Browser testing for coding agents: verify before done

One command

CLI version 0.1.1 on npm, no install needed. Requires Node 22 or newer. login opens your browser to approve a token for one app and stores it in the macOS Keychain or the Linux secret service. setup shows a diff and asks before it writes anything, keeps a .bak of every file it changes, and only touches the Well Tested server entry and skill files.

npx welltested login
npx welltested setup        # Claude Code, Cursor, Codex, Windsurf, Copilot (VS Code), Kiro
npx welltested setup --agent cline        # or --agent antigravity: you paste the token once

Testing a local app? npx welltested tunnel --port 3000 opens an origin-scoped tunnel and keeps a "Local (CLI tunnel)" environment up to date. Only the ports you name go through your machine. Quick-tunnel URLs are public while the tunnel runs. Or skip the tunnel: npx welltested login --runner, then npx welltested run --local reruns your kept tests in a browser on your own machine.

All commands

• npx welltested login [--label <name>] [--runner]
  Approve a token in your browser; it is stored in the OS keychain. --runner also allows run --local.
• npx welltested setup [--agent <id>]... [--yes] [--dry-run]
  Add the Well Tested MCP server and the verify-before-done skill to your coding agents. Claude Code, Cursor, Codex, Windsurf, Copilot and Kiro are detected; Cline and Antigravity only with --agent. Shows a diff and asks first.
• npx welltested tunnel --port <n> [--also <n>]... [--yes]
  Test localhost through an origin-scoped cloudflared quick tunnel.
• npx welltested run [--scenario <id>]... [--suite <id>] [--env <id>] [--save-evidence]
  Rerun kept tests or a suite in our cloud browser and print verdicts and proof links.
• npx welltested run --local [--scenario <id>]... [--headed] [--url <origin>] [--yes]
  Rerun kept tests in a browser on your own machine. localhost works without a tunnel. Needs a --runner token; masked evidence is uploaded.
• npx welltested doctor
  Check Node, token, tunnel binary and environment reachability.
• npx welltested token [--mcp-headers]
  Print the stored token (for WELLTESTED_TOKEN or an agent header helper).
• npx welltested logout
  Remove the stored token.

What the agent can do

• welltested_status: Environments, reachability, usage left this month, kept tests.
• welltested_plan: Draft numbered steps for a flow. You approve them in chat.
• welltested_run: Run an approved plan, kept tests, or a suite.
• welltested_get_run: Verdict, Jev + Clef triage, failing step, console errors, failing requests, what changed since the last green run, proof link.
• welltested_list_scenarios: Your kept tests and suites with their last result.
• welltested_save_scenario: Keep a passed run as a regression test.
• welltested_test_ai_feature: AI feature testing (beta): start an approved test suite for a chatbot or AI endpoint. Listed only for workspaces in the beta.

A new plan never runs without your approval in chat. Kept tests rerun without it, because keeping them was the approval. 1 credit = 1 passing test run, on one browser, up to 1 minute. Only passing runs use credits. A run that catches a bug in your app, or fails because of us or your environment, is free. A dead target or an offline tunnel is refused before anything is reserved.

Manual setup

Create a token under Settings → Coding agents, or run npx welltested login. Then add the server for your agent and copy the skill from /agent-skills/welltested-verify/SKILL.md into the skill path shown.

Claude Code

Config: .mcp.json (project root, safe to commit: no secret inside)

{
  "mcpServers": {
    "welltested": {
      "type": "http",
      "url": "https://welltested.io/api/mcp",
      "headersHelper": "npx --yes welltested token --mcp-headers"
    }
  }
}

Skill: .claude/skills/welltested-verify/SKILL.md

The helper reads your token from the OS keychain (after npx welltested login) and prints the Authorization header for each connection. Check it with claude mcp list.

Cursor

Config: ~/.cursor/mcp.json

{
  "mcpServers": {
    "welltested": {
      "url": "https://welltested.io/api/mcp",
      "headers": { "Authorization": "Bearer ${env:WELLTESTED_TOKEN}" }
    }
  }
}

Skill: .cursor/skills/welltested-verify/SKILL.md

Export WELLTESTED_TOKEN in the shell profile Cursor starts from (export WELLTESTED_TOKEN=$(npx welltested token)).

OpenAI Codex CLI

Config: ~/.codex/config.toml

[mcp_servers.welltested]
url = "https://welltested.io/api/mcp"
bearer_token_env_var = "WELLTESTED_TOKEN"

Skill: .agents/skills/welltested-verify/SKILL.md

Codex sends Authorization: Bearer $WELLTESTED_TOKEN. Export the variable before starting Codex.

Windsurf (Devin Desktop)

Config: ~/.config/devin/mcp_config.json

{
  "mcpServers": {
    "welltested": {
      "serverUrl": "https://welltested.io/api/mcp",
      "headers": { "Authorization": "Bearer ${env:WELLTESTED_TOKEN}" }
    }
  }
}

Skill: .devin/skills/welltested-verify/SKILL.md

Older Windsurf builds read ~/.codeium/windsurf/mcp_config.json with the same content.

GitHub Copilot (VS Code)

Config: .vscode/mcp.json (workspace, safe to commit: no secret inside)

{
  "servers": {
    "welltested": {
      "type": "http",
      "url": "https://welltested.io/api/mcp",
      "headers": { "Authorization": "Bearer ${input:welltested-token}" }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "welltested-token",
      "description": "Well Tested agent token (run: npx welltested token)",
      "password": true
    }
  ]
}

Skill: .github/skills/welltested-verify/SKILL.md

VS Code asks for the token the first time the server starts and stores it securely. Paste the output of npx welltested token.

Kiro

Config: .kiro/settings/mcp.json (workspace)

{
  "mcpServers": {
    "welltested": {
      "url": "https://welltested.io/api/mcp",
      "headers": { "Authorization": "Bearer ${WELLTESTED_TOKEN}" }
    }
  }
}

Skill: .kiro/skills/welltested-verify/SKILL.md

Export WELLTESTED_TOKEN before starting Kiro, and add WELLTESTED_TOKEN under the "Mcp Approved Env Vars" setting: Kiro only expands approved variables.

Cline

Config: CLI: ~/.cline/data/settings/cline_mcp_settings.json · VS Code extension: MCP Servers → Configure → Configure MCP Servers

{
  "mcpServers": {
    "welltested": {
      "type": "streamableHttp",
      "url": "https://welltested.io/api/mcp",
      "headers": { "Authorization": "Bearer <output of npx welltested token>" }
    }
  }
}

Skill: .cline/skills/welltested-verify/SKILL.md

Cline does not document reading a header from an environment variable, so paste your token into the header. npx welltested setup --agent cline writes the CLI file with a placeholder for you to replace; it is never set up automatically.

Google Antigravity

Config: ~/.gemini/config/mcp_config.json

{
  "mcpServers": {
    "welltested": {
      "serverUrl": "https://welltested.io/api/mcp",
      "headers": { "Authorization": "Bearer <output of npx welltested token>" }
    }
  }
}

Skill: .agents/skills/welltested-verify/SKILL.md

Antigravity needs serverUrl (not url) and does not document environment variables in headers, so paste your token. npx welltested setup --agent antigravity writes a placeholder for you to replace; then click Refresh under Manage MCP Servers.

Security

• Tokens go only in the Authorization header, never in URLs. Each token works for one app; revoke it any time in Settings.
• The CLI sends your token only to welltested.io, never to artifact or redirect hosts, and sends no telemetry.
• App context your agent shares is a summary (routes, features, acceptance lines). Fields that look like secrets are dropped and never stored.