Open source · Apache 2.0 · runs on your machine

Find the bugs in your web app before your users do.

One command opens your running app in a real browser, explores it like a careful tester, reproduces every bug it finds in a fresh browser context, and hands your coding agent a report it can fix from. No account. No key. Nothing leaves your machine.

npx breakmyapp test http://localhost:3000
Read the source
replaying a real run

What you get

Findings print the moment they reproduce. Everything else is written for the agent that will fix them.

Live findings

Each confirmed bug prints with its severity, the evidence line, and a one-line repro, usually within the first minute.

Reproduced, not guessed

Every candidate replays in a fresh browser context. If the failure does not happen again it is marked suspected and never scored.

A report and a test per bug

A standalone HTML report, findings.json for coding agents, screenshots, Playwright traces, and one failing Playwright test per finding.

Desktop and phone

A mobile pass catches horizontal overflow, covered controls, and menus that do not open. axe-core violations are listed separately.

Example report

This is a real report from fixtures/broken, the app with every defect class the engine must find.

breakmyapp-results/latest/index.html · 10 pages · 30 interactions · 40sOpen full report

Benchmark

The same SaaS brief, given to every popular AI app builder. Then BreakMyApp.

The brief, the generated apps, the prompts, and the full reports are published with the results. The first run has not been published yet; the harness is in the repository.

BuilderScoreConfirmed bugsPages testedReport
Lovablenot run yet
Boltnot run yet
v0not run yet
Replit Agentnot run yet
Cursornot run yet
Claude Codenot run yet
Codexnot run yet

Scores always appear with their coverage. A score reflects the areas tested, not the whole application. Method and brief: benchmark/.

Three loops

Find it, fix it, prove it. Then share the result.

The fix loop

Your coding agent drives BreakMyApp over MCP, finds a bug, reads findings.json, fixes it, and runs the exported Playwright test until it passes. No second API key.

claude mcp add breakmyapp -- npx -y breakmyapp mcp --allow-writes

The share loop

Render any confirmed finding as a 1200×675 card with the screenshot, the repro, and the score with its coverage. Add the badge to your README; it reads from a file in your repository.

npx breakmyapp card BMA-0001
npx breakmyapp badge

The CI loop

Test every preview deployment on every pull request. One comment per PR, edited on each run, with the score, coverage, and top findings. Fail the check at the severity you choose.

- uses: renderinc/breakmyapp/action@main
  with:
    url: https://pr-123.example.com
    fail-on: high

Privacy and safety

It tests the app you point it at, and only that.

What stays on your machine

  • Reports, screenshots, traces, and findings. The CLI makes no request except to your target and, with --ai anthropic, to Anthropic.
  • Authorization headers, cookies, bearer tokens, URL credentials, and secret-bearing query parameters are redacted before anything is written or sent to a model.
  • Telemetry is off until you say yes, once, after the first report. It never includes the URL or the findings. The exact payload is documented.

What it will not do

  • Leave the origin you named. External links, embedded content, and redirects elsewhere are never followed.
  • Test a remote origin without your confirmation, or a private-network address other than localhost.
  • Click anything that looks destructive or financial, or submit a state-changing form unless you pass --allow-writes.
  • Claim it finds every bug, or that it is a security scanner. It is neither.

Documentation

README and flags Architecture The fix loop skill GitHub Action Telemetry Security policy Contributing npm package Changelog

Try it on the app you are building right now

Sixty seconds to the first bug.

npx breakmyapp test http://localhost:3000