# CodexQA
**Shipping fast is table stakes. CodexQA runs fully local, installs ready to use, and tells you if the code is good.**
CodexQA is an open-source Agent Skills pack for Cursor, Claude Code, Codex, and OpenClaw. It provides 10 local-first verification skills and 1 auto-router to verify code quality, trace change blast radius, detect logic defects, audit PRD requirements, generate manual test cases, construct test data, replay browser UI workflows, and diagnose root causes before merging AI-generated code.
After AI coding, the hard part is **verifying quality before you merge**: bugs in what just landed, blast radius on old features, complete test cases, the change knowledge graph (which APIs, methods, and call chains moved), whether architecture broke, security risk, requirement fit, test data you can actually run, and whether a browser flow shows the evidence it claims. **CodexQA** is built for that **test-and-verify stage** — 10 specialized Agent Skills + 1 router, 360° coverage, so you not only write fast, you **see fast whether it is good**, and the development loop actually closes.
Cursor · Claude Code · Codex · OpenClaw. Fully local. Install and use — no account, no gateway, no QA-platform move.
10+1 skills ·
0 accounts ·
7/7 blind recall ·
0 decoy FPs ·
10 languages
Recorded JS blind eval on inventory-service: 7 planted semantic defects, 4 decoys. Recall 7/7, precision 7/7, 0 trap FPs — Composer, 2026-09-08, one run, not a multi-model benchmark. Semgrep seeds: 102 rules / 10 languages.
GitHub is the skill source; product site: [openqa.cn](https://openqa.cn/?utm_source=github&utm_medium=readme&utm_campaign=oss-seo&utm_content=hero).
[](https://github.com/openqa-cn/codexqa/actions/workflows/repo-check.yml)
[](https://openqa.cn/?utm_source=github&utm_medium=readme&utm_campaign=oss-seo&utm_content=badge-docs)
[](https://github.com/openqa-cn/codexqa/releases)
[](https://github.com/openqa-cn/codexqa/commits)
[](https://github.com/openqa-cn/codexqa/graphs/commit-activity)
[](https://github.com/openqa-cn/codexqa/stargazers)
[](LICENSE)
**English | [简体中文](#readme-zh)**
Documentation ·
Quick Start ·
Skills overview ·
Install notes ·
Changelog
|
codexqa-defect-analyzer
Verifies — whether the code you just wrote or merged hides bugs or security issues a quick glance would miss.
Does — merges SAST / lint / secrets with one Agent semantic pass into a P0–P3 HTML report: location, evidence, suggestion.
|
codexqa-code-reviewer
Verifies — whether this change is merge-ready, and whether it silently hits old behavior. A git diff alone rarely shows call chains or test gaps.
Does — collects a CodexQA evidence pack (callers, blast radius, test edges), then writes a bilingual REVIEW-REPORT.html you can send to a reviewer.
|
|
codexqa-code-wiki
Verifies — how the repo is actually layered, which module is the hub, and where a newcomer (or an Agent) should start reading. Without a map, “did we break the architecture?” is a guess.
Does — builds a local architecture knowledge graph — communities, real dependencies, reading paths — as openable HTML, not a chat summary.
|
codexqa-code-analyzer
Verifies — which APIs, methods, and call chains this change actually hits; what to regression-test; which paths still have no tests.
Does — queries a local symbol graph for callers, entries, and untested edges. Not a full-text search guess.
|
|
codexqa-rootcause-analyzer
Verifies — after mapping a stack or log back onto the repo, where the failure really starts. The throw site is often not the root cause.
Does — writes a gated English RCA: trigger vs root cause vs confidence, plus one fix-and-verify suggestion.
|
codexqa-requirement-analyzer
Verifies — whether the requirement is testable, complete, and internally consistent — before anyone writes code. Gaps and conflicts often live in the PRD.
Does — one P0/P1 gap-and-conflict register from a PRD (or a multi-source pack). High-priority items come with executable verification steps.
|
|
codexqa-testcase-generator
Verifies — what a complete test pass should cover for Web / server / APP, without inventing business facts when the PRD is silent.
Does — local Markdown plan + cases (unknowns stay TBD) plus an aggregated HTML you can open. No test-management platform.
|
codexqa-testdata-generator
Verifies — whether the preconditions in a case can actually be built on a real backend. A copied fake ID will not pass a real API.
Does — constructs data against the backend and writes the returned business IDs back into case preconditions. Success means the backend issued an ID.
|
|
codexqa-jev-browser · Jev Browser repo
Verifies — whether a browser flow reaches the visible evidence named in the goal. A model's DONE is not a pass.
Does — drives Playwright Chromium from a page index (role, name, allowed operations). Replays YAML, Markdown, or API cases, or generates a case from a goal. Each run writes reports/<run-id>/report.html with the marked screenshot and the step result.
|
codexqa-change-analysis
Verifies — for one diff, which methods were added or changed, which APIs or pages can trigger them, and which of those paths no existing test covers.
Does — writes one self-contained HTML change-impact report (entries, change list, test plan, coverage verdict, sensitive paths) and adds runnable test files for the uncovered points. Existing test files are not edited.
|
CodexQA
**写得快已经不够。CodexQA 完全本地执行、开箱安装即用，立刻知道写得好不好。**
CodexQA 是面向 Cursor、Claude Code、Codex 与 OpenClaw 的开源 Agent Skills 本地优先质量验证技能包，提供 10 个专业验证 Skill 和 1 个自动调度路由器，在合并 AI 生成代码前提供影响面分析、代码审查、缺陷扫描、用例生成、造数、浏览器回放与根因诊断。
AI Coding 之后，最大的痛点是**快速验证代码质量**：刚写的代码有没有 bug、会不会打到老功能、完整测试用例怎么建、变更知识图谱打了哪些接口 / 方法 / 调用链、架构有没有被破坏、有没有安全风险、是否满足业务需求、对应测试数据怎么尽快造出来、浏览器流程有没有走到说好的可见证据。**CodexQA 聚焦代码测试验证阶段**，用 10 个专业验证 Skill + 1 个路由器做 360° 覆盖，让你不但写得快，更能快速感知写得好不好，把开发闭环从「写完」走到「验完」。
Cursor · Claude Code · Codex · OpenClaw。完全本地执行，开箱安装即用；不用账号、不用网关、不用迁 QA 平台。
10+1 个 skill ·
0 个账号 ·
7/7 盲测召回 ·
0 次诱饵误报 ·
10 种语言
可复现数字来自 inventory-service：7 个语义缺陷 + 4 个诱饵。召回 7/7、精确率 7/7、陷阱误报 0 — Composer，2026-09-08，一次记录运行，不是多模型 benchmark。Semgrep 种子规则 102 条 / 10 种语言。
GitHub 是 skill 源码；产品站点：[openqa.cn](https://openqa.cn/?utm_source=github&utm_medium=readme&utm_campaign=oss-seo&utm_content=hero-zh)。
[](https://github.com/openqa-cn/codexqa/actions/workflows/repo-check.yml)
[](https://openqa.cn/?utm_source=github&utm_medium=readme&utm_campaign=oss-seo&utm_content=badge-docs)
[](https://github.com/openqa-cn/codexqa/releases)
[](https://github.com/openqa-cn/codexqa/commits)
[](https://github.com/openqa-cn/codexqa/graphs/commit-activity)
[](https://github.com/openqa-cn/codexqa/stargazers)
[](LICENSE)
**[English](https://github.com/openqa-cn/codexqa#readme-en) | 简体中文**
产品站点 ·
快速开始 ·
技能概览 ·
安装说明 ·
更新日志
|
codexqa-defect-analyzer
验证什么 — 刚写完或刚合进来的代码，有没有 bug、有没有把密钥和危险写法带进来。人眼扫一遍不够。
核心能力 — 规则扫描（SAST / lint / 密钥）和 Agent 语义检测合并去重，按 P0–P3 出 HTML：位置、证据、建议一次看完。
|
codexqa-code-reviewer
验证什么 — 这次改动能不能过评审、会不会误伤老功能。只看 git diff 往往看不到调用链和测试缺口。
核心能力 — 先用符号图收齐影响面和测试边，再按证据包做双语评审，落成可发给评审人的 REVIEW-REPORT.html。
|
|
codexqa-code-wiki
验证什么 — 仓库怎么分层、枢纽在哪、新人 / Agent 该从哪读起。没有地图时，「架构有没有被改坏」只能靠猜。
核心能力 — 本地建架构知识图谱：模块社区、真实依赖、阅读路径，写成可打开的 HTML，不是聊天里一段口头介绍。
|
codexqa-code-analyzer
验证什么 — 改了这几行，会打到哪些接口、方法、调用链；回归该测哪、哪些路径还没测试。
核心能力 — 对着本地符号图回答变更影响面：调用方、入口、未覆盖边。不是全文搜索猜一猜。
|
|
codexqa-rootcause-analyzer
验证什么 — 堆栈和日志对上仓库之后，异常到底卡在哪一层。抛错的那一行，经常不是根因。
核心能力 — 对照调用链产出带门禁的英文 RCA：触发点、根因、置信度分开写，并给出可验证的修复方向。
|
codexqa-requirement-analyzer
验证什么 — 需求本身写清楚了没有、能不能测、有没有缺口和互相打架的地方。代码还没写，坑可能已经在 PRD 里。
核心能力 — 从 PRD（或一包材料）整理出一份带 P0/P1 的缺口 / 冲突登记表；高优先级条目带可执行验证步骤。
|
|
codexqa-testcase-generator
验证什么 — 完整测试该覆盖哪些场景；Web / 服务端 / APP 的用例从哪来。需求没写清时，会不会被模型编出来。
核心能力 — 按需求在本地写出测试方案和用例，未知标 TBD；再聚合成可打开的 HTML。不连用例平台。
|
codexqa-testdata-generator
验证什么 — 用例写好了，前置数据是不是真能在后端造出来。复制一个假 ID，过不了真实接口。
核心能力 — 对着真实后端构造数据，把返回的业务 ID 回写进用例前置条件。成功以后端给了 ID 为准。
|
|
codexqa-jev-browser · Jev Browser 仓库
验证什么 — 浏览器流程有没有走到目标里写明的可见证据。模型返回 DONE 不算通过。
核心能力 — 用页面索引（角色、名称、允许的操作）驱动 Playwright Chromium。回放 YAML / Markdown / API 用例，或按目标生成用例。每次运行写出 reports/<run-id>/report.html，里面有带标记的截图和步骤结果。
|
codexqa-change-analysis
验证什么 — 针对一次 diff：新增、修改了哪些方法，哪些接口或页面会触发它们，其中哪些路径现有测试没覆盖。
核心能力 — 写一份自包含的 HTML 变更影响报告（入口、变更清单、测试方案、覆盖判定、敏感路径），并为未覆盖的点新增可运行的测试文件，不改已有测试文件。报告正文为英文。
|