Qodex

Qodex is a swarm of AI agents that attacks and tests your app 24/7, so your team ships AI-written code without a security or QA team.

Yes. The Individual plan is free with no card: one repository, up to 25 scenarios and 100 runs a month. Paid plans start at $1,299 per project per month.

Qodex attacks your app after every change with the OWASP Top 10 and the API Top 10 and reproduces the exploit as evidence. A yearly pentest checks one day; Qodex checks every deploy.

They check the change they just wrote, by reading it. Qodex attacks and tests the whole running app, every night and on every deploy, and Claude Code and Cursor can call Qodex and run its tests.

Your team writes and repairs those tests. Qodex writes them, keeps them, re-finds a step when the screen changes, and tells you which failures are real. The tests it writes are Playwright; you keep them if you leave.

No. Saved tests re-run with no AI calls, every night, from CI, or from a coding agent.

Every failure is labelled real bug, stale test or environment problem before anyone looks, with severity, reproduction steps and evidence.

Yes, by Docker or Terraform. Managed cloud and AWS Marketplace are the other two routes.

Nightly, on every deploy through CI or a webhook, and from Claude Code and Cursor today. A run on every merged pull request posted back on the PR is coming.

Scale plans include SSO and SAML, role-based access, audit logs, data redaction, mTLS and custom retention. See https://qodex.ai/docs/security-and-data-handling for the rest.