Codexqa

CodexQA

Shipping fast is table stakes. CodexQA runs fully local, installs ready to use, and tells you if the code is good.

CodexQA is an open-source Agent Skills pack for Cursor, Claude Code, Codex, and OpenClaw. It provides 10 local-first verification skills and 1 auto-router to verify code quality, trace change blast radius, detect logic defects, audit PRD requirements, generate manual test cases, construct test data, replay browser UI workflows, and diagnose root causes before merging AI-generated code.

After AI coding, the hard part is verifying quality before you merge: bugs in what just landed, blast radius on old features, complete test cases, the change knowledge graph (which APIs, methods, and call chains moved), whether architecture broke, security risk, requirement fit, test data you can actually run, and whether a browser flow shows the evidence it claims. CodexQA is built for that test-and-verify stage — 10 specialized Agent Skills + 1 router, 360° coverage, so you not only write fast, you see fast whether it is good, and the development loop actually closes.

Cursor · Claude Code · Codex · OpenClaw. Fully local. Install and use — no account, no gateway, no QA-platform move.

10+1 skills  ·  0 accounts  ·  7/7 blind recall  ·  0 decoy FPs  ·  10 languages

_{Recorded JS blind eval on inventory-service: 7 planted semantic defects, 4 decoys. Recall 7/7, precision 7/7, 0 trap FPs — Composer, 2026-09-08, one run, not a multi-model benchmark. Semgrep seeds: 102 rules / 10 languages.}

GitHub is the skill source; product site: openqa.cn.

English | 简体中文

Documentation · Quick Start · Skills overview · Install notes · Changelog

Overview of all skills

codexqa-defect-analyzer Verifies — whether the code you just wrote or merged hides bugs or security issues a quick glance would miss. Does — merges SAST / lint / secrets with one Agent semantic pass into a P0–P3 HTML report: location, evidence, suggestion.	codexqa-code-reviewer Verifies — whether this change is merge-ready, and whether it silently hits old behavior. A git diff alone rarely shows call chains or test gaps. Does — collects a CodexQA evidence pack (callers, blast radius, test edges), then writes a bilingual REVIEW-REPORT.html you can send to a reviewer.
codexqa-code-wiki Verifies — how the repo is actually layered, which module is the hub, and where a newcomer (or an Agent) should start reading. Without a map, “did we break the architecture?” is a guess. Does — builds a local architecture knowledge graph — communities, real dependencies, reading paths — as openable HTML, not a chat summary.	codexqa-code-analyzer Verifies — which APIs, methods, and call chains this change actually hits; what to regression-test; which paths still have no tests. Does — queries a local symbol graph for callers, entries, and untested edges. Not a full-text search guess.
codexqa-rootcause-analyzer Verifies — after mapping a stack or log back onto the repo, where the failure really starts. The throw site is often not the root cause. Does — writes a gated English RCA: trigger vs root cause vs confidence, plus one fix-and-verify suggestion.	codexqa-requirement-analyzer Verifies — whether the requirement is testable, complete, and internally consistent — before anyone writes code. Gaps and conflicts often live in the PRD. Does — one P0/P1 gap-and-conflict register from a PRD (or a multi-source pack). High-priority items come with executable verification steps.
codexqa-testcase-generator Verifies — what a complete test pass should cover for Web / server / APP, without inventing business facts when the PRD is silent. Does — local Markdown plan + cases (unknowns stay TBD) plus an aggregated HTML you can open. No test-management platform.	codexqa-testdata-generator Verifies — whether the preconditions in a case can actually be built on a real backend. A copied fake ID will not pass a real API. Does — constructs data against the backend and writes the returned business IDs back into case preconditions. Success means the backend issued an ID.
codexqa-jev-browser · Jev Browser repo Verifies — whether a browser flow reaches the visible evidence named in the goal. A model's DONE is not a pass. Does — drives Playwright Chromium from a page index (role, name, allowed operations). Replays YAML, Markdown, or API cases, or generates a case from a goal. Each run writes reports/<run-id>/report.html with the marked screenshot and the step result.	codexqa-change-analysis Verifies — for one diff, which methods were added or changed, which APIs or pages can trigger them, and which of those paths no existing test covers. Does — writes one self-contained HTML change-impact report (entries, change list, test plan, coverage verdict, sensitive paths) and adds runnable test files for the uncovered points. Existing test files are not edited.

Quick start

1. Install (router only is enough; it can fetch a worker on demand):

npx skills add openqa-cn/codexqa --skill codexqa-skill-router

Pick Cursor, Claude Code, Codex, or OpenClaw when prompted. No npm login.

2. Run — new Agent session, then paste:

I am not sure which skill to use. Route this: review this repo against origin/main
and produce an openable HTML report I can send to a reviewer.

Or name a worker: Use codexqa-defect-analyzer on this branch. Requirement: a refund must not exceed the remaining refundable balance.

3. See a report — the Agent writes HTML/Markdown on disk. Compare with the screenshots above.

Install a specific skill · code-graph CLI

npx skills add openqa-cn/codexqa --skill codexqa-defect-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-code-reviewer
npx skills add openqa-cn/codexqa --skill codexqa-code-wiki
npx skills add openqa-cn/codexqa --skill codexqa-code-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-change-analysis
npx skills add openqa-cn/codexqa --skill codexqa-rootcause-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-requirement-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-testcase-generator
npx skills add openqa-cn/codexqa --skill codexqa-testdata-generator
npx skills add openqa-cn/codexqa --skill codexqa-jev-browser

Capabilities

Each skill is one step in the test-and-verify loop. The table says when to use it and what checkable result you leave with — an openable artifact, not a chat summary.

	Skill	When to use it, and what verification result you get
🧭	codexqa-skill-router	When you are not sure whether you need a defect scan, impact map, cases, or test data — or the worker is not installed yet. You get the matching skill, installed on demand if missing, then a handoff. Verification starts by picking the right tool; you do not memorize ten entry points.
📋	codexqa-requirement-analyzer	When a PRD, story pack, or mixed materials land, before anyone writes code: is it testable, complete, internally consistent? You get one assignable P0/P1 gap-and-conflict register. High-priority rows include preconditions, stimulus, expected result, and evidence — the requirement-layer blockers that would make later testing fail.
🧪	codexqa-testcase-generator	When you need a test plan and executable cases for Web / server / APP before submit, or extra regression after a change. You get local Markdown plan + cases + aggregated HTML: which scenarios, which priority. Unknowns stay TBD; silent PRD gaps are not invented as fake cases.
🗃️	codexqa-testdata-generator	When cases exist but will not run: missing accounts, catalog rows, orders. A copied fake ID will not pass a real API. You get data constructed against the backend, with returned business IDs written into case preconditions. Success means the backend issued an ID, not that a number appeared in chat.
🌐	codexqa-jev-browser · repo	When you have a UI case, or only a goal, and need to see whether the page actually shows the expected evidence. You get a local HTML report: each step, the control that was used, and a marked screenshot. Replay does not call a decision model. The browser is Playwright Chromium.
🗺️	codexqa-code-wiki	When a newcomer or an Agent enters the repo, or you are reviewing whether a change broke the architecture. You get an architecture knowledge-graph HTML: module communities, real dependencies, the hub, a reading path. You are checking layering and where to start — not another README.
📈	codexqa-code-analyzer	When you review a PR, set regression scope, or ask “who does this change hit?” A git diff will not show call chains. You get blast radius from a local symbol graph: which APIs / methods / call chains moved, which entries fire, which edges have no tests. That list is what you regression-test.
🔀	codexqa-change-analysis	When one branch or PR is ready and you need to hand a reviewer the full impact of that diff, and close the test gaps it opened. You get one HTML change-impact report — added / changed / deleted methods, the entries that reach them, a test plan with existing cases recalled, a coverage verdict, sensitive paths — plus new runnable test files for what was not covered, run and counted in the report.
🧯	codexqa-rootcause-analyzer	When a production or local exception, stack, or log still does not tell you which layer actually failed. You get a gated English RCA: trigger vs root cause vs confidence, plus one fix-and-verify suggestion. The throw site is not treated as the root cause.
🛡️	codexqa-defect-analyzer	When you scan a branch before merge, or paste newly written code and ask about bugs, secrets, or dangerous patterns. You get a P0–P3 HTML scan: SAST / lint / secrets merged and de-duplicated with Agent semantic findings — location, evidence, suggestion. This is defect and security risk, not a CR opinion.
⚖️	codexqa-code-reviewer	When you need something a reviewer can open, not a raw git diff, before a merge gate. You get a bilingual REVIEW-REPORT.html from a CodexQA evidence pack (call chains, blast radius, test edges): merge risk, gaps, and what still needs tests. Use it as the CR attachment.

Narrow contracts, stop conditions, local files. The Agent you already use is the runtime.

Who it's for

	Who	Typical job: tools, skills, and what you take away
🏢	Enterprise	Tools The Cursor / Claude Code / Codex / OpenClaw you already run. One npx skills add puts verification next to the coding agent — no account, no gateway, no move of QA onto another SaaS. Skills codexqa-skill-router to route; PRs through codexqa-code-analyzer + codexqa-change-analysis + codexqa-defect-analyzer + codexqa-code-reviewer; pre-submit through codexqa-requirement-analyzer → codexqa-testcase-generator → codexqa-testdata-generator, then UI replay with codexqa-jev-browser; architecture with codexqa-code-wiki; incidents with codexqa-rootcause-analyzer. You get blast radius (APIs / methods / call chains, regression list, test gaps), P0–P3 defect-and-security HTML, a bilingual REVIEW-REPORT.html for reviewers, a requirement gap register, Web/server/APP cases, real backend IDs in preconditions, an architecture knowledge graph, and a gated RCA. Files stay local; findings still need a human.
👤	Individual	Tools Your own Cursor or Codex session. Install codexqa-skill-router; workers can be fetched when you need them. Skills Before you merge your PR: codexqa-defect-analyzer for bugs and secrets, codexqa-code-analyzer for who is hit, codexqa-code-reviewer for an openable review page. Unfamiliar repo → codexqa-code-wiki; your own PRD/cases → the generators. You get HTML you can open: whether there are obvious defects, whether the blast radius is clear, whether the review is sendable. No extra test platform.
🎓	Education	Tools Any Agent Skills IDE plus the in-repo inventory-service fixture (7 semantic defects, 4 decoys, a reproducible answer key). Skills codexqa-defect-analyzer to teach what a graded scan report looks like; codexqa-code-wiki / codexqa-code-analyzer for hubs and change call chains; codexqa-requirement-analyzer and codexqa-testcase-generator for “can this requirement be tested, and where do cases come from?” You get openable reports plus an answer key — “checkable output,” not a chat comment. Recorded recall numbers live on the fixture README; they are one run, not a multi-model board.
🤖	AI development	Tools The Agent runtime you already ship (Cursor · Claude Code · Codex · OpenClaw) plus this Agent Skills pack — not a mega-prompt. Skills codexqa-skill-router as the entry; the ten workers behind a narrow handoff: requirement gaps, cases, test data, browser UI replay, architecture graph, blast radius, change-impact report, RCA, defect scan, graph-evidence review. You get Markdown / HTML on disk (register, cases, scan page, REVIEW-REPORT.html, RCA), with stop conditions. When you wire verification into an Agent product, you ship skills, not an uncheckable conversation.

Not a hosted test cloud. Not a replacement for your test suite, SAST license, or maintainer judgment.

Star this repo

If a local skill pack like this is what you wanted instead of another QA platform, ⭐ Star opens this repository at the top — then click Star in the top-right. See who starred. Issues and reproductions help more than stars when something is wrong.

Changelog

0.3.0 — codexqa-* skill names; architecture wiki; Agent LLM Detection / judgment; canonical docs at openqa.cn.

0.2.0 — first five published skills, sample reports, inventory-service 7/7 blind eval (one model, one run).

Full history: CHANGELOG.md · Releases (each release body links to openqa.cn).

Product and docs

I want to…	Go here
Use the product site	openqa.cn
Browse skills	Skill Hub
See the commercial product	openqa.cn/agent
Install without guessing	Getting started · Support matrix
Know how a conclusion is reached	How it works
Reproduce the blind eval	inventory-service · Methodology
Report a bug	Issues · Security
Send a PR	Contributing · Apache-2.0

---

CodexQA

写得快已经不够。CodexQA 完全本地执行、开箱安装即用，立刻知道写得好不好。

CodexQA 是面向 Cursor、Claude Code、Codex 与 OpenClaw 的开源 Agent Skills 本地优先质量验证技能包，提供 10 个专业验证 Skill 和 1 个自动调度路由器，在合并 AI 生成代码前提供影响面分析、代码审查、缺陷扫描、用例生成、造数、浏览器回放与根因诊断。

AI Coding 之后，最大的痛点是快速验证代码质量：刚写的代码有没有 bug、会不会打到老功能、完整测试用例怎么建、变更知识图谱打了哪些接口 / 方法 / 调用链、架构有没有被破坏、有没有安全风险、是否满足业务需求、对应测试数据怎么尽快造出来、浏览器流程有没有走到说好的可见证据。CodexQA 聚焦代码测试验证阶段，用 10 个专业验证 Skill + 1 个路由器做 360° 覆盖，让你不但写得快，更能快速感知写得好不好，把开发闭环从「写完」走到「验完」。

Cursor · Claude Code · Codex · OpenClaw。完全本地执行，开箱安装即用；不用账号、不用网关、不用迁 QA 平台。

10+1 个 skill  ·  0 个账号  ·  7/7 盲测召回  ·  0 次诱饵误报  ·  10 种语言

_{可复现数字来自 inventory-service：7 个语义缺陷 + 4 个诱饵。召回 7/7、精确率 7/7、陷阱误报 0 — Composer，2026-09-08，一次记录运行，不是多模型 benchmark。Semgrep 种子规则 102 条 / 10 种语言。}

GitHub 是 skill 源码；产品站点：openqa.cn。

English | 简体中文

产品站点 · 快速开始 · 技能概览 · 安装说明 · 更新日志

所有技能SKILL概览

codexqa-defect-analyzer 验证什么 — 刚写完或刚合进来的代码，有没有 bug、有没有把密钥和危险写法带进来。人眼扫一遍不够。 核心能力 — 规则扫描（SAST / lint / 密钥）和 Agent 语义检测合并去重，按 P0–P3 出 HTML：位置、证据、建议一次看完。	codexqa-code-reviewer 验证什么 — 这次改动能不能过评审、会不会误伤老功能。只看 git diff 往往看不到调用链和测试缺口。 核心能力 — 先用符号图收齐影响面和测试边，再按证据包做双语评审，落成可发给评审人的 REVIEW-REPORT.html。
codexqa-code-wiki 验证什么 — 仓库怎么分层、枢纽在哪、新人 / Agent 该从哪读起。没有地图时，「架构有没有被改坏」只能靠猜。 核心能力 — 本地建架构知识图谱：模块社区、真实依赖、阅读路径，写成可打开的 HTML，不是聊天里一段口头介绍。	codexqa-code-analyzer 验证什么 — 改了这几行，会打到哪些接口、方法、调用链；回归该测哪、哪些路径还没测试。 核心能力 — 对着本地符号图回答变更影响面：调用方、入口、未覆盖边。不是全文搜索猜一猜。
codexqa-rootcause-analyzer 验证什么 — 堆栈和日志对上仓库之后，异常到底卡在哪一层。抛错的那一行，经常不是根因。 核心能力 — 对照调用链产出带门禁的英文 RCA：触发点、根因、置信度分开写，并给出可验证的修复方向。	codexqa-requirement-analyzer 验证什么 — 需求本身写清楚了没有、能不能测、有没有缺口和互相打架的地方。代码还没写，坑可能已经在 PRD 里。 核心能力 — 从 PRD（或一包材料）整理出一份带 P0/P1 的缺口 / 冲突登记表；高优先级条目带可执行验证步骤。
codexqa-testcase-generator 验证什么 — 完整测试该覆盖哪些场景；Web / 服务端 / APP 的用例从哪来。需求没写清时，会不会被模型编出来。 核心能力 — 按需求在本地写出测试方案和用例，未知标 TBD；再聚合成可打开的 HTML。不连用例平台。	codexqa-testdata-generator 验证什么 — 用例写好了，前置数据是不是真能在后端造出来。复制一个假 ID，过不了真实接口。 核心能力 — 对着真实后端构造数据，把返回的业务 ID 回写进用例前置条件。成功以后端给了 ID 为准。
codexqa-jev-browser · Jev Browser 仓库 验证什么 — 浏览器流程有没有走到目标里写明的可见证据。模型返回 DONE 不算通过。 核心能力 — 用页面索引（角色、名称、允许的操作）驱动 Playwright Chromium。回放 YAML / Markdown / API 用例，或按目标生成用例。每次运行写出 reports/<run-id>/report.html，里面有带标记的截图和步骤结果。	codexqa-change-analysis 验证什么 — 针对一次 diff：新增、修改了哪些方法，哪些接口或页面会触发它们，其中哪些路径现有测试没覆盖。 核心能力 — 写一份自包含的 HTML 变更影响报告（入口、变更清单、测试方案、覆盖判定、敏感路径），并为未覆盖的点新增可运行的测试文件，不改已有测试文件。报告正文为英文。

快速开始

1. 安装（只装路由即可，它能按需拉取干活 skill）：

npx skills add openqa-cn/codexqa --skill codexqa-skill-router

按提示选 Cursor、Claude Code、Codex 或 OpenClaw。不用登录 npm。

2. 运行 — 新建 Agent 会话，粘贴：

我不确定该用哪个 skill。请路由：对照 origin/main 审查这个仓库，
产出一份可以发给评审人的 HTML 报告。

也可以点名：用 codexqa-defect-analyzer 审这个分支。需求：退款不得超过剩余可退余额。

3. 看报告 — Agent 把 HTML/Markdown 写到磁盘。对照上面的截图。

按需安装某一个 skill · 代码图 CLI

npx skills add openqa-cn/codexqa --skill codexqa-defect-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-code-reviewer
npx skills add openqa-cn/codexqa --skill codexqa-code-wiki
npx skills add openqa-cn/codexqa --skill codexqa-code-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-change-analysis
npx skills add openqa-cn/codexqa --skill codexqa-rootcause-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-requirement-analyzer
npx skills add openqa-cn/codexqa --skill codexqa-testcase-generator
npx skills add openqa-cn/codexqa --skill codexqa-testdata-generator
npx skills add openqa-cn/codexqa --skill codexqa-jev-browser

核心能力

每个 skill 对应测试验证闭环里的一环。下表写清什么时候用，以及跑完之后你能拿到哪些可打开、可核对的结果——不是聊天里一段口头结论。

	Skill	什么时候用，以及验证环节你拿到什么
🧭	codexqa-skill-router	什么时候用 不确定该走缺陷扫描、影响面、用例还是造数；或者干活 skill 还没装。 验证结果 按你的话匹配到对应 skill，没有就按需装上再交接。你不用自己记十套入口，验证工作从「选对工具」开始。
📋	codexqa-requirement-analyzer	什么时候用 需求评审、提测前对 PRD / 故事 / 一包材料做完整性检查。代码还没写，先看需求能不能测、有没有打架。 验证结果 一份可指派的缺口与冲突登记表（P0/P1）。高优先级条目带前置、操作、期望和证据，标出需求层哪些地方会让后续测试做不下去。
🧪	codexqa-testcase-generator	什么时候用 提测、补回归，或要把 Web / 服务端 / APP 从需求落到可执行用例。 验证结果

…