brunoboto96/SceneScout

**Your coding agent, turned into an exploratory QA tester for any web app.**
Works with Claude Code · Cursor · VS Code (Copilot) · Codex CLI · Gemini CLI · Copilot CLI · Windsurf · any MCP client
🌐 Website · 📖 Guide · 🐛 What it catches · 🎬 QA with evidence · 🚀 Get started · 🚦 CI · 🔒 Safety · 📚 Docs
Scripted end-to-end tests answer one question: *does this exact flow still work?* They say nothing about the rest of the app. SceneScout lets the agent you already use explore a running web app like a curious, thorough tester. It clicks, fills forms, switches roles and calls the API behind a hidden button, then writes a report of what is **broken** and what could be **better**, with a picture and evidence for every line.
Try it on any app you are allowed to test. No account, no API key, no setup:
👥 Who it's for
| 🛠️ **Developers** | 🧑‍💼 **QA, product and non-technical teams** |
|---|---|
| Findings with the request that failed (GET /api/orders?status=archived → 500), the steps, and a Playwright regression-test skeleton | Each problem in plain words first: what was done, what was expected, what happened, and a picture of the page |
| Next to the source, the file behind the bug and a likely fix | Visible problems shown, not described: a covered button, a broken image, text too faint to read |
| A deterministic gate for pull requests, with SARIF for code scanning | Journeys recorded step by step, as frames and video, so a pass is something you can watch |
| Runs from your editor's agent, or unattended in CI | A test report laid out by **your** template, with expected and actual results, deviations and blank sign-off rows |
🐛 What it catches
A real run against the small demo app in this repository, which has bugs planted on purpose. The two you can see are outlined:
It filed twelve findings. A few from the report:
> **🔴 [HIGH] A double-click on Create order creates two orders**
> 2× click fired the same state-changing request 2× (POST /api/orders)
>
> **🔴 [HIGH] A clerk can approve an order by calling the endpoint the page hides from them**
> POST /api/orders/1037/approve 200 as clerk: the button was hidden, the server did not agree.
>
> **🔴 [HIGH] Filtering orders by Archived fails, and the page shows an empty table instead of an error**
> GET /api/orders?status=archived → HTTP 500
>
> **🟠 [MEDIUM] The "New: bulk import" badge sits on top of the All orders button** *(callout 1)*
> "All orders" overlaps "New: bulk import" (81%), measured from layout boxes, no screenshot needed.
What it looks for, on every page, after every action:
- 📐 **Broken layout, from geometry:** controls that overlap, sit off-screen, hide under a sticky bar or can never be scrolled into view. The CSS bugs a person spots at a glance, found without one.
- 🧨 **Real breakage:** console errors, crashes, failed requests, 4xx and 5xx responses, broken images, dead-end pages.
- 🔓 **Permission leaks:** it calls the app's own API as each role, so "the button is hidden" becomes "the server refuses it", or doesn't.
- 🤥 **Pages that lie:** "Saved!" after the server refused the save, or an empty table after the request failed.
- 👆 **Impatient users:** a double-click that sends the same order twice.
- ♿ **Accessibility and craft:** contrast, focus, labels, target sizes, spacing and type, with a 0 to 100 score per page.
- 🧭 **Friction:** how many steps a task takes, and where a user had to go back.
- 💉 **Security smells:** typed markup that comes back as an element, and tokens posted to any window.
Everything it checks.
🎬 Automated QA with evidence
Save the journeys that matter, the happy paths and the ones that must fail politely, and scenescout check replays them on every pull request with no model involved. Recorded, each run leaves proof you can watch and hand to someone who never opens a terminal.
A journey is a few lines of JSON, written by hand or kept from a flow your agent just walked. This is the demo's happy path: