A software testing assistant that looks for bugs by reviewing an app as a confused user, an experienced user, or someone trying to misuse it. It can test a running app in a browser or inspect its source code.

Checking pages, forms, clicks, screenshots, and browser errors in a running app, or reviewing code when the app is unavailable. It is also used for bug hunting and quality reviews.

It helps find problems that normal development checks may miss after a work cycle is complete. It records issues clearly so developers can fix them.

qa-analyzer — Agent for Claude Code by drobins25/craft

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/drobins25/craft

Made for: Claude Code.

Or install craft, the plugin that ships this one along with the rest of its 11 skills, 36 commands, 27 agents, 7 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/drobins25/craft/qa-analyzer/github.svg)](https://agentmods.dev/agents/drobins25/craft/qa-analyzer)

Your own site

<a href="https://agentmods.dev/agents/drobins25/craft/qa-analyzer"><img src="https://agentmods.dev/badge/agents/drobins25/craft/qa-analyzer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/agents/drobins25/craft/qa-analyzer"><img src="https://agentmods.dev/badge/agents/drobins25/craft/qa-analyzer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 223 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 2,989 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00223	$0.02989
Opus 5.5	$0.00089	$0.01196
Sonnet 5.5	$0.00045	$0.00598
Haiku 4.5	$0.00022	$0.00299

Measured yesterday against content hash b0346b14c7d8, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

qa-analyzer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/qa-analyzer.md · 310 lines

How it starts

The opening of the file, as written. The whole thing — 310 lines — stays where its author put it; the contents beside it link to each section on GitHub.

QA Analyzer Agent

You are a world-class QA analyst with 15 years of experience breaking software. Your superpower: finding the bugs that developers miss. You think like a confused user, an impatient power user, and a malicious attacker — all at once.

Startup Check

Before analysis, determine your operating mode:

Try list_pages via chrome-devtools MCP
Clear any leftover craft:dial injection before analyzing - via evaluate_script, remove the craft-dial-style style element, the craft-dial-panel element, every [data-craft-dial-injected] node, and delete documentElement.dataset.craftDial; idempotent on a clean page, and a stale dial would poison what you see (see commands/references/dial-inject.md); then clear leftover annotate changes: run bash "<PLUGIN_ROOT>/hooks/scripts/annotate-run.sh" review-clear (PLUGIN_ROOT is in your brief). A printed () => { ... } line goes to evaluate_script verbatim; OPEN <id> <subject> lines mean leave the page as found and name each open run (id and subject) in your report; with no PLUGIN_ROOT or a failing command, skip this and say so in your report (see commands/references/annotate-overlay.md, "Clearing leftovers before a review")
If MCP tools available and pages open: Use Browser Mode — navigate, click, fill forms, take screenshots, check console errors. State this: "Browser mode — testing the running app."
If MCP tools available but no pages/app not loaded: Try navigating to the expected URL. If it fails: "App doesn't appear to be running. Switching to code review."
If MCP tools not available: Use Code Review Mode — analyze source with Read, Glob, Grep. State this: "Code review mode — MCP unavailable, analyzing source code."

Browser mode finds runtime bugs (broken flows, console errors, visual glitches). Code review finds static issues (missing validation, error handling gaps, type safety).

Code Review Mode calibration: When in code review mode, raise the bar for "Confirmed" findings — most should be "Likely" or "Needs Verification". You cannot observe runtime behavior, so do not claim to have confirmed bugs you haven't seen execute.

Read the full file on GitHub · 310 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday Changed b0346b14c7d8
12d ago Changed · -29 lines · +6 tokens per session aafa9bee767c
1mo ago First seen · 339 lines · 217 tokens per session scan A bb63df459849

Subscribe to this mod's changes

qa-analyzer is an agent published in the GitHub repository drobins25/craft (68 stars, last pushed yesterday), licensed MIT. It adds 223 tokens to every session and 2,989 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Debugging E2E testing Testing agentic-ai agentic-workflow ai-coding-assistant anthropic anthropic-claude claude

e2e-runner

End-to-end testing specialist using Playwright for critical user flows. Use PROACTIVELY when the user needs to verify complete user journeys, test cross-browser behavior, or validate UI interactions. Trigger on changes to user-facing features, forms, navigation, or authentication flows.

VersoXBT/claude-initial-setup · 60 tokens

backend-development-test-automator

Create comprehensive test suites including unit, integration, and E2E tests. Supports TDD/BDD workflows. Use for test creation during feature development.

wshobson/agents · 37 tokens

demo-warden

Use to verify the demo works end-to-end before rehearsal, before deploy, and before submission. Invoke at every hourly checkpoint from H+12 onward, and always after a deploy. Read-only — reports what is broken, never fixes it.

nitrocloudofficial/nitrostack · 52 tokens

checker

Fresh-context adversarial verification of completed work. Give it the claimed outcome plus the relevant diff or paths; it independently reruns tests, exercises the affected flow, probes edge cases, and returns CONFIRMED or REFUTED. Read-and-run only; it never plans, edits, or fixes anything.

cordwainersmith/Claudoscope · 63 tokens

visual-qa-subagent

Performs visual QA inspection using Playwright browser automation.

closedloop-ai/claude-plugins · 17 tokens

proof

QA & testing engineer — test strategy, E2E suites, integration testing, test infrastructure, flaky test triage.

tonone-ai/tonone · 25 tokens