Qodex
AI AutomationUpdated November 13, 2026
AI QA agent that runs real API, UI and security tests on every pull request and posts review findings with the failing request and response.
We may earn a commission when you sign up through our links. It does not affect our reviews.
What is Qodex?
Built originally as an AI API testing tool, this platform now pitches itself as a QA agent for teams whose pull requests are increasingly written by Cursor, Claude Code or Codex. It reads each pull request, runs API, UI and OWASP-style security scenarios against your preview or staging URL, and posts findings with the failing request, response and screenshot attached. The AI writes or repairs a scenario once; after that, replays are plain Playwright and HTTP code with no model call, so a growing suite does not grow your model bill. You own that code and can export it. The weak spots are clear too: team testing plans start at $1,299 per project per month and go through sales, you need a reachable staging or preview environment, and self-managed GitLab is not supported yet. Pick it if your API and web app ship daily and nobody owns QA.
How to start using Qodex?
Sign up at agents.qodex.ai with email, Google or GitHub. Email signups confirm the address with a code, and the first project you create gets a 14-day free trial with no credit card. The About you screen asks for your name and company, then Qodex asks what it should do first, with four cards: Review my pull requests, Test my APIs, Test my UI and Check API security. Pick one; you can add the other jobs to the same project later.
For a first real scenario, choose Test my APIs. In the What Qodex should know box, paste an OpenAPI 3.x or Swagger 2.0 file or URL, a Postman collection or a curl command, and add how to log in. Click Start. The agent asks once for what a spec cannot carry: what the app does, the staging URL and test credentials. It reads the auth scheme from the spec’s securitySchemes or the Postman auth settings, writes scenarios, and runs each one as it is saved, so every scenario arrives with a verdict.
The chat is the main workspace. It streams every step, tool call and sub-agent, including a live view of the browser it drives, and you can steer it mid-run, for example by asking it to explore the login flow and check a users endpoint for IDOR. New scenarios land as drafts. Promote the ones you trust to active, because only active scenarios run on a schedule or from CI. Environments, under Context, hold base URLs and auth profiles, and you can mark an environment read-only and cap its request rate before any security probe goes near production. Settings > LLM keys is where you plug in your own OpenAI key or ChatGPT account.
To put Qodex on pull requests, install the Qodex GitHub App on the repositories you choose, then link a repo under Settings > Connections > GitHub. A project can link up to 10 repos, and repos over 500 MB are rejected. On GitHub, Qodex reviews your newest open pull request right away and posts a walkthrough comment, inline findings and a Check Run. That check stays advisory until you switch on blocking in .qodex.yaml, and you can trigger or pause reviews with @qodex-ai review and @qodex-ai pause.
Who is it for?
Teams shipping AI-written code
When coding agents open more pull requests than people can review, diff-only bots add opinions rather than proof. Qodex runs the change against your preview and attaches the failing request and response. Reviewers spend their time on confirmed bugs instead of guesses.
Startups without a QA hire
Small teams often merge on faith because nobody owns the regression suite. Qodex drafts API and UI scenarios from your spec or app URL and keeps running them on every pull request. You get a safety net before you can justify a dedicated QA engineer.
API platform teams
You already maintain an OpenAPI spec or a Postman collection, but the assertions lag behind the endpoints. Importing either produces runnable scenarios with auth profiles, role boundaries and multi-step flows. A coverage map then marks each endpoint as tested, untested or failing.
Multi-tenant SaaS security owners
Broken object-level authorization and auth bypass are the bugs that end up in breach notices. Qodex runs OWASP API Top 10 probes such as SQLi, XSS, SSRF and IDOR, where a passing test means the attack was blocked. You catch a cross-tenant leak on the pull request rather than in a pentest report.
QA engineers fighting flaky suites
A red build caused by a stale selector or a downed staging server teaches people to ignore the gate. Qodex classifies each failure as a real bug, a stale test with a proposed fix, or an environment problem that does not count against the suite. The gate stays one your team trusts.
Regulated or privacy-bound organizations
Some companies cannot send code and test traffic to a shared cloud. Self-hosted Qodex runs as one Docker container on your own Postgres, with Docker Compose and an AWS Terraform reference for larger setups. Code, artifacts and model traffic stay inside your environment.
Qodex pricing
Pricing is split across three tabs: Automation Testing, billed per project per month; PR Review, billed per reviewed pull request or per team; and Autopilot, scoped per engagement. The docs state that prices are the same in every region. The first project gets a 14-day free trial with no card, then falls back to the free plan unless you upgrade. Startup, Scale, PR Review Enterprise and Autopilot are bought through a sales call or email, since self-serve upgrades are still listed as planned.
One GitHub repository, up to 25 test scenarios and 100 test runs a month, one AI chat session at a time and synchronous runs. You get core OWASP probes and community support. Qodex-funded model usage is capped at $5 per 5 hours, $10 per 7 days and $20 per month, unless you add your own key.
Up to 10 repositories, 200 scenarios and 10,000 test runs a month, 2 concurrent chats and 2 concurrent runs, the full API, UI and OWASP suites, velocity analytics, CI/CD, Slack, Jira and Cursor (MCP) integrations, plus scheduled and webhook runs. Runs beyond 10,000 cost $20 per 1,000.
Unlimited scenarios, runs and environments, high concurrency, SSO/SAML, role-based access, audit logs, mTLS, data redaction, custom retention, webhooks and API access, and priority support on Slack, WhatsApp and email with SLAs.
One developer, 20 reviewed pull requests a month, up to 2 automatic reviews per pull request, unlimited repositories and the GitHub status check.
You are charged once per pull request however often it is re-reviewed, with no seats and no monthly minimum. It adds on-demand reviews, deep review, the code graph, the merge gate and custom checks.
You pay the model provider directly.
Custom. A larger review model, unlimited reviews per pull request, self-hosting, SSO and custom terms.
Custom. Fully autonomous QA, priced per engagement after a call with the team.
Qodex key features
Execution-backed PR review
Qodex reads the diff and surrounding code, comments on the exact lines and drops any finding below 0.7 confidence. When a preview deployment exists, it sends one safe GET request to check the finding and marks it verified if it reproduces. You get fewer speculative comments, though diffs over 200 KB are truncated, so split large refactors.
API tests from your spec
Import an OpenAPI or Swagger file, a Postman collection, a spreadsheet of endpoints or a one-sentence brief, and the agent writes HTTP and GraphQL scenarios with assertions. On paid plans it adds multi-step flows, auth profiles and a governance view of the endpoint catalog. Scenarios carry the role they run as, so admin, member and anonymous callers hit the same endpoint.
Intent-driven UI testing
You describe steps in plain English and Qodex resolves them against the live page in a real Chromium browser, generating Playwright scenarios. A successful first run creates an AI-free replay cache, and when a page changes enough to break the cached path, it re-resolves the step and repairs the test. Failed runs come with per-step screenshots, DOM snapshots, console and network logs.
Security probes with inverted semantics
The OWASP-aligned hostile mode tries SQLi, XSS, SSRF, IDOR/BOLA and auth bypass against your API. A pass means the attack was blocked, so the agent cannot turn a red check green by loosening an assertion. Per-environment constraints let safe checks run on production while heavier payloads stay on staging.
Three-way failure triage
Every failed test is labelled as a real bug, a stale test or an environment issue. Real bugs arrive with the failing request, response and screenshot; stale tests arrive with the repair as a diff you approve; environment problems are flagged and not counted.
Owned code and cheap replays
Scenarios are standard Playwright and HTTP code, parameterized by environment variables, that you can read, edit and export. The model is used when a test is authored or repaired, not on each run, and with your own key Qodex says it takes zero margin. Note that pushing generated tests back to your repository is still marked as planned in the docs.
Autopilot regression loop
Bugs your team files in Sentry, Jira, Datadog or PagerDuty, or sends over a webhook, become regression scenarios that Qodex reproduces on staging. After one human approval, any pull request that would reintroduce the bug fails the merge gate. Automatic ingestion straight from the error monitor is still on the roadmap.
Qodex Pros & Cons
Pros
Findings come with proof. A failing request, the response and a screenshot are far easier to act on than a reviewer bot guessing that a query might leak data. Because replays run without a model, a nightly full-suite run costs execution time rather than tokens, and the tests remain standard Playwright and HTTP code if you leave. The free entry points are real: 20 reviewed pull requests a month, or 200 on your own ChatGPT plan, plus a $0 testing tier. Self-hosting and the open-source OpenQodex for local pre-push review give privacy-minded teams options. Start with PR review on one busy repo and judge it by how many findings were real.
Cons
The pricing cliff is sharp. The free testing tier stops at 25 scenarios and 100 runs, and the next step is a quote starting at $1,299 per project per month, with no self-serve upgrade yet. You need a staging or preview URL the agent can reach, plus test accounts, before UI and API scenarios are useful. GitLab support covers GitLab.com only, and syncing tests to your repo is not live. G2 reviewers also mention slow loading of the chatbot and reports and thin documentation for advanced configuration. Budget time for environment setup, and ask sales for the exact limits in writing.
Use Qodex if you want…
- Test every pull request against a real running app.
- Turn an OpenAPI spec into runnable regression tests.
- Catch cross-tenant authorization bugs before they merge.
- Review AI-written code with evidence, not opinions.
- Keep tests as exportable Playwright and HTTP code.
- Turn filed production bugs into permanent regression checks.
- Run PR review on your own ChatGPT plan.
- Self-host QA agents inside your own infrastructure.
Qodex alternatives
Qodex Reviews
G2 reviewers frequently call it a big time-saver for API testing that cuts manual testing and widens API and performance coverage, although one of the most positive reviews still asks for better documentation and structure.
Several G2 users say the AI chatbot and reports load slowly, and a few report repeated test cases and less accurate results on complex user journeys.
Some G2 reviewers found onboarding straightforward and liked that tests adjust automatically when APIs change, but want deeper customization and finer control over test configurations for advanced scenarios.
Product Hunt reviewers praise automatic API discovery and chat-based test generation that non-technical teammates can use; none of the four reviews lists a drawback, so treat them as early impressions.
FAQ
Is there a free plan?
Yes. The Individual testing plan is $0 per project with 25 scenarios and 100 test runs a month, and PR Review Free covers one developer and 20 reviewed pull requests a month. Your first project also starts with a 14-day free trial, no credit card required.
Does Qodex train AI models on my code?
No. Qodex states that your code, specs, scenarios and run history are never used to train models, and data is encrypted in transit and at rest and isolated per project. With your own key, model calls go through your provider account instead of Qodex’s.
Which Git platforms does it support?
GitHub through the Qodex GitHub App, and GitLab.com through OAuth or a token. Self-managed GitLab is not supported yet, and Bitbucket is not listed among the integrations.
Can Qodex push code or merge pull requests?
No. The GitHub App reads repository contents and writes only review comments and Check Runs; it cannot push commits, change repository settings or merge. A human decides what merges, and stale-test repairs come as diffs you approve.
Do I own the tests it generates?
Yes. Scenarios are standard Playwright and HTTP code parameterized by environment variables, which you can read, edit and export. Automatic syncing of tests back to your GitHub repository is listed as planned.
Can I self-host Qodex?
Yes. The simplest setup is one Docker container connected to Postgres 16 or 17, with Docker Compose and an AWS Terraform reference for production. A Kubernetes Helm chart is planned, and self-hosting is part of PR Review Enterprise.
What is OpenQodex?
OpenQodex is the company’s open-source code review tool under the Apache 2.0 licence. It runs locally inside Claude Code, Codex, Cursor, Cline or Goose before you push, needs no Qodex account, and installs with npx openqodex init.
What happens when I hit a plan limit?
For PR review, new pull requests get a neutral Check Run saying the review was skipped for the plan limit, and members are emailed at 80% and 100% of the monthly allowance. For testing, you can wait for the spend window to roll over, add your own OpenAI key or ChatGPT account, or upgrade.
Similar tools
GPT WorkspaceAI agent for Google Docs, Sheets, Slides, Gmail and Drive that edits your files, runs GPT formulas in bulk and automates routine
FPT.AIVietnamese enterprise AI platform from FPT Smart Cloud for chatbots, call-center voicebots, document reading and eKYC that automate customer operations.
Frigate NVROpen-source NVR that runs real-time AI object detection on your own hardware and sends camera events to Home Assistant and other MQTT