# vibe-testing

Code-aware browser testing for AI coding agents. Reads your codebase so tests use real routes and field names, runs them in Playwright, remembers what broke, and reports what your last change fixed or regressed. No LLM calls inside. MCP server for Claude

- **Type:** MCP server
- **Trust:** 65/100 (B), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 0.4.5
- **Author:** Aishwary Shrivastav
- **License:** MIT
- **npm:** vibe-testing
- **Source:** https://github.com/AishwaryShrivastav/vibe-testing
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

65/100 (B), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: suspicious script found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** warnings
- **Scanned:** 2026-09-15T13:30:09.638Z
- **Version scanned:** 0.4.5
- **CVEs:** none found by OSV at scan time
**Findings**
- injection-shaped content (warning) in the `login` tool: Exfiltration-shaped instruction

## Tools

13 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `scan_codebase` — Analyze a project's codebase to understand its structure, routes, forms, components, existing tests, and coverage gaps. Returns a ProductModel with routes, beha
- `login` — Establish an authenticated browser session by executing a login scenario. Returns the post-login URL, token state, and a screenshot. Uses saved credentials from
- `scan_page_elements` — Navigate to a specific page and discover all interactive elements (buttons, links, inputs, selectors, checkboxes, tabs). Returns a structured list of elements w
- `explore_page` — Perform a full interactive exploration of a page: discover all elements, click buttons, fill inputs, test tabs, observe API calls, and report what happened. Ret
- `execute_scenario` — Execute a single test scenario (a sequence of navigate/fill/click/assert steps) and return detailed results with step-by-step logs, screenshots after each state
- `get_coverage` — Return the current test coverage map, identified gaps, and suggested tests. Prerequisite: scan_codebase must have been called first. Returns JSON with: coverage
- `generate_report` — Generate a self-contained HTML test report with embedded screenshots from all collected results, explorations, and coverage data. Returns the report file path a
- `take_screenshot` — Navigate to a URL and take a screenshot. Returns the screenshot as a base64 data URI that the editor LLM can see and reason about. Use this for quick visual ver
- `suggest_tests` — Analyze codebase features, existing test coverage, and results from previous runs to suggest concrete test scenarios that should be written or executed. Returns
- `run_full_test` — Run a complete end-to-end test suite: scan codebase → generate scenarios → execute all → explore pages → generate report. This is the all-in-one command. For mo
- `run_converge` — Iterative coverage: runs the full baseline suite, then automatically runs follow-up rounds targeting coverage gaps and failed scenarios until pass rate and gap 
- `get_context` — Retrieve the most relevant source files for a given feature or route. Returns actual source code (budget-capped) so you understand real field names, API endpoin
- `cleanup` — Close all open browsers and reset the session state. Call when done testing.

## Install

**Verdict: do-not-install** — Do not install: 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it.
**Blocking**
- 1 injection-shaped pattern found in this entry's own text — it may try to steer the model that loads it. — tool:login: Exfiltration-shaped instruction
**Client configuration withheld.** Client configs are withheld because this entry has a blocking finding. Show the warnings below to the person installing it.
If they have seen the findings and still want to proceed, request the plan again with acknowledge_warnings=true.

## Blast radius

Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on your machine; read-only tool surface.
- Floor 13, ceiling 31 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/vibe-testing
- Install plan: https://forgeregistry.com/api/v1/packages/vibe-testing/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/vibe-testing
- HTML page: https://forgeregistry.com/registry/vibe-testing
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.