Qodex
Qodex is an agentic QA platform whose autonomous agent reviews pull requests and runs API, UI and OWASP security tests against your running application, producing exportable Playwright and HTTP scenarios that replay deterministically without further model calls.
What is Qodex?
Qodex is an agentic QA platform built around a single autonomous agent that both reads your code and drives your running application. That combination is its central claim: AI code reviewers stop at the diff, autonomous pentest tools never see the source, and Qodex positions itself as the tool built on both.
Every component runs the same five-step loop. The agent explores first, crawling the web application with a real Chromium browser, ingesting OpenAPI, Swagger or Postman collections, and reading the route table and authentication wiring from a linked GitHub repository. It then generates: you describe in plain English what should hold true, and it writes a structured scenario, with a goal, ordered steps and explicit assertions, alongside standard Playwright or HTTP code, API scenarios being auto-verified against the target on save. Execution is where the economics sit. Once a scenario is promoted from draft to active, replay is plain code with no model in the loop, so the hundredth test costs what the first one did. The agent then classifies every failure as a real bug, a stale test or an environment issue, and finally remembers auth flows, API patterns, UI structure and past findings in a per-project memory, so coverage compounds instead of resetting.
Six co-equal components sit on that loop: UI testing, end-to-end journeys, functional testing, API testing, security testing and pull-request review. Security scenarios use inverted semantics, where a pass means the attack was blocked, so the agent cannot turn a failing check green by weakening the assertion. Probes span authentication bypass, BOLA and IDOR across roles, injection, SSRF and misconfiguration, mapped to the OWASP Top 10 and the OWASP API Top 10. Review arrives as a GitHub App that posts a status check, runs verification probes against the pull request's preview deployment, files inline findings with the failing request, the response and a screenshot, and can gate the merge with a Check Run. It never merges or deploys on its own.
Scenarios run on demand from chat, on a cron schedule, or fired by CI, a deploy hook or any webhook. The site reports 4.9 out of 5 from 60 reviews on G2.
What it does
- Review every pull request and post inline findings backed by a real test run
- Generate runnable API, UI and end-to-end scenarios from a plain-English brief
- Probe changed endpoints for OWASP, BOLA, IDOR, injection and SSRF regressions
- Replay the whole suite on demand, on a schedule or on a deploy hook without a model call
- Classify each failure as a real bug, a stale test or an environment problem
- Propose the repair of a stale test as a diff for a human to approve
- Block a merge with a pre-merge Check Run when a scenario or a security probe fails
When to use Qodex / When not to
A quick filter to help you decide if Qodex is the right fit.
When to use Qodex
- Engineering teams shipping daily, whose pull-request queue has outgrown what anyone can hand-write tests for
- Small teams with no dedicated QA engineer that still need confidence in every release
- Backend and full-stack developers with a large API surface to import from OpenAPI, Swagger or Postman
- Application security engineers who want continuous OWASP, BOLA and IDOR coverage in the same suite as functional tests
- Solo developers and freelancers, served by the permanently free Individual tier of one repository, 25 scenarios and 100 runs a month
When not to use Qodex
- Teams testing native mobile applications: the agent drives a Chromium browser, and no iOS or Android tooling is published
- Teams hosting code outside GitHub, since pull-request review ships as a GitHub App with no GitLab or Bitbucket equivalent announced
- Buyers who need formal assurances up front: no SOC 2 or ISO 27001 certification, no published DPA and no subprocessor list appear on the site
- Organisations bound to European-only hosting, as customer data is declared to sit on servers in the United States
- Teams looking for load, performance or unit testing: Qodex exercises the running application, not isolated code under synthetic load
How to use Qodex
A typical end-to-end flow, from setup to results.
- Open a free account through the trial; no credit card is required
- Start with the free app scan: point Qodex at your application and let it discover the APIs and return functional and OWASP findings
- Install the GitHub App and link the repositories you want reviewed
- Import what you already have rather than starting from zero: OpenAPI and Swagger specs, Postman collections, spreadsheets, existing tests
- Describe in plain English what should be verified; the agent writes the scenario as a draft
- Review each draft and promote it to active, a human step that is required before any scheduled run
- Configure environments and authentication profiles so scenarios run against staging rather than production
- Set the triggers: on demand from chat, on a cron schedule, or from CI, a deploy hook or a webhook
- Connect integrations under Settings then Integrations: GitHub, a Slack webhook, a generic webhook, email digests or your own OpenAI key
- Triage the findings, which arrive as real bugs with repro steps and evidence, stale tests with a suggested fix, or environment issues labelled as such
Pros & Cons
Pros
- Deterministic replay makes no model call, so the cost of the suite does not grow with its size
- Generated tests are standard Playwright and HTTP code you can export, edit and commit, with no proprietary runtime
- One agent with one shared memory covers UI, API, security and pull-request review instead of four separate tools
- Review is grounded in real execution against the preview deployment rather than a static read of the diff
- Inverted security semantics stop the agent from turning a failing check green by weakening the assertion
- Failures are triaged into real bug, stale test or environment issue, which limits alert fatigue
- A permanent free tier and documented self-hosting, from a single container to an AWS Terraform reference, make evaluation cheap
Cons
- The Startup tier shows a quote request rather than a price; the only traceable figure, 999 USD per month per project, appears solely in the pricing page metadata
- The gap between the free tier and the first paid tier is steep, and runs beyond the allowance are billed separately
- No SOC 2 or ISO 27001 certification, no published data processing agreement and no subprocessor list appear anywhere on the site
- GDPR compliance is never claimed in writing, and no Article 27 representative is designated for the European Union
- Data is hosted in the United States and other jurisdictions where the vendor operates, a deliberately open formulation
- Pull-request review is GitHub-only, with no GitLab or Bitbucket support announced
- The fully deterministic UI runner is still on the roadmap, and the terms and privacy policy carry a January 2025 date despite a visibly newer product
Pricing & Plans
A permanent free plan is available: the Individual tier costs 0 USD and covers one repository, 25 test scenarios and 100 test runs per month. The lowest paid entry point is the Startup tier, quoted at 999.00 USD per month per project, although the pricing card itself invites visitors to request a quote; the Scale tier starts at 2,500 USD per month. Runs beyond the Startup allowance are billed at 20 USD per 1,000. Billing is monthly or annual, in advance, and fees are stated to be non-refundable.
- one GitHub repository
- up to 25 test scenarios and 100 test runs per month
- one AI chat session at a time with synchronous runs
- core OWASP-aligned security probes
- import from OpenAPI
- Postman
- spreadsheets and existing tests
- findings with the failing request
- up to 10 repositories per project
- 200 scenarios and 10
- 000 runs per month
- 2 concurrent chat sessions and 2 concurrent runs
- a scenario layer that adapts as the code changes with coverage-gap generation in chat
- full API testing with multi-step flows
- auth profiles and governance
- full UI testing with the Pages catalog
- unlimited scenarios
- runs and environments
- high concurrency
- SSO/SAML
- role-based access
- audit logs
- advanced security and compliance
- data redaction
Data, GDPR & hosting
A consolidated view of how Qodex handles your data.
GDPR overview
The site never mentions the GDPR. Across every page collected, the privacy policy and the terms included, the regulation is not named once, so no compliance claim is made and none is denied. What the privacy policy does provide is a list of seven data subject rights, namely access, correction, deletion, portability, objection, restriction and withdrawal of consent, exercised by writing to care@qodex.ai, together with a statement that international transfers rely on appropriate safeguards such as standard contractual clauses approved by data protection authorities. Beyond that the usual apparatus is absent: no Article 27 representative in the European Union, no data protection officer, no data processing agreement offered, no subprocessor list. The minimum age is eighteen and both documents are dated January 2025. Buyers processing personal data should obtain these commitments contractually rather than assume them.
Who owns the data?
Under the terms of service you keep ownership of everything you submit, and Qodex.ai receives only a licence to use, store and process that material for the sole purpose of delivering the service. The generated tests are yours as well: scenarios are emitted as standard Playwright and HTTP code, parameterised by environment variables, that you can read, edit, commit to git and run elsewhere, with no proprietary runtime holding them hostage. The GitHub App requests read access to pull requests rather than write access to your source. Asked what customers keep if they leave, the homepage answers in one word: everything.
Reuse rights
The licence you grant is narrow. Qodex.ai may use, store and process your submissions solely to provide the service, and the privacy policy limits its purposes to service delivery, account management, support, communications, analytics, security and legal compliance. Personal information is not sold to third parties for marketing. The homepage states that customer data is never used to train models and that provider agreements exclude training as well; cached replays make no model call at all, and a project can supply its own OpenAI key instead. Environment tokens are cached for thirty minutes, cleared when an environment is saved and redacted from API responses. On your side there is nothing to ask permission for: the scenarios and scripts the agent generates belong to you, and you may export them, modify them, keep them in version control and run them on any infrastructure.
Data retention & training
Hosting summary
Customer data is declared to sit on servers in the United States. The homepage states that it is encrypted in transit and at rest there, isolated per project, never sold and never used to train models, while the privacy policy widens this to servers located in the United States and other jurisdictions where the vendor operates, without naming any other country. No European hosting region is offered. The declared safeguards are conventional: TLS in transit, encryption of sensitive data at rest, regular security assessments, access controls, secure data centres and staff training, with international transfers covered by standard contractual clauses. The Scale tier adds mTLS and data redaction. Teams that cannot send data to a United States provider have a documented alternative in self-hosting, with a single-container deployment, Docker Compose and an AWS Terraform reference, which puts the choice of infrastructure back in their hands. One caveat on published network data: the site's resolved IP address belongs to an Amazon CDN edge node observed in Italy, which describes content delivery and says nothing about where customer data is stored.
Things to keep in mind
Risks and trade-offs to weigh before adopting Qodex.
- Qodex fires hostile probes at a live target, including injection, SSRF and authentication bypass; run it against staging, never against production without explicit sign-off
- The agent is granted read access to pull requests and holds environment credentials, so its blast radius should be weighed against your internal secrets policy before a repository is connected
- The only traceable price for the middle tier lives in page metadata rather than on the pricing card; confirm the figure, and whether billing is per project or per organisation, before committing
- Usage beyond the plan allowance is billed separately, so an automated suite that quietly grows can move the invoice without anyone deciding to
- With no data processing agreement, no subprocessor list and no mention of the GDPR, any personal data flowing through test runs should be covered contractually first
- Trusting an autonomous reviewer can erode the habit of human review; the vendor itself insists that the agent recommends and humans ship, and that discipline has to be kept on your side
- Generated tests are only as good as the brief behind them, and a green suite can create a false sense of safety if nobody checks that the scenarios assert what actually matters
Setup & Integrations
Technical difficulty
Low to begin with. The fastest route is the free app scan: point Qodex at an application and it discovers the APIs and returns findings with no configuration at all. The standard path is installing the GitHub App, linking a repository and describing tests in plain English, and existing OpenAPI specs, Postman collections, spreadsheets and tests can be imported rather than rewritten. Reading and editing the generated Playwright and HTTP scripts, and configuring environments and auth profiles, calls for developer skills. Self-hosting is a different order of difficulty, involving Docker Compose or Terraform, storage backends and secret management.
Deployment
Integrations
Supported languages
Behind Qodex
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Qodex.
Frequently asked questions
How is Qodex different from an AI code reviewer?
Does Qodex change code, merge or deploy on its own?
Is customer data used to train AI models?
What does Qodex cost, and is there a free plan?
What happens to the tests if we stop using Qodex?
What access does Qodex need to our repository?
Is Qodex GDPR compliant?
Can Qodex be self-hosted?
Which platforms and integrations does Qodex support today?
Should you pick Qodex?
Qodex answers a specific complaint: that AI code reviewers comment on a diff they never execute, while hand-written suites rot faster than anyone can patch them. Its response is an agent that reads the repository and drives the running application, then replays what it wrote as ordinary Playwright and HTTP code. That last point carries most of the weight. Because replay makes no model call, running the full suite on every deploy stops being a budget decision, and because the scripts are standard and exportable, nothing holds the tests hostage if the relationship ends.
The same engineering discipline shows in smaller choices. Security scenarios pass only when an attack is blocked, so the agent cannot cheat its way to green. Failures are sorted into real bug, stale test and environment issue before anyone is paged. Drafts have to be promoted by a person before they run on a schedule.
The reservations are commercial and contractual rather than technical. The middle tier hides its price behind a quote request, and the only traceable figure sits in page metadata rather than on the page itself. More consequentially for a tool granted read access to pull requests and custody of environment credentials, the site publishes no SOC 2 or ISO 27001 certification, no data processing agreement and no subprocessor list, and never mentions the GDPR at all. Data sits in the United States, with self-hosting as the documented escape hatch. The terms and the privacy policy still carry a January 2025 date.
For an engineering team on GitHub shipping daily, especially one without a dedicated QA engineer, the free tier makes the evaluation cheap and the exportable output makes it low-risk. For a buyer working through a procurement checklist, the paperwork will have to be requested rather than downloaded.
- Choosing a selection results in a full page refresh.
- Opens in a new window.