blastproof
Open-source AI testing agent for pull requests

Every diff has a blast radius.Test inside it.

You write end-to-end tests in plain English. An AI agent runs them in a real browser, but only the tests your pull request can actually break. You wait less and spend fewer tokens.

npx skills add hamc/blastproof

Then tell your coding agent: “set up e2e tests”

View on GitHub Watch the one-minute intro
100% local MIT licensed Your LLM key: Anthropic, OpenAI or Ollama
  1. git diff
  2. impact mapping
  3. test generation
  4. agentic execution
  5. report + score
Only what changed

Don't re-test the whole app for a change to the cart.

An AI agent in a real browser is more expensive than a script: each step is a model call, and a full suite on every pull request adds up quickly. blastproof reads the diff, works out which pages it can reach, and runs only the tests for those pages. Everything else is skipped, so no browser opens and no tokens are spent on it.

Run everything

The usual way
24tests run

Run what the diff touches

blastproof
4tests run
20 skipped · 0 tokens

Illustration: a 24-test suite and a pull request that changes the cart and checkout.

Faster pull requests

Feedback arrives while you still remember the change, not after the whole suite finishes.

A smaller token bill

You pay for the pages your change touches, with your own key. With a local model through Ollama, you pay nothing.

Nothing slips through quietly

A changed file that doesn't map to any page is flagged rather than silently skipped, and so is a touched page with no tests.

Plain English

A test is a list of sentences.

No selectors, no page objects, no scripts to maintain. Your tests are YAML files in your repository, readable by anyone on the team and reviewed in the pull request like any other code. The agent works out how to carry out each step and checks whether it's true.

.blastproof/tests/checkout.yamlYAML
summary: Checkout with discount
priority: P0
tags: [checkout, discount]
routes: ["/cart", "/checkout"]
steps:
  - add the Trail Pack to the cart
  - verify the cart total is $120.00
  - go to checkout
  - apply promo code SAVE20 and verify
    the page confirms 20% off
  - verify the discount line matches
    20% of the cart total
blastproof run --impacted --base mainexample run
diff main…HEAD  1 file → /cart, /checkout
selected        1 of 5 tests

P0 Checkout with discount
  ✓ add the Trail Pack to the cart
  ✓ verify the cart total is $120.00
  ✓ go to checkout
  ✓ apply promo code SAVE20 and verify…
  ✗ verify the discount line matches 20%…
    The page says SAVE20 gave 20% off, but the
    discount shown is -$6.00. 20% of $120.00
    would be -$24.00.

Score 0   exit 1
What happened here
No element broke. The test failed anyway, because the agent did the math.

We changed the cart discount from 20% to 5% without touching the test. The page still said “20% off”, and every button and field was where it had always been. A selector-based test would have passed. This one didn't.

Built for AI coding agents

Your coding agent sets it up. You review.

When code is written this fast, traditional end-to-end tests break with nearly every change. blastproof doesn't use AI to patch that. It puts AI at the core: agents understand what each test is for, drive the browser, and pick which tests to run.

One command 
$ npx skills add hamc/blastproof

Then tell your agent:

“set up e2e tests”

The skill already knows your stack, your port and which journeys matter, because it reads your project. From there it:

  • checks that your pages can be tested at all
  • picks a model provider and creates the config
  • drafts tests from your running app
  • trims them into tests that catch real problems, then runs them

Claude Code · Cursor · Codex · and other agents

Made for apps built with AI

blastproof needs accessible markup: buttons and fields with real names. The agent writing your UI can get that right from the first commit.

Tests agents can read and write

Plain English in YAML, in your repository. Your coding agent can extend the suite along with the feature, and a person reviews both in the same pull request.

No values made up

Anything the agent types has to come from your test, the page or a variable you named. When it tries to invent a value, blastproof refuses it.

You stay in charge

AI can suggest tests. Only you can approve them.

blastproof does two separate jobs. One runs by itself on every pull request. The other only runs when you ask, and nothing it writes counts until you approve it. An unreviewed AI-written test could block good code or let broken code through.

Automatic

On every pull request

  1. It sees which pages your change touches.
  2. It opens a real browser and runs only the tests for those pages.
  3. It scores the pull request and blocks the merge if something important broke.
  4. It lists pages that have no test yet, without blocking.

You get → merge or block

When you ask

For a page with no test yet

  1. It opens the page and drafts a test in plain English.
  2. You read the draft and fix anything it got wrong.
  3. You run it and see that it works.
  4. It joins your tests only after you approve it.

You get → a draft to review

Before you install

Is it a fit? Three quick checks.

Here's what it can't do yet, before you spend time on setup. It works best for new web apps, especially ones built with AI, and it runs alongside the tests you already have.

1 · Is your app accessible?

This matters most. blastproof finds buttons and fields the way a screen reader does: by their names. A button with no name is one it can't click.

  • ✓A button that says “Add to cart”
  • ✓A form field with a label
  • ✕Something clickable that isn't a real button
  • ✕An icon button with no name

The hardest shape is a spreadsheet-style grid you type into. If that's your main journey, spend one test on it before adopting.

2 · Do your key flows avoid these?

Not supported yet:

  • Embedded widgets, like a hosted payment form
  • Hovering, dragging, file uploads
  • Multiple tabs and browser pop-up dialogs

Windows hasn't been tested yet. Linux and macOS are fine.

3 · Do you have test data?

The agent really clicks and submits forms. Point it at a staging environment or a test account, never at real customer data.

Open source

An open alternative that runs on your machine.

There are commercial tools in this space. blastproof is for people who'd rather not depend on a platform. MIT licensed, runs locally or in your own CI, with your own LLM key.

  • Typical platformblastproof
  • Closed sourceMIT, on GitHub
  • Tests locked in their dashboardYAML files in your repo
  • Their cloud, their modelsYour machine, your key, or Ollama
  • Priced per seat or per runFree. You pay only for tokens

Prefer the terminal?

$ npm install -g blastproof   # Node ≥ 20.19
$ blastproof init
$ blastproof run --dry-run    # no key, no browser
$ npx playwright install chromium
$ export ANTHROPIC_API_KEY=…
$ blastproof run
View on GitHub Read the docs