Point it at a URL.
Walk away.
The Autonomous Exploratory Tester logs into your application, crawls up to 25 pages (8 by default), writes up to 6 Gherkin test flows with AI, runs each in a real browser, and drafts a structured bug report for every failure — all without a single line of written test input. Every run that finishes then says what its limits left out.
Five automated phases. Zero written input.
From the moment you hit Start to the moment bug candidates appear in your results, every step is handled by the agent. You choose which ones to file to Jira or ClickUp.
Login
The agent opens your application URL in a real Playwright browser and heuristically locates the login form — finding the password field, username/email input, and submit button without any written rules. It fills your credentials, submits the form, and confirms success by checking for a URL change, appearance of a logout link, or disappearance of the password field.
Crawl
Starting from the post-login page, the agent performs a breadth-first crawl of your application, staying on the same host — it never wanders to external sites — until it reaches the page limit (8 by default, at most 25) or the depth limit. For every page it opens it records the title, headings, links, up to 40 controls and the form count, building an interactive map of your UI surface.
Discover Flows
A summary of the first 12 pages the crawl opened — titles, headings, up to 10 controls a page — is fed to AI, which writes up to 6 Gherkin test flows however many pages were crawled. Scenarios cover navigation sequences, search interactions, filtering, and pagination, all referencing real labels from your live application. A flow whose wording would submit or change data is dropped and replaced by a page-load smoke flow. When AI is unavailable, only page-load smoke flows are written.
Execute
Each flow is executed in a real browser through the same PipelineRunner that powers QAEverest's UI Automation module, within a 20-minute budget for the whole phase. The browser session starts pre-authenticated — the login state saved during Phase 1 is injected — so every scenario begins where a real user would. Per-flow results include pass/fail status, the failed step, error detail, and a screenshot on failure; a flow the budget left no time for is reported as not run, never as passed.
Triage Bugs
Each failed flow is analysed by AI, which produces a structured bug candidate: a concise title, a severity rating (Critical, High, Medium, or Low), the expected behaviour, and the actual behaviour. The Gherkin flow itself serves as the built-in reproduction steps. Bug cards appear in the results view instantly, ready to file.
See what the crawl reached, page by page
Every run draws a map of the pages it reached, as a graph or a tree, and the map fills in live while the crawl runs. Open a page for its screenshot, how the crawl got there, and the flows and bugs that touched it.
Coloured by what happened
Each page shows Flows passed, Bug or failed flow, Crawled or Not crawled, so you can see where the problems sit.
Unopened links, folded by template
Links to pages that share a template, like
/orders/:id, fold into one Not crawled card with a +12 more count instead of filling the map. The crawl opens at most two pages per template.Clear about what it missed
Links the crawl saw but did not open stay on the map as Not crawled, apart from destructive-looking ones. Every run that finishes also counts what each limit left out: pages not opened and why, pages the flow writer was not shown, flows not run, fields not checked.
Map the app only
Just want the map? This mode logs in, crawls and draws it without generating or running anything, at 5 credits per page crawled instead of 10.
Go deeper on one page without re-running the whole app
On a finished run's map, pick a page and choose Explore this page. It crawls that page and the pages it links to, up to 5 pages in all, writes up to 3 flows that start there, runs them and triages anything that broke.
No login to retype
The run's signed-in browser session is kept encrypted for 45 minutes from sign-in by default and reused, so there is nothing to type unless your app has ended it. It is the session that is kept, never your password, and Forget saved login removes it sooner.
Any page on the map
That includes pages the first crawl saw but did not open, so a page or depth limit does not leave them out for good.
Check its inputs too
Tick Validate inputs on this page to probe up to 12 of its fields with boundary, negative and valid values. Submitting forms with invalid data is a separate opt-in that creates real records, so use it on a test environment.
A flat price
10 credits for the run, not per page. It crawls up to 5 pages in all.
Every failure becomes a structured bug report
The agent doesn't just flag failures — it writes the bug for you. Each failed flow becomes a complete bug candidate with a title, severity, expected vs actual behaviour, and the Gherkin flow as reproduction steps — ready to file, and labelled Automation issue when the automation may be at fault.
Works for public and protected applications
No login? No problem. Credentials? The agent finds the form and fills it.
Public applications
If the target URL has no password field, the agent detects this automatically and proceeds directly to crawl — no credentials configuration needed.
- E-commerce product catalogues
- Public dashboards and portals
- Documentation and support sites
- Marketing and landing pages
Protected applications
Provide your application username and password. The agent locates the login form, fills it, verifies success, and saves the session state so every executed flow starts pre-authenticated.
- SaaS application dashboards
- Admin and management panels
- Internal tools and intranets
- Customer and partner portals
Your password never touches our database
At run launch, your username and password are passed to the agent over a secure stdin channel as JSON — they never appear on CLI arguments (which are visible in the process table), never written to disk, and never stored in the database. The run record retains only a masked username such as “Ad***” for display purposes. The signed-in session is different. During the run it is a plain-text file on our server, deleted when the run ends however it ends; if our server itself goes down mid-run, a clean-up removes it once the server is back and the file is 42 minutes old. After a sign-in with your password works, the session is also kept encrypted in our database for 45 minutes by default, so single pages can be explored without signing in again, and Forget saved login deletes it sooner. Screenshots of the pages it crawls and of failed steps are kept with the run, and the executor records a video of each flow on our server unless that is switched off.
From bug candidate to Jira or ClickUp, already written
Every bug card has View details, File to Jira and File to ClickUp buttons. View details opens the whole bug: the flow's steps with the failed one marked, the automation's own message and the screenshot taken when it failed. The agent pre-fills the entire report — you only need to provide your project key or list ID.
File to Jira
Provide your Jira project key (e.g. QA). The agent creates an issue in your configured Jira instance using your API key from Settings.
File to ClickUp
Provide your ClickUp list ID. The agent creates a task using the token configured in Settings — personal or organisation-level.
QA-42) with a direct link to the tracker. Bugs already filed cannot be filed again from the same run.See what a release changed since the last crawl
A finished full or map-only run is compared automatically with an earlier finished crawl of the same app, preferring one made with the same login. After a release, use Re-crawl to compare, or choose another earlier run from the Compare dropdown.
New, Changed, Removed
Pages get a badge on the map, removed pages return as dashed cards, and a strip counts each kind. Click a count to highlight those pages.
What changed on the page
Open a changed page to see its title change, the controls added and removed, and how its form and input counts moved.
Data does not read as change
“Inbox (3)” and “Inbox (12)” are the same control, and
/orders/41is compared with/orders/42as one template.Cautious on purpose
A page is only called Removed if this crawl reached the page that led to it. Pages it cannot be sure about are counted as not reached, and a note says when a limit may have skewed the result, such as a page with more controls than a crawl records.
Save discovered flows as a regression suite
Tick the flows you want and save them as a real UI Automation suite, one test case per flow. Flows that passed are ticked to begin with. Saving costs no credits on an active plan.
Follows your environment
Navigation steps are saved as paths like
"/orders", so the suite runs against whichever UI environment you pick. Untick the option to keep the explored site's full URLs.Logins stay out of the steps
A flow that types into a password-like field is skipped and named in the result, rather than copied into plain-text steps.
The login goes in once
Saved flows assume a signed-in browser. Add your app's login under the suite's menu → Prerequisite Steps before running the suite.
Environment handled
If you have no UI environment for this app, one is created when you save. Open suite takes you straight to Edit Suite.
More detail in the Exploratory Testing FAQ and the case study on exploring an unfamiliar app.
See It In Action
Enter your application URL and preview the Login → Crawl → Discover Flows → Execute → Triage Bugs run.