accessibility violations, visual regressions, performance budget breaches, and adversarial edge cases. It runs eight checks in a single command and cross-references source code with browser behavior for high-confidence findings.

npx sniff-qa

That's it. No config files. No signup. No API keys. It just works.

Key facts

• What: Open source AI-powered QA testing tool that runs 8 checks in a single command: source scanning (6 rule categories + dead links + API endpoint discovery), accessibility audits, visual regression, performance budgets, AI-driven exploration, and source/browser cross-referencing
• Who it's for: Frontend and full-stack developers who want automated QA without configuring multiple tools
• How it works: Uses Playwright for browser automation, axe-core for WCAG accessibility, Lighthouse for performance, pixelmatch for visual diffs, and Anthropic Claude for adversarial AI exploration
• Install: npx sniff-qa (zero config, no signup, no API keys required for base checks)
• Comparable to: Combines Lighthouse CI + Pa11y + BackstopJS into one tool, plus source code scanning and AI-driven edge case discovery that no other tool offers
• Unique: First QA tool with native MCP (Model Context Protocol) integration. Flakiness quarantine system isolates non-deterministic test results automatically

Quick start

The source scan finishes in seconds. The full audit adds accessibility, visual regression, performance, and AI exploration on top of it.

[!TIP] Drop your URL in sniff.config.ts once and you can just run sniff for the full audit every time.

The three modes

graph LR
    A["🔍 Quick Scan<br/><sub>npx sniff-qa</sub>"] --> B["Source bugs only<br/><sub>No browser needed</sub>"]
    C["🛡️ Full Audit<br/><sub>npx sniff-qa --url URL</sub>"] --> D["All 8 checks<br/><sub>Source + Browser + Xref</sub>"]
    E["🏗️ CI Mode<br/><sub>npx sniff-qa --url URL --ci</sub>"] --> F["Deterministic<br/><sub>Skips AI explorer</sub>"]

    style A fill:#fef2f2,stroke:#ef4444,color:#7f1d1d
    style B fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
    style C fill:#fef2f2,stroke:#ef4444,color:#7f1d1d
    style D fill:#fee2e2,stroke:#ef4444,color:#7f1d1d
    style E fill:#fef2f2,stroke:#ef4444,color:#7f1d1d
    style F fill:#fee2e2,stroke:#ef4444,color:#7f1d1d

npx sniff-qa                                   # quick scan (no browser)
npx sniff-qa --url http://localhost:3000       # full audit (everything)
npx sniff-qa --url http://localhost:3000 --ci  # ci mode (skips AI explorer)

CI mode auto-skips the AI explorer because it is non-deterministic. Everything else runs exactly the same.

What it checks

How it works

Your code goes in. A report with actionable findings comes out. When you provide a URL, sniff also runs browser checks and cross-references source findings with runtime behavior for high-confidence results. You don't configure anything.

Compared to

[!IMPORTANT] Sniff is the first QA tool with native MCP integration. Your AI editor can trigger scans, read results, and fix issues without you switching context.

Source scanning rules

Sniff ships 6 rule categories that run on every scan. No browser needed.

Dead link checker

Scans .md, .html, .jsx, .tsx, .vue, .svelte, and .astro files for links and validates them:

• Internal links: Checks the target file exists (with extension resolution and index file fallback)
• External links: Sends HTTP HEAD requests with timeout, retry, and GET fallback for servers that reject HEAD
• Anchor links: Validates #section references against markdown headings and HTML id/name attributes
• Smart skipping: Ignores mailto:, tel:, data:, javascript:, and template variables

HIGH  README.md:28        Broken internal link: ./missing-guide.md
MED   docs/api.md:15      HTTP 404: https://example.com/old-endpoint
MED   CONTRIBUTING.md:8   Anchor #setup-guide not found in ./README.md

API endpoint discovery

Automatically discovers API routes from 8 frameworks:

For each endpoint, sniff checks for:

• Missing error handling (no try/catch or error middleware)
• Missing input validation on POST/PUT/PATCH routes (no zod, joi, yup, etc.)
• Missing auth middleware on non-public routes
• Hardcoded secrets (API keys, tokens, Stripe keys, GitHub tokens)

CRIT  src/routes.ts:12    Hardcoded Stripe key in POST /checkout handler
MED   src/api.ts:5        POST /users has no input validation
MED   src/api.ts:18       GET /admin/data has no error handling
LOW   src/api.ts:25       GET /admin/data has no visible auth middleware
INFO  Discovered 6 API endpoints (express: 4, nextjs-app: 2)

Cross-reference engine

When you run sniff with --url, the cross-reference engine correlates source code findings with browser runtime behavior. Findings confirmed in both layers get bumped severity and a HIGH confidence tag.

5 correlation strategies:

CORROBORATED (source + browser evidence)
  src/handler.ts:42  console.log("debug data")
    Source: debug-console-log rule triggered
    Browser: console.log output captured at /dashboard
    Confidence: HIGH (confirmed in both layers)

Architecture

Example output

Works with your stack

No config needed. Sniff auto-detects your framework from package.json and source files.

🔌 Use with your AI editor

Sniff ships an MCP server. Pick your tool and copy the snippet.

claude mcp add sniff-qa npx sniff-qa --mcp

{
  "mcpServers": {
    "sniff-qa": { "command": "npx", "args": ["sniff-qa", "--mcp"] }
  }
}

{
  "mcpServers": {
    "sniff-qa": {
      "type": "stdio",
      "command": "npx",
      "args": ["sniff-qa", "--mcp"]
    }
  }
}

{
  "mcpServers": {
    "sniff-qa": { "command": "npx", "args": ["sniff-qa", "--mcp"] }
  }
}

codex mcp add sniff-qa -- npx -y sniff-qa --mcp

[mcp_servers.sniff-qa]
command = "npx"
args = ["-y", "sniff-qa", "--mcp"]

{
  "mcpServers": {
    "sniff-qa": { "command": "npx", "args": ["sniff-qa", "--mcp"] }
  }
}

mcpServers:
  sniff-qa:
    command: npx
    args: [sniff-qa, --mcp]
    type: stdio

{
  "servers": {
    "sniff-qa": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "sniff-qa", "--mcp"]
    }
  }
}

clawhub install sniff-qa

{
  "mcpServers": {
    "sniff-qa": {
      "command": "npx",
      "args": ["-y", "sniff-qa", "--mcp"]
    }
  }
}

Once configured, ask: "Scan this project for issues" or "Check accessibility on localhost:3000".

MCP tools exposed: sniff_scan (source), sniff_run (browser), sniff_report (last results).

Install

npm install -D sniff-qa

{
  "scripts": {
    "qa": "sniff --url http://localhost:3000"
  }
}

Then run npm run qa. Requires Node.js 22+. Playwright browsers install automatically the first time.

🏗️ CI integration

npx sniff-qa ci

Generates .github/workflows/sniff.yml with Playwright caching, JUnit output, flakiness quarantine, and report artifacts.

Flakiness quarantine. Tests that fail 3 of 5 runs get quarantined. They still run, still appear in reports, but won't block your pipeline.

All commands

sniff                       quick scan (source only)
sniff --url <url>           full audit (everything)
sniff --url <url> --ci      ci mode (no AI explorer)

sniff init                  scaffold sniff.config.ts
sniff ci                    generate .github/workflows/sniff.yml
sniff report                show last results
sniff update-baselines      accept current screenshots as baselines

Configuration

import { defineConfig } from 'sniff-qa';

export default defineConfig({
  browser: {
    baseUrl: 'http://localhost:3000',
  },
  viewports: [
    { name: 'mobile', width: 375, height: 667 },
    { name: 'desktop', width: 1280, height: 720 },
  ],
  performance: {
    budgets: { lcp: 2500, fcp: 1800, tti: 3800 },
  },
  visual: { threshold: 0.1 },
  exploration: { maxSteps: 50 },
  flakiness: { windowSize: 5, threshold: 3 },

  // Dead link checker (new in v0.2)
  deadLinks: {
    checkExternal: true,      // validate external URLs via HTTP
    timeout: 5000,            // ms per request
    retries: 2,               // retry failed requests
    ignorePatterns: [],       // regex patterns to skip
    maxConcurrent: 10,        // parallel HTTP requests
  },

  // API endpoint discovery (new in v0.2)
  apiEndpoints: {
    checkErrorHandling: true, // flag missing try/catch
    checkValidation: true,    // flag missing input validation
    checkAuth: true,          // flag missing auth middleware
    checkSecrets: true,       // flag hardcoded secrets
    frameworks: [],           // empty = auto-detect all
  },

  // Disable specific rules
  rules: {
    'debug-console-log': 'off',     // example: allow console.log
    'dead-link-internal': 'off',    // example: skip dead link checks
  },
});

🔒 Trust and privacy

[!NOTE] The AI explorer requires an Anthropic API key only if you want the chaos monkey feature. The other seven checks (source scanning, dead links, API endpoints, accessibility, visual regression, performance, cross-referencing) work completely offline with zero external calls. External link checking in the dead link scanner makes HTTP requests to validate URLs, but never sends your code.

Built on

Playwright · axe-core · Lighthouse · pixelmatch · Zod · MCP SDK · Anthropic SDK

Contributing

Easiest way in: add a source rule. Each rule is a regex pattern with a severity level in src/scanners/source/rules/. See CONTRIBUTING.md.

Good first contributions:

• 🔧 Add a new source scanning rule
• 🐛 Report a false positive
• 📚 Improve documentation

License

Apache 2.0

_{Built by Adam Boudjemaa · Apache 2.0 · No telemetry · No data collection}