StellCode

AI-powered security scanner, web crawler, Playwright test generator, and API tester for GitHub PRs.

stell secure https://mysite.com
stell crawl https://mysite.com "find the pricing page"
stell report https://mysite.com
stell generate https://github.com/owner/repo/pull/42
stell api https://api.mysite.com/openapi.json

Install

npm install -g stell-code

Prerequisites

1. Playwright Chromium (for XSS/SQLi probing and browser-based test execution)

npx playwright install chromium

2. GitHub Token (only required for generate, analyze, and report with a PR URL)

• Go to github.com/settings/tokens
• Create a token with repo scope
• Export it: export GITHUB_TOKEN=your_token_here

3. StellCode Token (required for all commands)

• Get your token at https://stellcode.dev/dashboard
• Export it: export STELLCODE_TOKEN=your_token_here

Setup

Create a .env file in your working directory:

# Required
STELLCODE_TOKEN=your_stellcode_token
GITHUB_TOKEN=your_github_token

# Optional — credentials for authenticated scans
[email protected]
TEST_PASSWORD=yourpassword

# Optional — Anthropic API key for enhanced test generation
ANTHROPIC_API_KEY=sk-ant-...

Commands

stell secure <url>

9-phase security scan: input discovery → tech fingerprinting → security headers → XSS → SQLi → exposed secrets → admin route enumeration → rate limit checks → verbose error exposure.

stell secure https://mysite.com
stell secure https://mysite.com --email [email protected] --password secret

Exit codes: 0 = clean · 1 = scan error · 2 = critical/high vulnerabilities found

stell api <spec-url|base-url>

Scan and generate tests for a REST API from an OpenAPI/Swagger spec, or auto-discover endpoints.

stell api https://api.mysite.com/openapi.json
stell api https://api.mysite.com --discover --security
stell api https://api.mysite.com/openapi.json --output api-tests --token Bearer_xyz

Flags:

• --discover — auto-discover OpenAPI spec from common paths
• --security — run security scan on discovered endpoints
• --output <dir> — output directory for generated tests (default: api-tests)
• --token <auth> — auth token to include in scan requests

stell generate <pr-url>

Auto-generate a Playwright test for a GitHub PR and open it as a PR in your test repo.

stell generate https://github.com/owner/repo/pull/42
stell generate https://github.com/owner/repo/pull/42 --dry-run

stell analyze <pr-url>

Map GitHub PR file changes to test coverage using TypeScript AST.

stell analyze https://github.com/owner/repo/pull/42

stell rot-check

Scan existing Playwright spec files for broken selectors and auto-heal them via a GitHub PR.

stell rot-check --spec-dir e2e/tests --url https://mysite.com

stell crawl <url> "<goal>"

Goal-driven web crawler — navigates pages until the goal is met or max steps reached.

stell crawl https://mysite.com "find the pricing page"
stell crawl https://mysite.com "locate the contact form"

stell report <site-url>

Run all phases (security + crawl + analyze) and generate a consolidated HTML dashboard.

stell report https://mysite.com
stell report https://mysite.com --goal "explore all navigation links"
stell report https://github.com/owner/repo/pull/42 https://mysite.com

stell webhook

Start a GitHub webhook server that auto-triggers generate on every PR event.

stell webhook --port 3000

Configuration

Place a .pr-agent.json in your project root:

{
  "baseUrl": "https://mysite.com",
  "outputDirectory": "e2e/tests",
  "targetRepo": {
    "owner": "your-github-username",
    "name": "your-test-repo"
  },
  "authStrategy": "none",
  "integrations": {
    "slack": {
      "webhook": "https://hooks.slack.com/services/..."
    }
  }
}

Environment Variables

| Variable | Description | |----------|-------------| | STELLCODE_TOKEN | Your StellCode API token (from dashboard) | | GITHUB_TOKEN | GitHub personal access token | | ANTHROPIC_API_KEY | Anthropic API key for enhanced test generation | | TEST_EMAIL | Email for authenticated scans | | TEST_PASSWORD | Password for authenticated scans | | MCP_BROWSER_HEADLESS | Set false to watch the browser (default: true) | | STELL_DOC_PATH | Explicit path to context document | | STELL_DOC_TYPE | Document type: prd, tech-spec, api-spec, arch-doc, raw |

License

MIT — Thiru S