scenescout weekly downloads statistics

<div align="center"> <img src="site/favicon.svg" alt="" width="88" height="88" />

SceneScout

Your coding agent, turned into an exploratory QA tester for any web app.

Works with Claude Code · Cursor · VS Code (Copilot) · Codex CLI · Gemini CLI · Copilot CLI · Windsurf · any MCP client

🌐 Website · 📖 Guide · 🐛 What it catches · 🎬 QA with evidence · 🚀 Get started · 🚦 CI · 🔒 Safety · 📚 Docs

</div>

Scripted end-to-end tests answer one question: does this exact flow still work? They say nothing about the rest of the app. SceneScout lets the agent you already use explore a running web app like a curious, thorough tester. It clicks, fills forms, switches roles and calls the API behind a hidden button, then writes a report of what is broken and what could be better, with a picture and evidence for every line.

Try it on any app you are allowed to test. No account, no API key, no setup:

npx -y scenescout http://localhost:3000

flowchart LR
  A["🧠 Your coding agent<br/>Claude Code, Cursor, Copilot…"] -- MCP --> S["🔭 SceneScout<br/>browser · checks · memory"]
  S --> App["🌐 Your running app"]
  S --> R["📋 Report<br/>plain words + pictures"]
  S --> E["🎬 Evidence<br/>replay, videos, test report"]

👥 Who it's for

🛠️ Developers	🧑‍💼 QA, product and non-technical teams
Findings with the request that failed (GET /api/orders?status=archived → 500), the steps, and a Playwright regression-test skeleton	Each problem in plain words first: what was done, what was expected, what happened, and a picture of the page
Next to the source, the file behind the bug and a likely fix	Visible problems shown, not described: a covered button, a broken image, text too faint to read
A deterministic gate for pull requests, with SARIF for code scanning	Journeys recorded step by step, as frames and video, so a pass is something you can watch
Runs from your editor's agent, or unattended in CI	A test report laid out by your template, with expected and actual results, deviations and blank sign-off rows

🐛 What it catches

A real run against the small demo app in this repository, which has bugs planted on purpose. The two you can see are outlined:

<p align="center"><img src="examples/screenshots/dashboard-annotated.png" alt="The demo app's dashboard with two defects outlined in red: 1, a yellow badge covering the All orders button; 2, the weekly chart image failing to load" width="760" /></p>

It filed twelve findings. A few from the report:

🔴 [HIGH] A double-click on Create order creates two orders 2× click fired the same state-changing request 2× (POST /api/orders)

🔴 [HIGH] A clerk can approve an order by calling the endpoint the page hides from them POST /api/orders/1037/approve 200 as clerk: the button was hidden, the server did not agree.

🔴 [HIGH] Filtering orders by Archived fails, and the page shows an empty table instead of an error GET /api/orders?status=archived → HTTP 500

🟠 [MEDIUM] The "New: bulk import" badge sits on top of the All orders button (callout 1) "All orders" overlaps "New: bulk import" (81%), measured from layout boxes, no screenshot needed.

What it looks for, on every page, after every action:

• 📐 Broken layout, from geometry: controls that overlap, sit off-screen, hide under a sticky bar or can never be scrolled into view. The CSS bugs a person spots at a glance, found without one.
• 🧨 Real breakage: console errors, crashes, failed requests, 4xx and 5xx responses, broken images, dead-end pages.
• 🔓 Permission leaks: it calls the app's own API as each role, so "the button is hidden" becomes "the server refuses it", or doesn't.
• 🤥 Pages that lie: "Saved!" after the server refused the save, or an empty table after the request failed.
• 👆 Impatient users: a double-click that sends the same order twice.
• ♿ Accessibility and craft: contrast, focus, labels, target sizes, spacing and type, with a 0 to 100 score per page.
• 🧭 Friction: how many steps a task takes, and where a user had to go back.
• 💉 Security smells: typed markup that comes back as an element, and tokens posted to any window.

Everything it checks.

🎬 Automated QA with evidence

Save the journeys that matter, the happy paths and the ones that must fail politely, and scenescout check replays them on every pull request with no model involved. Recorded, each run leaves proof you can watch and hand to someone who never opens a terminal.

flowchart LR
  PR["🔀 Pull request"] --> C["🚦 scenescout check<br/>--record --video --template"]
  F["📝 Saved journeys<br/>.scenescout/flows/*.json"] --> C
  C --> G["✅ / ❌ A gate on the pull request"]
  C --> RP["🖼️ replay.html<br/>every step, with frames"]
  C --> V["🎞️ A video per journey"]
  C --> TR["📄 Test report<br/>your template, SHA-256 manifest,<br/>blank sign-off rows"]

A journey is a few lines of JSON, written by hand or kept from a flow your agent just walked. This is the demo's happy path:…