CodexQA

AI writes it.CodexQA proves it.

Code graphIntelligent testingCode coverageAI test generationAI defect detectionE2E automation

Every step comes with evidence an agent can fix from, so every merge has grounds.

Use codexqa-defect-analyzer to review this branch. Requirement: a refund must not exceed the remaining refundable balance.

Blind-test replay7 defects found, 0 false positivesDo not mergeSee report
Try the skills freeBook an evaluation
  • 11 open-source skills
  • Public blind test: 7/7 recall, 0 false positives
  • Runs locally, no account
  • Private deployment
  • Your choice of model

01Why verify

AI proves it finished writing. CodexQA proves the code is right.

The faster AI writes, the further verification falls behind.

02The method

Independent verification, six steps to merge

Graph the blast radius, check defects two ways, keep browser proof. 11 open-source skills.

See all 11 skills

  1. Build an architecture knowledge graph locally: how modules layer, where the real dependencies and hubs are. Requirement gaps and testability are logged first too.

    • code-wiki
    • requirement-analyzer
code-wiki.html
Sample report
Code knowledge graph · Sample report

Plus rootcause-analyzer for exception root causes and skill-router to pick the right skill from your words. Everything runs locally, with no account and no extra model key.

03Public evidence

Trust from evidence, not self-grading

Recall 7/7, 0 false positives; cases 7/7, rules 9/14, code 93.2%, APIs 33/39, chains 2/2. Every number reruns, gaps listed.

  1. 01

    Independent, checked against a public key

    ground-truth.json

    The verifier is not the agent that wrote the code, and every result is checked against the answer key: all 7 defects found, none of the 4 decoys flagged.

  2. 02

    Evidence on every conclusion

    JSON

    Location, expected, actual and trigger come out as JSON the agent reads and fixes from; anything not reported carries a reason.

  3. 03

    What was checked, and what was not

    Test cases, requirements, code, interfaces and call chains each get a number, gaps listed.

    • 7/7Test cases
    • 9/14Requirements
    • 93.2%Code
    • 33/39Interfaces
    • 2/2Call chains
Book an evaluation
Answer keyExample repoReport page sample
defect-report.htmlcodexqa-defect-analyzer
inventory-service/feature/reservation-v2→main
Do not merge
Changed functions
12
Defects found
7
Suspicious code checked
4correct, not reported
Against answer key
7/7
IDIssue
D3Refund is not capped at the remaining balanceThis requirementrefund.js:18 · §11
D5Gateway refund fails, ledger still records successrefund.js:56 · §12
D2Two concurrent holds can both succeed and oversellinventory.js:49 · §4
D4Exactly 10 or 50 units miss the volume discountpricing.js:32 · §8
D6A throw inside the lock never releases itdb.js:186 · §14
D7Commit leaves status HELD, expiry releases stock twicereservation.js:93 · §5
D1Expired holds leave the availability cache stalereservation.js:162 · §6
Found byRule scan0/7AI semantic review7/7None has a syntactic signature; 102 Semgrep seed rules hit none
Check it yourself$ node examples/inventory-service/verify.mjsPASS: 7 seeded defects reproduce, 4 decoys behave correctly.
Matches the answer keyLocation, expected and actual handed back to the agentReplay · public blind test

One recorded run (Composer, 2026-09-08): one model, one run, not a multi-model benchmark.

Not a report for people, feedback an agent can fix from

Every finding carries location, expected, actual and trigger. The agent fixes it, CodexQA verifies again, until it passes.

Coding agentThe agent, reading only code

“Refunds are done and all tests pass.”

All tests pass

Paths its tests walked

  • Gateway succeeds → ledger updated, success returnedTested
  • Gateway fails → ledger untouched, failure returnedUntested

Its tests never exercised a failing payment gateway.

feedback.jsonCodexQA returns

{

// Where

"location": "src/refund.js:56–91 · refundOrder",

// Expected

"expected": "On gateway failure, leave the ledger untouched and return a failure (rule 12)",

// Actual

"actual": "Fakes a local receipt, updates the ledger and returns ok: true",

// Trigger

"trigger": "gateway.failNextRefunds(1), then refundOrder"

}

  1. Back to the agent
  2. Fix to expected
  3. Verify again
  4. Pass

Taken from the answer key of the public inventory-service example (defect D5).

04Delivery

Agentic SDLC: keep your process, make AI delivery real

Keep your repos, CI and release process; hand each step to an agent. Two quality gates hold the line, and failures return to coding with root cause and evidence.

Timo · Internal · opens 2026 Q4

  1. 1Requirements specRequirements analysisThe request is written up as a spec with features and acceptance criteria.Requirements analyst
  2. 2Technical design specDesign agentReads the existing code and produces the technical design spec.Architecture analyst
  3. 3ImplementationCoding agentImplements the change against both specs, writes unit tests, and runs the build and static scan before handing off.Software engineer
  4. 4Component testing and quality gateComponent test agentRuns unit tests with coverage, API tests and code review. If the gate fails, the defect analyst runs root cause analysis and it goes back to coding.Test engineerCode reviewerDefect analyst
  5. 5Test preparation (shift-left)ParallelTest design agent, test data agentTest cases and test data are prepared from the requirements and design.Test engineer
  6. 6Integration testing and quality gateIntegration test agent: API integration, end-to-endRuns integration tests with the prepared test cases and test data. If the gate fails, it goes back to coding with test evidence.Test engineerDefect analyst
  7. 7ReleaseRelease processOnce both quality gates pass, ships through the release process.

  • 01Spec-driven development

    Requirements and technical design are written as specs first; code and tests are baselined against them and stay traceable.

  • 02Two quality gates

    Component testing and integration testing each have a quality gate, and both must pass before release.

  • 03Closed-loop defects

    Defects that fail a gate return to the coding agent with root cause analysis and test evidence, and are regression-tested after the fix.

  • 04Shift-left testing

    Test design and test data preparation run from the specs while the code is written, off the critical path.

Illustrative flow. Timo is in internal use.

About Timo Module status on the roadmap

05Enterprise services

More than a tool: AI engineering, put to work

Start with one pilot: AI in requirements, code, testing and release, all on-premises.

Book an evaluation

06Security and private deployment

Your code and data stay inside your boundary

Worried about code leaving the building or failing a security review? Deploy to your own requirements, from one skill on a developer laptop to the desktop app, models and solutions fully on-premises.

Private deploymentSecurity and governance

  • Runs locally

    CodexQA Skills run inside your agent, write reports to the local disk and need no account. How source context is handled depends on the agent and model you use.

  • Private models

    Connect models deployed inside your company. With private deployment and internal models, code and data can stay entirely on your network.

  • The whole solution on-premises

    Timo supports intranet and private deployment, and models and solutions such as quality assurance can be deployed alongside it. Private deployment of the CodexQA platform can be evaluated.

  • Open to inspection

    The skills are open source under Apache-2.0 / MIT, so every instruction and script can be reviewed; the local analysis engine some skills use is distributed separately and closed source.

07Get started

Three ways in, from one skill to the platform

Start free with skills in your agent; add the platform or a private deployment when needed.

One command, inside your agent

No account, no gateway. Pick Cursor, Claude Code, Codex or OpenClaw when prompted.

View on GitHubOpen a sample report

CodexQA Skills are open source (openqa-cn/codexqa), under Apache-2.0 (the test case generator is MIT). Its instructions and scripts can be read line by line.

npx skills add openqa-cn/codexqa --skill codexqa-skill-router

Start with one pilot project

Verify one real project inside your network or on anonymized code. A 30-minute call, then an assessment and a roll-out plan.

Book an evaluationTry the skills free