PrestCode

AI-powered security scanner, web crawler, and Playwright test generator for GitHub PRs.

prest secure https://mysite.com
prest crawl https://mysite.com "find the pricing page"
prest report https://mysite.com
prest generate https://github.com/owner/repo/pull/42

Install

npm install -g prest-code

Prerequisites

1. Ollama (local LLM — free, no API key needed)

# macOS
brew install ollama
ollama serve

# Pull the default model
ollama pull qwen2.5:7b

2. Playwright Chromium (for XSS/SQLi probing and browser-based test execution)

npx playwright install chromium

3. GitHub Token (only required for generate, analyze, and report with a PR URL)

• Go to github.com/settings/tokens
• Create a token with repo scope
• Export it: export GITHUB_TOKEN=your_token_here

Setup

Create a .env file in your working directory:

# LLM — Ollama (default, free, local)
OLLAMA_BASE_URL=http://localhost:11434
OLLAMA_MODEL=qwen2.5:7b

# GitHub (required for PR commands)
GITHUB_TOKEN=your_github_token

# Optional — credentials for authenticated scans
[email protected]
TEST_PASSWORD=yourpassword

Commands

prest secure <url>

8-phase security scan: input discovery → tech fingerprinting → security headers → XSS → SQLi → exposed secrets → admin route enumeration.

prest secure https://mysite.com
prest secure https://mysite.com --email [email protected] --password secret

Exit codes: 0 = clean · 1 = scan error · 2 = critical/high vulnerabilities found

prest crawl <url> "<goal>"

Goal-driven web crawler — LLM navigates pages until the goal is met or max steps reached.

prest crawl https://mysite.com "find the pricing page"
prest crawl https://mysite.com "locate the contact form"

prest report <site-url>

Run all phases (security + crawl) and generate a consolidated HTML dashboard, auto-opened in your browser.

prest report https://mysite.com
prest report https://mysite.com --goal "explore all navigation links"
prest report https://github.com/owner/repo/pull/42 https://mysite.com

prest analyze <pr-url>

Map GitHub PR file changes to test coverage using TypeScript AST (ts-morph).

prest analyze https://github.com/owner/repo/pull/42

prest generate <pr-url>

Auto-generate a Playwright test for a GitHub PR and open it as a PR in your test repo.

prest generate https://github.com/owner/repo/pull/42
prest generate https://github.com/owner/repo/pull/42 --dry-run

prest rot-check

Scan existing Playwright spec files for broken selectors and auto-heal them via a GitHub PR.

prest rot-check --spec-dir e2e/tests --url https://mysite.com

prest webhook

Start a GitHub webhook server that auto-triggers generate on every PR event.

prest webhook --port 3000

Configuration

Place a .pr-agent.json in your project root:

{
  "baseUrl": "https://mysite.com",
  "outputDirectory": "e2e/tests",
  "targetRepo": {
    "owner": "your-github-username",
    "name": "your-test-repo"
  },
  "authStrategy": "none",
  "ticketPatterns": [
    { "pattern": "([A-Z]+-\\d+)", "type": "jira" }
  ],
  "featureMappings": [
    {
      "id": "auth",
      "name": "Authentication",
      "patterns": ["src/auth/.*", "pages/login.*"],
      "entryUrl": "/login"
    }
  ]
}

Environment Variables

| Variable | Default | Description | |----------|---------|-------------| | OLLAMA_BASE_URL | http://localhost:11434 | Ollama server URL | | OLLAMA_MODEL | qwen2.5:7b | Ollama model to use | | GITHUB_TOKEN | — | GitHub personal access token | | TEST_EMAIL | — | Email for authenticated scans | | TEST_PASSWORD | — | Password for authenticated scans | | TEST_REPO_OWNER | — | Override targetRepo.owner | | TEST_REPO_NAME | — | Override targetRepo.name | | MCP_BROWSER_HEADLESS | true | Set false to watch the browser | | MCP_VERBOSE | false | Set true for MCP connection logs |

License

MIT — Thiru S