breakit

Autonomous exploratory testing for web apps. AI personas try to break your site so real users don't have to.

npx breakit test https://your-app.com

Install

npm install -g breakit

Or run directly with npx:

npx breakit test https://your-app.com

Setup

Set your Anthropic API key:

export ANTHROPIC_API_KEY=sk-ant-...

Or pass it directly:

breakit test https://your-app.com --key sk-ant-...

What it does

breakit launches 5 AI personas against your web app. Each uses a real browser (Playwright) controlled by Claude to explore your app the way unpredictable humans would.

| Persona | What they do | |---------|-------------| | :older_woman: Confused Grandma | Misreads labels, clicks wrong things, puts names in phone fields, gets lost in flows | | :firecracker: Form Abuser | XSS, SQL injection, 10k-character strings, empty submits, emoji in email fields | | :iphone: Mobile User | Tests on iPhone viewport (390x844), checks tap targets, overflow, responsive layout | | :zap: Impatient Teenager | Double-clicks everything, navigates away mid-submit, rapid back-button abuse | | :new_button: First-Time Visitor | Zero context arrival, evaluates clarity, tries signup, reports confusing UX |

Every bug found is automatically verified by replaying the steps. You get a structured report with severity, reproduction steps, and screenshots.

Usage

breakit test <url> [options]

| Flag | Description | Default | |------|------------|---------| | -k, --key <key> | Anthropic API key | ANTHROPIC_API_KEY env | | -d, --description <text> | Brief description of the app | -- | | -e, --email <email> | Login email for authenticated testing | -- | | -p, --password <password> | Login password | -- | | -t, --time-budget <seconds> | Max run time in seconds | 300 | | -n, --personas <count> | Number of personas to use | 5 | | -o, --output <dir> | Output directory for reports | ./breakit-output |

Examples

# Quick scan, 2 minutes, 3 personas
breakit test https://my-app.com -t 120 -n 3

# Authenticated testing
breakit test https://my-app.com -e [email protected] -p testpass123

# With app description for smarter testing
breakit test https://my-app.com -d "E-commerce store with checkout flow"

Report output

Reports are saved to ./breakit-output/ as both Markdown and JSON.

breakit Report -- https://your-app.com

Run ID: brk_a1b2c3
Duration: 4m 32s
Personas: 5 | Actions: 142 | Findings: 7

## Findings

### [CRITICAL] XSS via unescaped user input in search results
Persona: form_abuser | Category: security | Confidence: verified

Steps to reproduce:
1. Navigate to /search
2. Enter <script>alert(1)</script> in the search input
3. Click Search
4. Observe the results page heading

Expected: Input should be sanitized/escaped
Actual: Script tag rendered in page, XSS possible

How it works

1. Discovery -- Crawls the target site, maps pages and forms
2. Execution -- Each persona gets a browser and explores with Claude driving actions via tool-use
3. Verification -- Candidate bugs are replayed to confirm they're real
4. Report -- Structured output with severity, steps, screenshots

License

MIT -- Copyright 2026 Petr Kindlmann