TestForge — Dual-Agent Adversarial QA Engine

Inspiration

Most AI test generation tools are a single prompt → single output with no review. You trust it blindly and it always misses something — security edge cases, ambiguous requirements, boundary conditions nobody thought to check. I wanted to build something that catches its own mistakes before a human ever sees the result.

What it does

TestForge runs two independent Gemini 2.5 Flash AI agents in an adversarial debate loop:

• Builder Agent drafts a complete test suite from your plain-English requirement
• Skeptic Agent independently reviews it against the original requirement — finding missing scenarios, security gaps, and ambiguous coverage the Builder missed
• Builder Agent responds to every single critique — fixing or defending each one with a clear justification

The final, debated test cases sync into UiPath Test Manager (Test Cloud) via REST API. The full debate transcript is shown as an Adversarial Review Trail — a visible audit of exactly what was caught and why.

In a real run on a Multi-Factor Authentication requirement, the Skeptic caught 4 issues the Builder missed: a replay attack scenario, MFA lockout ambiguity, counter-reset coverage, and a boundary test at the 14-minute lockout mark. All 4 were fixed before the user saw anything.

How we built it

• Three-call Gemini 3.5 Flash pipeline via @google/genai SDK with strict JSON schemas enforced via responseMimeType: application/json and responseSchema — no relying on prompt instructions alone to enforce structure
• React + TypeScript frontend with glassmorphism UI — animated gradient mesh background, glass cards with backdrop-filter blur, staggered card animations, 3-step pipeline progress tracker
• Node.js + Express backend (server.ts) handling the UiPath OAuth2 Client Credentials flow server-side so no secrets are exposed to the browser
• UiPath Test Manager API for syncing vetted test cases into Test Cloud with full traceability
• Built agent-first: the entire app was scaffolded by writing a senior-engineer-level prompt spec covering exact data contracts, system instructions per agent role, UI behavior, error handling, and build order — then executing that spec through Google AI Studio Build Agent and Google Antigravity

Challenges

• Getting three sequential Gemini calls to maintain context correctly without the Skeptic being influenced by the Builder's own framing — solved by giving the Skeptic the original requirement independently, not filtered through the Builder
• UiPath OAuth2 Client Credentials flow in a staging environment with tenant-specific API paths that had to be confirmed against the live Swagger rather than assumed from documentation
• Designing the JSON schemas for critiques and Builder responses tightly enough that the merge step never produces malformed output

Accomplishments

• A working three-call adversarial pipeline that genuinely catches real gaps — not decorative filler — as proven by the MFA demo run
• A visible Adversarial Review Trail that shows every critique and resolution, giving teams an actual audit trail rather than a black-box result
• Live deployment on Render with UiPath Test Manager integration

What we learned

The most important design decision was making the Skeptic receive the original requirement independently — not just the Builder's output. That single choice is what lets it catch things the Builder's own framing caused it to miss. Without it, it's just a proofreader. With it, it's an independent reviewer.

What's next

• Second debate round option (Builder → Skeptic → Builder → Skeptic → Builder) for high-stakes requirements
• Coverage gap analysis: pull existing Test Manager test cases and find what's missing rather than only generating new ones
• CI/CD webhook integration so TestForge runs automatically on every new requirement ticket

Built With

• express.js
• gemini-2.5-flash
• google-ai-studio
• google-antigravity
• node.js
• oauth2
• react
• render
• typescript
• uipath-automation-cloud
• uipath-test-cloud
• uipath-test-manager
• vite