FAQ

Does frontend-qa use an LLM to find issues?

No. The core scan pipeline is entirely deterministic — collectors observe the browser and produce structured Issues with no model in the loop. The MCP server lets an external AI assistant consume that report; it doesn’t add AI to how the report is produced. See Non-negotiable principles.

Does anything leave my machine?

No. The tool makes no outbound network calls other than to the URL you point it at — no telemetry, no update check, no crash reporter. Reports, screenshots, and HAR files are written under .local/frontend-qa/ inside the project you scanned.

Are secrets safe in the report?

Authorization, Cookie, Set-Cookie, X-API-Key, X-Auth-Token, and Proxy-Authorization headers are redacted (case-insensitive) at the point of capture, before anything is written to memory shared with the report writer — never as a filtering pass after the fact. Response bodies are not persisted in V1. See docs/SECURITY.md in the repository for the full threat model.

Which frameworks are supported?

Project auto-detection currently recognizes Vite and Next.js React projects. You can still scan any URL directly with --url, regardless of framework — auto-detection only affects the “no --url given” dev-server convenience path.

Does it replace my E2E test suite?

No. frontend-qa observes what happens on the routes you give it; it doesn’t let you author assertions about application behavior the way Playwright/Cypress tests do. It’s closer to “what would a careful developer notice by opening dev tools,” run automatically.

Can I run it against a deployed (non-local) URL?

Yes — --url accepts any reachable URL, not just localhost. The dev-server auto-detect/launch behavior only kicks in when --url is omitted.

Why does scan sometimes launch its own dev server?

If you don’t pass --url, frontend-qa first checks common ports for an already-running server; if none answers, it detects your package manager from the lockfile and runs your project’s dev script itself, then stops it when the scan finishes. This is meant to make npx frontend-qa work with zero configuration in a typical Vite/Next project.

Is there a config file?

Not yet — CLI flags (and MCP tool arguments) are the only configuration surface today. See Roadmap.

Why isn’t the MCP server published to npm on its own?

That’s not decided yet — see Design Decisions and Roadmap. Today it’s run from a built checkout inside this monorepo.

More questions?

See Troubleshooting for failure modes, or Contributing to open a discussion.