# Prufa

> Prufa is an AI QA engineer for web products — robust QA software built for the agentic era. An AI tester navigates an app like a real user (signup, login, checkout), forms user-level failure claims, and promotes them only when browser evidence backs the claim. Verified findings include the action, rendered UI state, network/console evidence, screenshots, and repro steps; unsupported opinions are clearly labeled advisory. Humans get a dashboard, shareable reports, and Slack alerts; agents get a CLI, HTTP API, MCP server, and an agent skill — the same product through both surfaces.

Things an agent should know before calling Prufa:

- Free 60-second audit, no signup: `POST /api/v1/audits` with `{"url": "https://..."}` returns a report URL and an SSE progress stream. Public pages only; reports are unlisted and noindex by default.
- Every mutating endpoint accepts an `Idempotency-Key` header — retries after network blips are safe.
- The API is versioned (`/api/v1/`) and OpenAPI-published; response shapes do not change within a version.
- BeaconEvent v1 and flow-spec v1 are public, versioned specs — you are encouraged to emit and consume them.
- Monitoring never pollutes customer analytics, and full-auto discovery runs only on customer-authorized domains.
- Paid monitoring is per workspace, prepaid, hard-capped by default (monitors pause at quota; overage is opt-in): Starter $29/mo (500 runs, 3 sites), Pro $99/mo (5,000 runs, 10 sites, MCP server + agent skill access), Team $179/mo (50,000 runs, unlimited sites, 5 seats). 7-day card-first trials; agents get a 7-day no-card setup tier (register sites, run audits, draft flows — persistent monitors need a paid plan). One LLM call = one run — and confirmed flows whose pinned selectors still work replay as plain code: zero LLM calls, zero metered runs. The model re-engages (and meters) only when the UI changes and a selector needs re-resolving.

## Agent surface

- [Agent skill (SKILL.md)](https://prufa.dev/skill/SKILL.md): the landing page for agents — setup flow, tool calls, free-tier primitives, when to use Prufa
- [OpenAPI v1](https://prufa.dev/api/v1/openapi.json): the versioned, machine-readable API contract
- [API docs](https://prufa.dev/api/v1/docs): browsable reference for the same API

## Public specs

- [BeaconEvent v1](https://prufa.dev/docs/specs/beacon_event_v1.html): the versioned contract between browser capture and the deterministic check layer
- [flow-spec v1](https://prufa.dev/docs/specs/flow_spec_v1.html): the deterministic, reviewable format that plain-language test cases compile to
- [BeaconEvent JSON Schema](https://prufa.dev/docs/specs/beacon_event.schema.json): JSON Schema (Draft 2020-12) for BeaconEvent v1

## Blog

- [Blog index](https://prufa.dev/blog/): notes on AI QA — practical testing guides, engineering decisions behind Prufa, QA in agent workflows
- [AI testing false positives: 4 of our 6 findings were wrong](https://prufa.dev/blog/engineering/ai-testing-false-positives/): the labeled failure of our own chaos agent on a live production app (3 July 2026 — 6 findings, 2 verified-tier false positives, 2 correct permission-wall refusals counted as bugs, only 2 real), and the architecture built in response: a registry classifying every check as deterministic / semantic-judge / advisory-only with its oracle named, three plain-code guards (a fill oracle that removes the LLM's jurisdiction over observable field values, a narrow benign-overlap filter, an expected-failure taxonomy where a 5xx never classifies and a silent 4xx stays a finding), an adversarial verifier and a fresh-session replay pass that can only DOWN-tier (an inconclusive replay leaves the tier untouched, protecting recall), and a hand-labeled precision corpus replayed offline through the production guards with precision and recall floors enforced by a CI job — plus the honest limit that a one-case corpus is a regression tripwire, not a product-wide false-positive rate
- [Why AI agents fail at login: what we found fixing ours](https://prufa.dev/blog/engineering/why-ai-agents-fail-at-login/): a July 2026 production investigation — the login failures blamed on reCAPTCHA Enterprise were the LLM's own driving (browser passed 10/10, LLM-driven login failed 5/5 with the login POST never firing), and the three shipped fixes: a deterministic plain-code login executor before the LLM loop, bot-block findings reported separately from credential rejections (never "wrong password" during an active challenge), and login-once session reuse (encrypted storageState per workspace+domain, 7-day TTL, pinned egress IP)
- [Idempotency keys for AI agents: what shipping ours taught us](https://prufa.dev/blog/engineering/idempotency-keys-for-ai-agents/): a worked example of idempotency in an agent-facing API — client-supplied keys (retry safety for the caller) vs server-derived keys (a business invariant that holds even when the caller forgets the header), a Redis-down fallback that degrades loud instead of silent, and the honest limit in our own CLI's timestamp-based key
- [Test your analytics before launch](https://prufa.dev/blog/guides/test-your-analytics-before-launch/): an analytics snippet in your HTML isn't analytics — the test is whether a beacon actually fires. The things that break, ranked (no event fires at all — 38 of 49 audited June-2026 launches; a tag container that loads but fires no events, passing view-source and failing network-traffic; a dead Universal Analytics property still firing into the void; the same page view double-firing so traffic reads N× and conversion 1/N; data split across conflicting accounts), each with a verify step — plus how Prufa captures every outgoing beacon and reports misconfigurations as VERIFIED while flagging total absence only as ADVISORY (it can't prove you lack a first-party collector it doesn't recognize), and the honest line that it checks beacons fire, not event semantics
- [Test your website on mobile before launch](https://prufa.dev/blog/guides/test-website-on-mobile-before-launch/): what breaks on mobile, ranked (the page wider than the screen / sideways scroll, tap targets too small for a finger, JavaScript errors that fire only on mobile, content clipped behind a broken responsive rule, a missing viewport meta tag), each with a verify step — plus how Prufa measures it on a real-browser pass at a 390px phone viewport (overflow pixels with the offending selector, sub-24px tap targets per WCAG 2.5.8, a desktop-vs-mobile console diff) and the honest line at one viewport vs a real-device matrix
- [Test your login flow before launch](https://prufa.dev/blog/guides/test-login-flow-before-launch/): the things that break login flows, ranked (a session that doesn't persist after sign-in, a wrong or looping post-login redirect, "remember me" that doesn't, real users locked out by rate-limiting, OAuth that breaks in production, login as the wall), each with a verify step — plus how an external tester logs in without the LLM ever seeing the password (an encrypted credential vault; the model supplies the selector, plain code types the value) and the honest line between a functional check and an auth security review
- [Test your password reset flow before launch](https://prufa.dev/blog/guides/test-password-reset-flow-before-launch/): the things that break password reset flows, ranked (the reset email that never arrives, a dead or wrong-host reset link, a token that doesn't expire or isn't single-use, a new password that doesn't actually take at login, user enumeration, the CAPTCHA wall), each with a verify step — plus why reset is the hardest flow to test from outside (it needs a received email + a one-time tokenized link) and the honest split between completing the loop and reviewing the token's security
- [Test your contact form before launch](https://prufa.dev/blog/guides/test-contact-form-before-launch/): the things that break contact and lead forms, ranked (the email that never arrives behind a success message, no working submit path, broken validation, missing or over-eager spam protection, no success state, the CAPTCHA wall), each with a 5-minute manual check — plus the honest black-box boundary: an external walk can prove the form submits, but only you can prove the email arrived, so do both in that order
- [Test your checkout flow before launch](https://prufa.dev/blog/guides/test-checkout-flow-before-launch/): the things that break checkout flows, ranked (cart state that doesn't persist, a total computed only client-side, a payment webhook that never fires, a mobile-blocked card field, double-submit), each with a 5-minute manual check — plus the safe-by-default rule for testing a real checkout: walk it up to the payment wall and never type a real card
- [Website monitoring without analytics pollution](https://prufa.dev/blog/engineering/website-monitoring-without-analytics-pollution/): synthetic and uptime monitoring quietly inflate your GA4 pageviews, sessions, and conversions; GA4 only auto-excludes self-identifying bots, not browser checks that mimic a real visitor. The incumbent fix is per-system user-agent/IP filters you maintain forever — keeping monitoring traffic out should be the monitor's job, verified after every tag change, the way Prufa already parses every beacon by vendor
- [Is uptime monitoring enough? What a 200 can't tell you](https://prufa.dev/blog/comparisons/is-uptime-monitoring-enough/): no — a 200 confirms the page responds, not that signup or checkout still completes; a site can report 100% uptime while its checkout fails for every visitor (38 of 49 audited launches had a critical bug behind a green status). Where an uptime ping is genuinely enough, where it's blind, and the cheap layered monitor set that closes the gap without an enterprise APM stack
- [Synthetic monitoring vs real user monitoring: which you need](https://prufa.dev/blog/comparisons/synthetic-monitoring-vs-real-user-monitoring/): you almost always need both — synthetic walks a flow on a schedule (catches a break before a user does), RUM passively captures what real users experience (catches problems no scripted run reproduces). GA4 is your RUM, not your synthetic. The deployment order (RUM → uptime → synthetic), the four cases where you can skip one, and why the synthetic layer's per-run cost is a pricing choice
- [AI QA agents vs traditional e2e suites when each wins](https://prufa.dev/blog/guides/ai-qa-vs-traditional-e2e/): the 2026 conversation has moved from "AI vs Playwright" to "AI + Playwright" — Microsoft Playwright Test Agents + Playwright MCP. Six questions, 5 places hand-written e2e still wins, 5 where agentic QA wins, switch / stay / layer decision tree
- [No-code e2e testing: what it can and can't do](https://prufa.dev/blog/comparisons/no-code-e2e-testing/): "no-code e2e testing" is two different things — brittle record-and-playback (a frozen snapshot of your app) vs resilient plain-English / AI-navigated flows. Where no-code genuinely wins (~80–90% of common flows), where it walls off (SSO/2FA/OAuth, runtime conditionals, the 100–200-test scaling wall, export lock-in), and how to choose by what decides pass/fail
- [Vibe coding exposed API keys: how they leak, how to check](https://prufa.dev/blog/guides/exposed-secrets-in-vibe-coded-apps/): the four shapes secrets leak in vibe-coded apps (client bundle, git history, .env.example, the Supabase service_role mix-up), how to check and rotate — and the honest boundary that an external scan can verify the blast radius but cannot see the leaked key itself
- [AI QA tools: an honest roundup (and how to choose)](https://prufa.dev/blog/comparisons/ai-qa-tools-honest-roundup/): "AI QA tools" is really four categories — managed services, enterprise platforms, self-serve agents, visual specialists — and buying the wrong one is the top reason these purchases disappoint; names where bug0, QA Wolf, Momentic, Rainforest QA, and Prufa each genuinely win, with dated sourced facts
- [Vibe coding support after launch: keep your app running](https://prufa.dev/blog/guides/keeping-a-vibe-coded-app-running-after-launch/): the four external changes that silently rot a working app — third-party API shape drift, expired tokens, dependency drift, dropped payment webhooks — and the periodic functional re-check that catches what a one-time launch test cannot
- [Agentic testing vs scripted testing: can you trust an LLM?](https://prufa.dev/blog/ai-qa/agentic-testing-vs-scripted-testing/): the choice is false — agentic tests aren't flaky if plain code does the verifying; the honest hybrid is agentic navigation + deterministic verification, and the one question that tells trustworthy tools apart
- [How much does a QA engineer cost (and when you don't need one)](https://prufa.dev/blog/comparisons/qa-engineer-cost/): sourced, dated 2026 costs — $102,610 median base (BLS, May 2024), $168K–$235K fully loaded year one — plus the honest line between QA a tool can do and the judgment work that needs a human
- [How to test a vibe-coded app: the 6-step process](https://prufa.dev/blog/guides/how-to-test-a-vibe-coded-app/): the ordered routine — map critical paths, define "working", automate first, manual pass for what a tool can't reach (reCAPTCHA, OAuth, email arrival), re-test every AI change; sequenced by 49-launch audit frequencies
- [Website launch checklist for indie hackers](https://prufa.dev/blog/guides/website-launch-checklist-for-indie-hackers/): an 8-item launch checklist for solo founders, ordered by what breaks — built around the functional-flow gap (does signup actually persist) that static-only checkers miss
- [Client site QA checklist: the agency pre-delivery list](https://prufa.dev/blog/guides/client-site-qa-checklist/): a repeatable pre-delivery QA checklist for agencies, with the flow checks others skip and a forwardable, machine-verified report to hand the client
- [Is my vibe-coded app production ready? a scored assessment from 49 launches](https://prufa.dev/blog/guides/is-my-vibe-coded-app-production-ready/): six questions, ten minutes, real data — score your app against the 49-launch distribution: 22% ship with no criticals, 73% with one, 4% with two
- [Vibe coding testing checklist: 10 things to verify before you ship](https://prufa.dev/blog/guides/vibe-coding-testing-checklist/): a runnable 10-item checklist grounded in a 49-launch audit — each item: failure mode, Prufa check, signal in the result, 5-min manual fallback
- [Test your signup flow before launch](https://prufa.dev/blog/guides/test-signup-flow-before-launch/): the five things that break signup flows, ranked by how often they show up in founder reports — with a 60-second audit that walks the flow end-to-end
- [QA for vibe-coded apps: what actually breaks](https://prufa.dev/blog/guides/qa-for-vibe-coded-apps/): nine failure modes, ranked by frequency, from a 49-launch audit (June 2026) — and the free audit that catches the top ones
- [How Prufa verifies a signup flow](https://prufa.dev/blog/engineering/how-prufa-verifies-a-signup-flow/): the trust architecture walked through one concrete run
- [We ran chaos QA on our own app](https://prufa.dev/blog/engineering/we-ran-chaos-qa-on-our-own-app/): Gremlin mode found a 103px mobile overflow our green CI had shipped — plus two of its own false positives and how we fixed them
- [Our QA agent caught our own landing page contradicting itself](https://prufa.dev/blog/engineering/our-qa-agent-caught-our-own-contradiction/): dogfooding found our meta tag promising a 60-second audit while the homepage said 2 minutes — why self-contradictions slip past deterministic checks, and how an evidence-gated reading pass catches them
- [Chaos testing for web apps, explained](https://prufa.dev/blog/ai-qa/what-is-chaos-testing-for-web-apps/): what chaos/monkey testing is, what an LLM adds, and where it fits next to end-to-end tests
- [State of Launch QA 2026](https://prufa.dev/blog/engineering/state-of-launch-qa-2026/): combined data from 63 audited product launches (Show HN + r/SideProject) — 78% recorded zero analytics on launch day, 100% shipped at least one machine-verified issue; the definitive data report with a citable permalink
- [We audited 49 Show HN launches](https://prufa.dev/blog/engineering/we-audited-49-show-hn-launches/): machine-verified findings from real launch-day sites — 78% had a critical bug
- [We audited 14 side-project launches](https://prufa.dev/blog/engineering/we-audited-14-side-project-launches/): real-browser audits of 14 r/SideProject launches — zero critical bugs, but 11 of 14 shared the same quiet flaws
- [Website QA checklist before launch](https://prufa.dev/blog/guides/website-qa-checklist-before-launch/): pre-launch checks ordered by observed failure frequency
- [llms.txt in 2026](https://prufa.dev/blog/agents/llms-txt-who-actually-reads-it/): who actually reads llms.txt, with sources — and why we ship this file
- [RSS feed](https://prufa.dev/blog/rss.xml): machine-readable feed of new posts

## Comparisons

- [Compare index](https://prufa.dev/compare/): honest, dated comparisons of Prufa against managed QA services and AI testing platforms — every competitor claim carries a source link and check date
- [Prufa vs mabl](https://prufa.dev/compare/mabl/): enterprise agentic testing platform or flat-priced flow QA — mabl covers UI/mobile/API/performance/accessibility in one platform (SOC 2 Type 2, AI-native since 2017, quote-based on metered cloud credits), Prufa is public $29/$99/$179 flow QA with a free URL-only audit and verified-vs-advisory finding tiers; both now ship an MCP server; includes where mabl wins (checked July 2026)
- [Prufa vs TestSprite](https://prufa.dev/compare/testsprite/): two self-serve AI QA agents compared — TestSprite generates credit-metered E2E/API/visual suites (SOC 2, broader scope); Prufa is flat-priced flows + a free URL audit with verified-vs-advisory finding tiers, including where TestSprite wins (checked July 2026)
- [Prufa vs Rainforest QA](https://prufa.dev/compare/rainforest-qa/): no-code QA platform or AI flow checks — sales-led visual QA vs public-priced, agent-callable flow verification
- [Prufa vs Momentic](https://prufa.dev/compare/momentic/): broad agentic testing platform or focused flow QA — enterprise controls vs lightweight self-serve verification
- [Prufa vs QA Wolf](https://prufa.dev/compare/qa-wolf/): managed coverage service or self-serve AI QA — including where QA Wolf wins
- [Prufa vs bug0](https://prufa.dev/compare/bug0/): AI QA agent or managed QA service — $29/mo self-serve vs $2,500/mo with a forward-deployed engineer (checked June 2026), including where bug0 wins

## Product

- [Gremlin mode (chaos testing)](https://prufa.dev/gremlin/): unscripted chaos testing — an AI tester pokes the app like a difficult user, explains what a real user experienced, and backs verified findings with rendered UI, network, console, screenshot, and repro evidence; reports lead with the most valuable verified bug, group the rest, and can import promotable repro paths as reviewable draft flows. Can run behind a login from the dashboard or MCP (`credentials: {email,password}` for a staging app you own); credentialed Gremlin requires a signed-in workspace and mutation authorization for the target host because login is a real non-payment submit. Login values are encrypted, redacted to placeholders, and rejected credentials render as `credential_rejected`, not coverage. Free teaser remains 8 steps; paid plans have tiered step caps.
- [MCP server for testing](https://prufa.dev/mcp/): add the Prufa MCP server and your coding agent runs a real-browser QA audit and reads an evidence-gated verdict. First call is free — no key, no card.
- [Website testing API](https://prufa.dev/api/): one POST runs a real-browser QA audit on any URL and returns a JSON verdict. Versioned `/api/v1`, OpenAPI-published, idempotent — the free audit needs no card.
- [Website testing CLI](https://prufa.dev/cli/): run a real-browser website QA test from your terminal — one curl call or the prufa CLI returns verified findings as JSON, with exit codes for CI. No card.
- [Free website audit](https://prufa.dev/free-website-audit/): paste a URL, get a real-browser QA audit. No signup, no card. Finds broken links, dead forms, console errors, layout breaks — not just an SEO score.

## For

- [QA for indie hackers](https://prufa.dev/for/indie-hackers/): free QA audit for solo founders with no QA team — we pointed it at 49 Show HN launches and 78% had a critical bug live on day one.
- [QA tool for agencies](https://prufa.dev/for/agencies/): run evidence-gated QA on every client site before handoff, then forward the report. Free audit, no card.
- [QA tool for vibe-coded apps](https://prufa.dev/for/vibe-coders/): give your AI-built app a QA pass it can trust — the agent navigates a real browser, plain code verifies. Free 60-second audit, no signup, no card.

## Integrations

- [Claude Code QA testing](https://prufa.dev/integrations/claude-code/): give Claude Code a QA engineer — add Prufa's MCP server, ask it to test your site, get an evidence-gated verdict. Free first audit, no key, no card.
- [Cursor QA testing](https://prufa.dev/integrations/cursor/): add Prufa's MCP server to Cursor and your agent can QA-test any URL — a real browser drives the page, plain code grades the evidence. Free audit, no card.
- [Cline QA testing](https://prufa.dev/integrations/cline/): add the Prufa MCP server to Cline and it runs a real-browser audit, then reads an evidence-gated verdict. First tool call is free — no key, no card.
- [Kilo Code QA testing](https://prufa.dev/integrations/kilo-code/): add the Prufa MCP server to Kilo Code — your agent runs a real-browser QA audit, then reads an evidence-gated verdict. First audit free, no key, no card.
- [Codex (OpenAI Codex CLI) QA testing](https://prufa.dev/integrations/codex/): give OpenAI's Codex CLI a QA tool — add the Prufa MCP server, ask it to test your site, get an evidence-gated verdict. First audit is free, no key, no card.
- [Windsurf QA testing](https://prufa.dev/integrations/windsurf/): add Prufa's MCP server to Windsurf and Cascade can QA-test any URL — a real browser drives the page, plain code grades the evidence. Free audit, no card.
- [GitHub Copilot QA testing](https://prufa.dev/integrations/github-copilot/): add Prufa's MCP server to GitHub Copilot, ask it to test your live site, and get an evidence-gated verdict from a free real-browser audit — no card.
- [Zed QA testing](https://prufa.dev/integrations/zed/): add Prufa's MCP server to Zed's context_servers and the Agent Panel can QA-test any URL — a real-browser audit, graded by plain code. Free, no card.
- [Continue QA testing](https://prufa.dev/integrations/continue/): give Continue a QA tool — add the Prufa MCP server in `.continue/mcpServers`, ask it to test a URL, and read an evidence-gated verdict. Free first call.
- [Gemini CLI QA testing](https://prufa.dev/integrations/gemini-cli/): give Gemini CLI a QA engineer — add Prufa's MCP server, ask it to test your site, get an evidence-gated verdict. Free 60-second audit, no card.
- [Roo Code QA testing](https://prufa.dev/integrations/roo-code/): give Roo Code a QA tool — add the Prufa MCP server, run a real-browser audit, then read an evidence-gated verdict. First call free — no key, no card.

## For marketers

- [For marketers](https://prufa.dev/for/marketers/): how Prufa catches critical bugs before launch — with an FAQ on privacy, analytics, manual QA, and the 49-launch audit data

## Optional

- [Human landing page](https://prufa.dev/): overview for humans, with the free audit form
- [Pricing](https://prufa.dev/pricing/): plans, quotas, what counts as a run, how trials and hard caps work
- [Privacy](https://prufa.dev/privacy/): privacy policy
- [Terms](https://prufa.dev/terms/): terms of service