Nova AI QA Engineer - An AI QA engineer that proves the bug before filing it

Hi Product Hunt 👋 novaqa is an AI QA engineer. Give it an OpenAPI URL or your feature files and it works the way a new tester would on their first week: designs the tests, runs them against your API and your UI, works out which results actually matter, and files the bugs. Concretely, here's what the AI does: It reads your feature files and designs the nasty version of every scenario. A scenario mentioning "a product priced 79.99, stock 5" becomes -79.99, 0, 1e18, "79.99" as a string, stock -1, an empty name, a 10,000-character name, injection-shaped strings, missing required fields, and the business rules the domain implies. It decides how many cases each scenario deserves — a checkout flow earns more than a health check. With no feature files it works from each request's JSON Schema; on read-only endpoints it designs hostile path and query parameters instead. It runs the same scenarios everywhere — no glue code. Normally a .feature file is dead weight until someone writes step bindings. novaqa hands the scenario text to the model and gets back concrete actions: ordered HTTP calls against your API, or clicks and form-fills against your UI — it reads the page's interactive elements and drives a browser it has never seen, no selectors written by hand. Drop a .feature in and it runs, on both sides of your stack. It reviews what your app accepted. A 2xx is the easiest place for a bug to hide — the wrong price echoed back, a field silently dropped, a total that doesn't add up. In the browser it also catches console errors, uncaught exceptions, and visual regressions against committed baselines. Response bodies are redacted before anything leaves for a model. It writes the analyst summary — recurring root-cause themes, highest risk first, at the top of the report. And it runs with no API key. Three providers: ANTHROPIC_API_KEY, GEMINI_API_KEY, or — the one I'd point you at — your local Claude Code CLI. If claude is on your PATH, novaqa finds it and uses it: full AI on your own subscription, no key to provision, no per-run cost, nothing routed through me. With none of the three it degrades to the deterministic engine and says so on the status line. It never fails a run over a missing key. Why I'm comfortable putting AI on the front page: the model proposes, it never decides. Every AI-proposed request is matched against your OpenAPI spec before it's sent, and browser actions come from a closed vocabulary the runner executes — the model can't invent one. A prompt-injected feature file can't steer traffic at anything you didn't declare. Verdicts come from deterministic oracles — 5xx, schema violation, invalid input accepted, a failed assertion on the page — never from the model. Everything is re-run three times before you see it, in the browser as well as against the API. Anything that doesn't hold up is marked unconfirmed instead of filed. A bug's identity excludes the AI's wording, so the model rephrasing a case tomorrow can't re-file something you already have — and an issue only closes if the run actually re-tried it. "We didn't look" never reads as "it's fixed." Read-only by default. It won't write to your API until you allow it, and it refuses any writing mode against environment: "production" with no override flag. Point it at a test environment and set safety.mode: "safe-write" — that's where the AI earns its keep, because that's where it can send the inputs it designed. Two honest notes. It's source-available, not open source — Functional Source License, free for everything except building a competing product, converting to Apache-2.0 two years after each release. I switched while the project had zero users, because doing it later, once people depend on you, is what burns trust. And there's a runnable example ecosystem in the repo: two deliberately broken services and a storefront, one docker compose up, so you can see what it finds without pointing it at anything you care about. I'd genuinely like to know what it finds in your app — and where it's wrong.