rootxqa

AI-powered QA intelligence that runs silently in the background of your existing test suite — no wrapper commands, no code changes. Every test run automatically captures performance, network, security, and pen testing signals and opens a local dashboard when done.

excuea.com

How it works

npx playwright test          ← your normal command, unchanged
         │
         ▼
  rootxqa reporter           ← injected once by `npx rootxqa init`
         │
         ├── Performance     LCP · FCP · CLS · INP · TTFB · long tasks · memory
         ├── Network         failed requests · slow APIs · large payloads
         ├── Security        CSP · headers · cookies · SRI · mixed content
         ├── Pen Testing     XSS sinks · SQL errors · CORS · JWT exposure · IDOR
         └── Console / CPU   errors · warnings · CPU spikes
         │
         ▼
  dashboard opens automatically  →  http://localhost:4321

Install

npm i rootxqa

Setup (once per project)

npx rootxqa init

This will:

1. Ask for your API token — generate one at excuea.com
2. Auto-detect your test framework (Playwright / Cypress / Jest / Vitest / WebdriverIO)
3. Inject the rootxqa reporter into your framework config
4. Add rootxqa.config.json and rootxqa/ to .gitignore

Run your tests as normal

After init there is nothing else to do. Just run your tests the way you always have:

npx playwright test
npx cypress run
npx jest
npx vitest run
npx wdio run wdio.conf.js

rootxqa collects signals in the background and opens the dashboard automatically when the run finishes.

Supported frameworks

| Framework | Trigger command | Signals collected | |---|---|---| | Playwright | npx playwright test | Perf · Network · Security · Pen test · Console · CPU · Screenshots | | Cypress | npx cypress run | Pass/fail · Duration · Slow tests · Errors | | Jest | npx jest | Pass/fail · Duration · Slow tests · Console · Coverage gaps | | Vitest | npx vitest run | Pass/fail · Duration · Slow/flaky tests · Coverage gaps | | WebdriverIO | npx wdio run wdio.conf.js | Pass/fail · Duration · Slow tests · Flaky (retry) detection |

Framework config (auto-injected by npx rootxqa init)

Playwright — playwright.config.js

reporter: [
  ['list'],
  ['rootxqa/reporters/playwright'],
],

Cypress — cypress.config.js

const rootxqa = require('rootxqa/reporters/cypress');

module.exports = defineConfig({
  e2e: {
    setupNodeEvents(on, config) {
      rootxqa(on, config);
    },
  },
});

Jest — jest.config.js

reporters: [
  'default',
  'rootxqa/reporters/jest',
],

Vitest — vitest.config.js

import { defineConfig } from 'vitest/config';
import RootXQAReporter from 'rootxqa/reporters/vitest';

export default defineConfig({
  test: {
    reporters: ['verbose', new RootXQAReporter()],
  },
});

WebdriverIO — wdio.conf.js

reporters: [
  ['rootxqa/reporters/wdio', {}],
],

What gets detected

Performance

| Signal | Threshold | |---|---| | Largest Contentful Paint (LCP) | > 2500 ms | | First Contentful Paint (FCP) | > 1800 ms | | Interaction to Next Paint (INP) | > 200 ms | | Cumulative Layout Shift (CLS) | > 0.1 | | Time to First Byte (TTFB) | > 800 ms | | Long tasks (UI jank) | > 100 ms | | DOM node count | > 1500 nodes | | Total page weight | > 5 MB | | Individual resource size | > 2 MB | | JS bundle size | > 1.5 MB | | Full page load | > 8 s | | Slow test | > 10 s | | Flaky test | passed after retry |

Security (always on)

| Check | What it catches | |---|---| | Missing HSTS | No Strict-Transport-Security header | | Missing / weak CSP | No policy, or unsafe-inline / unsafe-eval / wildcard | | Missing X-Frame-Options | Clickjacking risk | | Missing X-Content-Type-Options | MIME sniffing risk | | Missing Permissions-Policy | Camera / mic / geolocation exposure | | Missing Referrer-Policy | Referrer leakage | | Cookie flags | Missing HttpOnly / Secure / SameSite | | Mixed content | HTTP resources loaded on HTTPS pages | | SRI missing | External scripts/styles without integrity attribute | | CSP violations | Browser-reported policy violations | | Server version leakage | Server: or X-Powered-By: header with version number | | Unsafe external links | target=_blank without rel=noopener | | Certificate errors | TLS/SSL issues reported by the browser |

Pen Testing — passive (always on)

| Signal | OWASP | Severity | |---|---|---| | Sensitive data in URL params (token, password, secret …) | A02 | HIGH | | Sensitive data in URL hash fragment | A02 | MEDIUM | | Open redirect via query param | A01 | HIGH | | DOM XSS sink — eval() called | A03 | HIGH | | DOM XSS sink — innerHTML set with script/event | A03 | HIGH | | DOM XSS sink — document.write with script | A03 | HIGH | | SQL / DB error string in API response body | A03 | HIGH | | Stack trace exposed in JSON API response | A09 | MEDIUM | | CORS wildcard * + Allow-Credentials: true | A05 | HIGH | | Object.prototype pollution detected | A05 | HIGH | | JWT token in localStorage / sessionStorage | A07 | MEDIUM | | Sensitive key name found in storage | A07 | MEDIUM | | IDOR candidate — numeric IDs with unauthenticated calls | A01 | MEDIUM |

Pen Testing — active (opt-in only)

Active probes send real attack payloads. Only use on apps you own and have explicit permission to test.

Enable in rootxqa.config.json:

{
  "pentest": { "active": true }
}

Or via environment variable:

ROOTXQA_PENTEST=active npx playwright test

| Probe | What it tests | |---|---| | XSS reflection | Fills form inputs with <img onerror> canary — checks if it executes in DOM | | SQLi error | Sends ' to search fields — checks if a DB error string appears in DOM | | CSRF token absence | POSTs to form action without CSRF token — checks if server returns 200 |

CLI commands

| Command | Description | |---|---| | npx rootxqa init | One-time setup — saves token, injects reporter into framework config | | npx rootxqa dashboard | Open the local dashboard for the latest run | | npx rootxqa upload | Upload results to the excuea.com cloud dashboard |

Dashboard

The dashboard opens automatically at http://localhost:4321 after every test run. It shows:

• Pass/fail summary with per-test drill-down
• Performance timeline with threshold violations highlighted
• Network waterfall — failed and slow requests
• Security and pen test findings grouped by severity
• Console errors and CPU spikes per test
• Screenshot on failure (Playwright only)

To reopen the dashboard for a previous run:

npx rootxqa dashboard

Local run storage

Results are saved to a rootxqa/ folder in your project root (auto-added to .gitignore):

rootxqa/
  run_1718000000000/
    summary.json
    devtooltrace.json
    perf-attachments/

Upload to cloud

npx rootxqa upload

Sends results to your excuea.com project dashboard for team visibility, trend analysis, and AI-powered root cause analysis.

Configuration reference

rootxqa.config.json is created by npx rootxqa init and is git-ignored automatically:

{
  "apiToken": "rxqa_...",
  "apiUrl": "https://api.excuea.com",
  "pentest": {
    "active": false
  }
}

License

ISC — © Excuea. Commercial use requires a valid API token from excuea.com.