QA should no longer be a final checkpoint. It should be an agent that develops alongside you.
EagleEye learns from a real, consented browser journey, expands it with GPT-5.6, and replays every case with deterministic, privacy-safe proof.
AI proposes coverage. Deterministic code owns the verdict.
EagleEye is not just a web testing tool. It is an agentic QA foundation designed to plug into any software development workflow—observing real usage, expanding coverage, validating risk, replaying proof, and continuously improving the product with developers.
Why EagleEye
Web testing still has a painful split: recorders preserve what happened but rarely add the edge cases a strong QA engineer would think of, while prompt-only generators can invent plausible tests without trustworthy evidence that they are runnable.
EagleEye joins those two halves. A user explicitly turns on the Chrome extension and follows a normal browser journey. EagleEye turns that approved journey into privacy-aware QA evidence, keeps it as a deterministic regression test, asks GPT-5.6 through Codex App Server for complementary coverage, validates every generated case, replays the critical path with Playwright, and produces an evidence-backed report.
Five-minute demo flow
Turn the Chrome extension on. Use an approved website normally. Capture a bounded DOM summary, visible-page evidence, and the action trail without retaining typed values. Ask GPT-5.6 through Codex App Server for complementary cases and improvement suggestions. Run deterministic quality checks. Replay the recorded path with Playwright. Export a report with screenshots, WebM evidence, timestamps, byte counts, and SHA-256 receipts.
The included proof uses a real local WordPress journey. The extension recorded four observations, Codex returned five schema-valid cases with no fallback, the mechanical quality gate returned 100 / PASS, and Playwright Replay produced verifiable evidence.
What is innovative
Reality-anchored generation: the recorded journey remains the critical path; AI expands coverage around real evidence instead of starting from a blank prompt. Two trust layers: GPT-5.6 proposes; deterministic code validates and executes. The model never becomes the pass/fail oracle. Privacy as an input contract: form values, passwords, cookies, authentication headers, FormData, and secret-like URL parameters are excluded. Screenshots are opt-in and are not sent in the AI prompt. Useful failure: if AI is unavailable, the recorded regression test still works and the fallback is clearly labelled. Human-bounded repair: suggestions and bounded repair plans are allowed, while production writes, release approval, and unsafe changes remain explicit human decisions.
How Codex and GPT-5.6 were used
Codex App Server is the OpenAI integration layer. It owns the ChatGPT authentication lifecycle, starts an ephemeral read-only turn, denies approval requests, and asks for JSON that must match EagleEye's schema. The browser-generation prompt contains only the test goal, sanitized URL, action types, accessible target labels, a safe DOM summary, and explicit safety boundaries.
GPT-5.6 was used to expand the real WordPress path with complementary test cases, risk observations, and fix suggestions. Codex also accelerated implementation, debugging, privacy-boundary design, test authoring, the Build Week QA proof, and release hardening. The repository records where deterministic checks and human decisions remain authoritative.
Architecture
Python 3.12, FastAPI, Pydantic Codex App Server and GPT-5.6 Playwright Replay and evidence capture Chrome Manifest V3 extension Risk-adaptive strategy and pre-execution case quality checker MCP interoperability Atomic local storage and SHA-256 evidence metadata GitHub Actions for Windows and Linux
Try it without an account
The repository includes a login-free local demo: git clone https://github.com/nullx2-x/eagleeye-qa-agent.git cd eagleeye-qa-agent Copy-Item .env.example .env uv sync --locked --dev uv run playwright install chromium uv run uvicorn app.main:app --host 127.0.0.1 --port 8766
Open http://127.0.0.1:8766/demo. The README also contains the full Chrome extension and WordPress proof path.
Verification
142 Python tests passed Ruff lint and format checks passed Chrome extension privacy/security verifier and ESLint passed Gitleaks found zero leaks across the sanitized submission history Fixed Python dependency versions: zero known PyPI advisories; npm audit also reports zero known vulnerabilities Final demo: 2:55, 1080p, English narration, 72 burned-in English subtitle cues
EagleEye is local-first by default. Remote or multi-user deployment requires TLS, strong authentication, access control, retention, audit logging, and deletion procedures described in the repository security and privacy documents.