Docs

What is VibeTesting Agent?

Hosted orchestration around the open-source vibetesting-agent scanner: dashboard, billing, deploy webhooks, GitHub checks, MCP for agents, badges, and history. The OSS CLI stays free forever.

Security coverage map → zones, OWASP WSTG categories, and ASVS L1 — what we automate vs what needs auth or active tests.

Ownership security

Full scans only run against apps you prove you control. Two paths:

1. Domain email + inbox click — Sign in with an email on the same domain as the app (e.g. you@acme.com for app.acme.com). We email a one-click link; open it to prove you control that inbox. Free/public mail (Gmail, etc.) cannot prove app ownership this way.
2. DNS TXT — In your DNS control panel, add vibetesting-verify=<token> on the hostname or _vta.<hostname>, then click Check DNS.

Authenticated / internal testing

Optional. After ownership, open the project and enable Authenticated testing:

1. Create a dedicated test user on your app (not a real customer / not prod admin).
2. Confirm that user's email link.
3. Log in, copy the session cookie or a test API bearer token.
4. Paste it into the project panel, save, and click Verify session.
5. Scans then attach that session on same-origin requests.

Opt out anytime:“Opt out & delete credentials” disables internal scans and wipes stored secrets. External black-box still works.

See also coverage map (Zones 3–5).

Hosted workflow

1. Sign in (prefer an email on your product domain when possible).
2. Create a project with your production URL.
3. Prove ownership via domain email (inbox click) or DNS TXT.
4. Upgrade for cadence (weekly / daily / every commit).
5. POST the deploy webhook after every successful release.
6. Review score, baseline diffs, and agent fix packs.

API

curl -X POST $APP/api/v1/scans \
  -H "Authorization: Bearer sk_live_…" \
  -H "content-type: application/json" \
  -d '{"url":"https://example.com","authorized":true,"mode":"fast"}'

Every production commit → full suite → Claude / Codex recursive fix

Agents do not watch git alone. Wire two layers:

1. Deploy webhook (or GitHub deployment_status) so every production deploy starts a VibeTesting Agent full suite scan. Needs Daily ($100) or Every commit ($250).
2. MCP on Claude Code / Codex: start_scan / get_scan / list_findings / get_fix_prompt → apply patches → re-scan until highs are gone (or residual items need DNS/human).
3. Paste the recursive fix prompt into the agent (or AGENTS.md). Optional: headless Claude in CI after the webhook.

push → prod deploy → POST deploy webhook
   → full suite → MCP get_fix_prompt → patch + PR
   → re-scan → repeat until clean (max ~5 rounds)

Full copy-paste setup (webhook, Claude, Codex, recursive prompt): Dashboard → MCP / Claude Code · Codex · every commit (after login).

MCP tools

See Dashboard → MCP after login. Tools: list_projects, start_scan, get_scan, list_findings, get_fix_prompt, get_security_review, compare_baseline, get_badge_markdown.

End-of-run security-review + PDF

When a scan completes, VibeTesting Agent always produces a Claude /security-review markdown (ranked P1→Pn with problem / where / fix / verify) and a downloadable PDF report. On the scan detail page: copy, download .md, or Download PDF report. API: GET /api/v1/scans/:id/security-review · GET /api/v1/scans/:id/report.pdf.

GitHub App

Point the App webhook to /api/webhooks/github. On deployment_status success, VibeTesting Agent scans and posts a Check Run. Link projects with githubRepo: owner/name. GitHub linking is for hooks — not a substitute for ownership proof.