Security posture
Paranoid by default.
Test platforms hold credentials, sessions, and API keys. Vera treats all of them as radioactive.
Secrets sealed at restLogin credentials, captured sessions, and AI keys are encrypted before they touch the database.
Write-only keysCI tokens are shown once and stored hashed; AI keys and webhooks can be set but never read back.
SSRF guardedEvery server-side fetch — AI crawler, recorder, test steps, webhooks — is validated. Cloud metadata is always blocked.
No shell, everSetup commands run allow-listed, tokenized, and shell-free — no chaining, no injection surface.
Rate-limited sharingPublic report links are tokenized, read-only, IP rate-limited, and revocable at any time.
Append-only auditEvery mutating action in an org lands in an audit ledger that can’t be edited after the fact.
Ship with it
Wire it into the pipeline you already have.
Vera meets your stack where it is — GitHub, Slack, your CI, even your AI assistant.
- GitHub Action — run a project, suite, or single test against a preview deploy. Vercel and Netlify preview URLs are auto-detected.
- Honest gating — the PR fails only on real failures. Quarantined tests, passes-on-retry and passes-on-heal surface as warnings, so nobody learns to ignore red.
- Green is not one thing — a run that only went green because self-heal rewrote a selector is reported as
healed, not folded into the pass. Gate on it withfail-on-healedwhen you want a human to confirm the step still drives the control it was written for. - GitHub App — import a repo as a project, let the AI discover config from source, and review autosync proposals when the app changes.
- REST API + tokens — scoped bearer tokens (shown once, stored hashed) to trigger and await runs from any CI system.
- MCP server — ask Claude to run a test or suite, inspect a failure, apply a repair, author a new test, or file an issue — straight from your editor.
- Import from anywhere — Cypress, Playwright, WebdriverIO, Selenium (Java/Python via AI review), TestCafe, Postman, a browser HAR, or an OpenAPI spec — all become editable no-code steps.
- Export without lock-in — any test as runnable Playwright, WebdriverIO, Selenium (pytest), or TestCafe code; any run as JUnit XML.
- CI runner agent — the
vera-agent-ciaction drains queued runs on your own GitHub runners — including iOS simulators onmacos-*.
# Gate every PR on your real user flows - name: Run Vera E2E suite uses: vera/vera-run@v1 with: api-url: https://vera-agent.com api-token: ${{ secrets.VERA_TOKEN }} project: proj_checkout environment: preview preview-url: ${{ steps.deploy.outputs.url }} # opt in to a stricter gate: # fail-on-flaky: 'true' # fail-on-healed: 'true' # quarantined, passed-on-retry and healed => warnings, # the check only fails on real failures
Get started
Describe what to test — and let Vera build it, run it, and keep it green.
Point Vera at your app, write one sentence, and watch real tests generate and pass in seconds. Free plan, your own AI key, no credit card.