fagun 0.2.0__tar.gz

fagun-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.10", "3.12"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+      - name: Import + tool registration smoke test
+        run: |
+          python -c "
+          import asyncio
+          from fagun.server import mcp
+          async def main():
+              tools = await mcp.list_tools()
+              names = {t.name for t in tools}
+              assert 'deep_test' in names and 'test_forms' in names, names
+              assert len(tools) >= 19, len(tools)
+              prompts = await mcp.list_prompts()
+              assert any(p.name == 'fagun' for p in prompts)
+              print(f'OK: {len(tools)} tools, {len(prompts)} prompts')
+          asyncio.run(main())
+          "

fagun-0.2.0/.github/workflows/publish.yml

@@ -0,0 +1,40 @@
+name: Publish to PyPI
+
+# Ships to PyPI whenever you push a version tag, e.g.:
+#   git tag v0.2.0 && git push origin v0.2.0
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch: {}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build sdist + wheel
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC — no API token stored in the repo
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

fagun-0.2.0/.gitignore

@@ -0,0 +1,7 @@
+.venv/
+__pycache__/
+*.pyc
+*.egg-info/
+build/
+dist/
+.DS_Store

fagun-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Mejbaur Bahar Fagun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

fagun-0.2.0/PKG-INFO

@@ -0,0 +1,162 @@
+Metadata-Version: 2.4
+Name: fagun
+Version: 0.2.0
+Summary: Fagun — one MCP server that lets any AI tool (Claude, Cursor, Codex, Antigravity, Windsurf) drive a browser, hunt bugs, and run a full QA sweep.
+Project-URL: Homepage, https://github.com/fagun-dev/fagun
+Author-email: Mejbaur Bahar Fagun <mejbaur@markopolo.ai>
+License: MIT
+License-File: LICENSE
+Keywords: ai,browser,claude,codex,cursor,mcp,playwright,qa,testing
+Requires-Python: >=3.10
+Requires-Dist: mcp>=1.2.0
+Requires-Dist: playwright>=1.44.0
+Description-Content-Type: text/markdown
+
+# 🦊 Fagun
+
+**One MCP server. Every AI tool. Type `fagun` and it drives a browser + runs full QA.**
+
+Fagun is an [MCP](https://modelcontextprotocol.io) server that lets any AI coding
+tool — **Claude Code / Desktop, Cursor, Codex, Antigravity, Windsurf, Cline, VS Code** —
+control a real browser, debug it (console, network, DOM, screenshots, JS eval), and
+run an automated quality sweep (broken requests, console errors, accessibility,
+performance, SEO) with a Markdown report.
+
+You set it up once. Then inside any of those tools you just say **`fagun`** (or `/fagun`) and it starts.
+
+---
+
+## One-line setup (paste into your AI tool)
+
+Tell your AI agent (Claude, Cursor, Codex, Antigravity, …) exactly this:
+
+> Install or upgrade **fagun** to the latest stable version with `uv` using Python
+> 3.12, register the skill from `fagun skill`, and connect it to my browser. Follow
+> https://github.com/mejbaurbahar/fagun/blob/main/install.md if setup or connection fails.
+
+The agent follows [`install.md`](install.md) and wires everything up. Then just type
+**`/fagun`** and describe what to test.
+
+---
+
+## Setup (once, ~2 min)
+
+**1. Install the runner + browser engine**
+
+```bash
+pip install uv
+uvx --from fagun python -m playwright install chromium
+```
+
+`uvx` runs Fagun without a permanent install and always uses the latest version.
+
+**2. Add Fagun to your AI tool**
+
+Print ready-to-paste config for every tool:
+
+```bash
+uvx fagun install
+```
+
+Or let Fagun write the file for you:
+
+```bash
+uvx fagun install cursor     # writes ~/.cursor/mcp.json
+uvx fagun install claude     # writes Claude Desktop config
+uvx fagun install vscode     # writes .vscode/mcp.json
+```
+
+Manual config is identical everywhere — command `uvx`, args `["fagun"]`:
+
+| Tool | Where |
+|------|-------|
+| **Claude Code** | `claude mcp add fagun -- uvx fagun` |
+| **Claude Desktop** | `~/Library/Application Support/Claude/claude_desktop_config.json` |
+| **Cursor** | `~/.cursor/mcp.json` |
+| **Windsurf / Cline / Antigravity** | their MCP settings (same JSON as Cursor) |
+| **VS Code (Copilot)** | `.vscode/mcp.json` |
+| **Codex CLI** | `~/.codex/config.toml` |
+
+```jsonc
+// Claude Desktop / Cursor / Windsurf / Cline / Antigravity
+{ "mcpServers": { "fagun": { "command": "uvx", "args": ["fagun"] } } }
+```
+
+```toml
+# Codex ~/.codex/config.toml
+[mcp_servers.fagun]
+command = "uvx"
+args = ["fagun"]
+```
+
+**3. Restart the tool. Say `fagun`.**
+
+---
+
+## Use it
+
+Inside any tool, just talk:
+
+- *"fagun"* → shows the menu and starts up
+- *"go to example.com and screenshot it"*
+- *"run QA on https://example.com"*
+- *"full QA sweep of https://example.com, write the report to ./qa.md"*
+- *"show me the console errors"* · *"any failed network requests?"*
+- *"click Sign in, type me@x.com into email, press Enter"*
+
+- *"deep test https://example.com and write the report to ./report.md"* — the full sweep
+
+## The `/fagun` skill — autonomous bug hunter
+
+`skills/fagun/SKILL.md` is a full QA methodology the AI follows: it hunts **real,
+reproducible** bugs across 10 scenario classes — functional, JS/runtime errors,
+network/API, form validation, auth/session/authorization, accessibility,
+performance, visual/responsive, security posture, and edge cases — with an
+evidence-or-it-didn't-happen rule and impact-based severity. Register it (see
+`install.md` Step 5) to get the `/fagun` slash command.
+
+## What it exposes (MCP tools)
+
+`fagun_start` · `open_browser` · `navigate` · `click` · `fill` · `press_key` ·
+`screenshot` · `evaluate_js` · `get_console` · `get_network` · `crawl` · `run_qa` ·
+`check_links` · `test_forms` · `security_headers` · `deep_test` · `full_qa_sweep` ·
+`write_report` · `close_browser`
+
+Plus a **`fagun` prompt** — appears as a slash command in tools that surface MCP prompts.
+
+## Options (env vars)
+
+| Var | Default | Meaning |
+|-----|---------|---------|
+| `FAGUN_HEADLESS` | `1` | `0` shows the browser window |
+| `FAGUN_BROWSER` | `chromium` | `chromium` \| `firefox` \| `webkit` |
+| `FAGUN_CDP_URL` | — | Attach to a running Chrome, e.g. `http://127.0.0.1:9222` |
+
+## Local dev
+
+```bash
+git clone <repo> && cd fagun
+pip install -e .
+python -m playwright install chromium
+python -m fagun        # starts the MCP server on stdio
+```
+
+## Releasing to PyPI (maintainer)
+
+Auto-publish is wired via GitHub Actions using **PyPI Trusted Publishing** (OIDC —
+no API token stored). One-time setup on [pypi.org](https://pypi.org/manage/account/publishing/):
+
+- Project: `fagun` · Owner: `mejbaurbahar` · Repo: `fagun`
+- Workflow: `publish.yml` · Environment: `pypi`
+
+Then every release is just a tag:
+
+```bash
+# bump version in pyproject.toml + src/fagun/__init__.py first
+git tag v0.2.0 && git push origin v0.2.0
+```
+
+The `Publish to PyPI` workflow builds, checks, and uploads automatically. Build
+locally to verify anytime: `python -m build && twine check dist/*`.
+
+MIT © Mejbaur Bahar Fagun

fagun-0.2.0/README.md

@@ -0,0 +1,148 @@
+# 🦊 Fagun
+
+**One MCP server. Every AI tool. Type `fagun` and it drives a browser + runs full QA.**
+
+Fagun is an [MCP](https://modelcontextprotocol.io) server that lets any AI coding
+tool — **Claude Code / Desktop, Cursor, Codex, Antigravity, Windsurf, Cline, VS Code** —
+control a real browser, debug it (console, network, DOM, screenshots, JS eval), and
+run an automated quality sweep (broken requests, console errors, accessibility,
+performance, SEO) with a Markdown report.
+
+You set it up once. Then inside any of those tools you just say **`fagun`** (or `/fagun`) and it starts.
+
+---
+
+## One-line setup (paste into your AI tool)
+
+Tell your AI agent (Claude, Cursor, Codex, Antigravity, …) exactly this:
+
+> Install or upgrade **fagun** to the latest stable version with `uv` using Python
+> 3.12, register the skill from `fagun skill`, and connect it to my browser. Follow
+> https://github.com/mejbaurbahar/fagun/blob/main/install.md if setup or connection fails.
+
+The agent follows [`install.md`](install.md) and wires everything up. Then just type
+**`/fagun`** and describe what to test.
+
+---
+
+## Setup (once, ~2 min)
+
+**1. Install the runner + browser engine**
+
+```bash
+pip install uv
+uvx --from fagun python -m playwright install chromium
+```
+
+`uvx` runs Fagun without a permanent install and always uses the latest version.
+
+**2. Add Fagun to your AI tool**
+
+Print ready-to-paste config for every tool:
+
+```bash
+uvx fagun install
+```
+
+Or let Fagun write the file for you:
+
+```bash
+uvx fagun install cursor     # writes ~/.cursor/mcp.json
+uvx fagun install claude     # writes Claude Desktop config
+uvx fagun install vscode     # writes .vscode/mcp.json
+```
+
+Manual config is identical everywhere — command `uvx`, args `["fagun"]`:
+
+| Tool | Where |
+|------|-------|
+| **Claude Code** | `claude mcp add fagun -- uvx fagun` |
+| **Claude Desktop** | `~/Library/Application Support/Claude/claude_desktop_config.json` |
+| **Cursor** | `~/.cursor/mcp.json` |
+| **Windsurf / Cline / Antigravity** | their MCP settings (same JSON as Cursor) |
+| **VS Code (Copilot)** | `.vscode/mcp.json` |
+| **Codex CLI** | `~/.codex/config.toml` |
+
+```jsonc
+// Claude Desktop / Cursor / Windsurf / Cline / Antigravity
+{ "mcpServers": { "fagun": { "command": "uvx", "args": ["fagun"] } } }
+```
+
+```toml
+# Codex ~/.codex/config.toml
+[mcp_servers.fagun]
+command = "uvx"
+args = ["fagun"]
+```
+
+**3. Restart the tool. Say `fagun`.**
+
+---
+
+## Use it
+
+Inside any tool, just talk:
+
+- *"fagun"* → shows the menu and starts up
+- *"go to example.com and screenshot it"*
+- *"run QA on https://example.com"*
+- *"full QA sweep of https://example.com, write the report to ./qa.md"*
+- *"show me the console errors"* · *"any failed network requests?"*
+- *"click Sign in, type me@x.com into email, press Enter"*
+
+- *"deep test https://example.com and write the report to ./report.md"* — the full sweep
+
+## The `/fagun` skill — autonomous bug hunter
+
+`skills/fagun/SKILL.md` is a full QA methodology the AI follows: it hunts **real,
+reproducible** bugs across 10 scenario classes — functional, JS/runtime errors,
+network/API, form validation, auth/session/authorization, accessibility,
+performance, visual/responsive, security posture, and edge cases — with an
+evidence-or-it-didn't-happen rule and impact-based severity. Register it (see
+`install.md` Step 5) to get the `/fagun` slash command.
+
+## What it exposes (MCP tools)
+
+`fagun_start` · `open_browser` · `navigate` · `click` · `fill` · `press_key` ·
+`screenshot` · `evaluate_js` · `get_console` · `get_network` · `crawl` · `run_qa` ·
+`check_links` · `test_forms` · `security_headers` · `deep_test` · `full_qa_sweep` ·
+`write_report` · `close_browser`
+
+Plus a **`fagun` prompt** — appears as a slash command in tools that surface MCP prompts.
+
+## Options (env vars)
+
+| Var | Default | Meaning |
+|-----|---------|---------|
+| `FAGUN_HEADLESS` | `1` | `0` shows the browser window |
+| `FAGUN_BROWSER` | `chromium` | `chromium` \| `firefox` \| `webkit` |
+| `FAGUN_CDP_URL` | — | Attach to a running Chrome, e.g. `http://127.0.0.1:9222` |
+
+## Local dev
+
+```bash
+git clone <repo> && cd fagun
+pip install -e .
+python -m playwright install chromium
+python -m fagun        # starts the MCP server on stdio
+```
+
+## Releasing to PyPI (maintainer)
+
+Auto-publish is wired via GitHub Actions using **PyPI Trusted Publishing** (OIDC —
+no API token stored). One-time setup on [pypi.org](https://pypi.org/manage/account/publishing/):
+
+- Project: `fagun` · Owner: `mejbaurbahar` · Repo: `fagun`
+- Workflow: `publish.yml` · Environment: `pypi`
+
+Then every release is just a tag:
+
+```bash
+# bump version in pyproject.toml + src/fagun/__init__.py first
+git tag v0.2.0 && git push origin v0.2.0
+```
+
+The `Publish to PyPI` workflow builds, checks, and uploads automatically. Build
+locally to verify anytime: `python -m build && twine check dist/*`.
+
+MIT © Mejbaur Bahar Fagun

fagun-0.2.0/install.md

@@ -0,0 +1,87 @@
+# Fagun — install & connect (for the AI agent to follow)
+
+You are an AI coding tool (Claude, Cursor, Codex, Antigravity, Windsurf, Cline, …).
+The user asked you to install and connect **Fagun**. Do the steps below in order.
+If any step fails, read the "Troubleshooting" section and retry.
+
+## The command users give you
+
+> Install or upgrade **fagun** to the latest stable version with `uv` using Python
+> 3.12, register the skill from `fagun skill`, and connect it to my browser. Follow
+> https://github.com/mejbaurbahar/fagun/blob/main/install.md if setup or connection
+> fails.
+
+## Step 1 — ensure `uv` exists
+
+```bash
+uv --version || curl -LsSf https://astral.sh/uv/install.sh | sh
+```
+
+## Step 2 — install / upgrade Fagun with Python 3.12
+
+```bash
+uv tool install --python 3.12 --upgrade fagun
+```
+
+If `fagun` is not on PyPI yet, install from GitHub:
+
+```bash
+uv tool install --python 3.12 --upgrade "git+https://github.com/mejbaurbahar/fagun"
+```
+
+## Step 3 — install the browser engine (once)
+
+```bash
+uv tool run --from fagun python -m playwright install chromium
+```
+
+## Step 4 — register Fagun as an MCP server (pick the user's tool)
+
+The config is identical everywhere: **command `uvx`, args `["fagun"]`**.
+
+- **Claude Code:** `claude mcp add fagun -- uvx fagun`
+- **Cursor / Windsurf / Cline / Antigravity** — `~/.cursor/mcp.json` (or equivalent):
+  ```json
+  { "mcpServers": { "fagun": { "command": "uvx", "args": ["fagun"] } } }
+  ```
+- **VS Code (Copilot MCP)** — `.vscode/mcp.json`:
+  ```json
+  { "servers": { "fagun": { "type": "stdio", "command": "uvx", "args": ["fagun"] } } }
+  ```
+- **Codex CLI** — `~/.codex/config.toml`:
+  ```toml
+  [mcp_servers.fagun]
+  command = "uvx"
+  args = ["fagun"]
+  ```
+
+Shortcut — let Fagun write the file: `uvx fagun install cursor` (or `claude`, `vscode`).
+
+## Step 5 — register the skill
+
+Copy `skills/fagun/SKILL.md` from this repo into the tool's skills directory
+(e.g. `~/.claude/skills/fagun/SKILL.md`). This makes `/fagun` available as a
+slash command. For tools without skills, the `fagun` MCP prompt is the entry point.
+
+## Step 6 — connect to the browser & verify
+
+Restart the AI tool, then call the `fagun_start` tool (or say `fagun`). Fagun
+launches its own Chromium. To attach to an already-running Chrome instead, set:
+
+```bash
+export FAGUN_CDP_URL=http://127.0.0.1:9222   # Chrome started with --remote-debugging-port=9222
+```
+
+Verify: ask *"go to https://example.com and screenshot it"*.
+
+## Troubleshooting
+
+- **`uv` not found** → re-run Step 1, then `source ~/.bashrc` / open a new shell.
+- **`playwright` browser missing / launch error** → re-run Step 3. On Linux add deps:
+  `uv tool run --from fagun python -m playwright install-deps chromium`.
+- **Tool doesn't see `fagun`** → fully restart the AI tool after editing MCP config;
+  confirm the JSON is valid (no trailing commas).
+- **Want to see the browser** → set `FAGUN_HEADLESS=0`.
+- **Corporate proxy / SSL** → set `HTTPS_PROXY`; for CDP connect use `FAGUN_CDP_URL`.
+- **Firefox/WebKit instead of Chrome** → `FAGUN_BROWSER=firefox` (run the matching
+  `playwright install firefox` first).

fagun-0.2.0/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "fagun"
+version = "0.2.0"
+description = "Fagun — one MCP server that lets any AI tool (Claude, Cursor, Codex, Antigravity, Windsurf) drive a browser, hunt bugs, and run a full QA sweep."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "MIT" }
+authors = [{ name = "Mejbaur Bahar Fagun", email = "mejbaur@markopolo.ai" }]
+keywords = ["mcp", "browser", "qa", "testing", "playwright", "ai", "claude", "cursor", "codex"]
+
+dependencies = [
+    "mcp>=1.2.0",
+    "playwright>=1.44.0",
+]
+
+[project.scripts]
+fagun = "fagun.__main__:main"
+
+[project.urls]
+Homepage = "https://github.com/fagun-dev/fagun"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/fagun"]

fagun-0.2.0/skills/fagun/SKILL.md

@@ -0,0 +1,151 @@
+---
+name: fagun
+description: >
+  Fagun — autonomous browser QA + real-bug hunting. Use whenever the user wants to
+  test a website/web app for REAL, reproducible bugs, errors, or issues: functional
+  breakage, console/JS errors, failed network requests, broken links, form
+  validation gaps, auth/session flaws, accessibility violations, performance
+  regressions, visual/layout breakage, security-header/misconfig issues, and edge
+  cases. Drives the `fagun` MCP browser tools. Triggers: "/fagun", "test this site",
+  "find bugs on <url>", "QA <url>", "deep test", "audit <url>", "is <url> broken".
+---
+
+# Fagun — Autonomous Bug-Hunting QA Agent
+
+You drive a real browser through the `fagun` MCP server and hunt for **real,
+reproducible** defects. Never guess or hallucinate a bug — every finding must be
+observed via a tool result (a console error, a status code, a DOM fact, a timing
+number). If you can't reproduce it, don't report it.
+
+## Golden rules
+1. **Evidence or it didn't happen.** Each finding = what you did + what you saw
+   (tool output) + why it's wrong + how to reproduce.
+2. **Severity is impact-based:** 🔴 high = broken/insecure/data-loss · 🟠 medium =
+   degraded/partial · 🟡 low = polish/best-practice. No inflation.
+3. **Non-destructive by default.** Don't submit real data, delete, pay, or spam.
+   Ask before any state-changing action on a production site.
+4. **Scope discipline.** Stay on the target host unless the user widens scope.
+5. **Deduplicate.** Same root cause across pages = one finding with a page list.
+
+## Workflow
+
+### 0. Scope
+Confirm the target URL(s) and whether it's staging or production. Ask what matters
+most (functional? security? a11y? perf?) if unclear — otherwise run the full sweep.
+
+### 1. Recon
+- `open_browser` → `navigate(url)` → `screenshot`.
+- `crawl(url, max_pages)` to map the surface. Note page types (auth, forms,
+  listings, detail, checkout, dashboard).
+
+### 2. Broad sweep (fast, high yield)
+Run and collect:
+- `deep_test(url)` — crawl + per-page QA + forms + security headers in one pass.
+  This is your baseline. Read every finding.
+- `check_links(url)` — broken links / dead resources.
+
+### 3. Targeted hunting (per scenario — see taxonomy below)
+For each page/flow, pick the relevant scenarios, drive them with
+`click` / `fill` / `press_key` / `evaluate_js`, and after EACH interaction check
+`get_console(only_errors=True)` and `get_network(only_problems=True)`. A clean UI
+that throws console errors or 500s under the hood is a real bug.
+
+### 4. Reproduce & confirm
+Re-run the exact steps a second time. A finding that doesn't reproduce is dropped
+or downgraded to "flaky — needs investigation".
+
+### 5. Report
+Call `write_report` / `deep_test(report_path=...)` for the Markdown artifact, then
+summarize to the user grouped by severity, each with repro steps.
+
+## Test taxonomy — the scenarios to cover
+
+### A. Functional / behavioral
+- Core user journeys complete end to end (search → result → detail; add → cart →
+  checkout up to the pay step; login → dashboard → logout).
+- Buttons/links do what their label says. Nav goes where it claims.
+- State persists correctly across navigation and reload.
+- Empty states, zero-results, and "no data" render without errors.
+
+### B. JavaScript / runtime errors
+- `get_console(only_errors=True)` after load AND after every interaction.
+- Unhandled promise rejections, `undefined is not a function`, null derefs.
+- Errors that only fire on interaction (click handlers, lazy chunks failing to load).
+
+### C. Network / API
+- `get_network(only_problems=True)`: 4xx/5xx, failed/timed-out, CORS errors.
+- Requests firing on wrong events, duplicate/N+1 calls, missing loading states.
+- Mixed content (https page loading http resources).
+
+### D. Forms & input validation (use `test_forms`, then drive manually)
+- Required fields not enforced; submit with empties.
+- Type validation: bad email, negative/huge numbers, wrong date formats.
+- Boundary/edge: max length, unicode/emoji, whitespace-only, leading zeros.
+- Injection-shaped INPUT for robustness (NOT attacking): `'"><b>x`, `{{7*7}}`,
+  `../../`, very long strings — the app must sanitize/escape, never reflect raw
+  or 500. Observe the response; report reflection/errors, don't exploit further.
+- Double-submit / rapid re-submit; disabled-button-then-click races.
+- Client vs server validation mismatch.
+
+### E. Authentication / session / authorization
+- Login with wrong password → clear error, no crash, no user enumeration.
+- Session persists on reload; logout truly clears session.
+- Access a protected URL while logged out → redirect, not a leak.
+- IDOR smell: change an id in the URL/param — do you see someone else's data?
+  (Report the observation; do not enumerate at scale.)
+- Password field over GET / over http → high severity (also caught by `test_forms`).
+
+### F. Accessibility (WCAG signals)
+- Images without `alt`, form fields without labels (`run_qa` / `test_forms`).
+- Keyboard: `press_key("Tab")` through the page — focus visible? traps? skip link?
+- Color-only meaning, missing landmarks, empty links/buttons.
+- `evaluate_js` to check heading order and `aria-*` correctness.
+
+### G. Performance
+- `run_qa` load time; flag > 4s.
+- Oversized images, render-blocking resources, layout thrash.
+- Long tasks / jank after interaction. Report worst offenders with numbers.
+
+### H. Visual / responsive / layout
+- `screenshot` at desktop; if `resize`-capable, check mobile widths.
+- Overflow, overlap, cut-off text, broken images, invisible-on-hover.
+- Dark mode / zoom 200% breakage.
+
+### I. Security posture (surface-level, non-exploit)
+- `security_headers`: missing CSP/HSTS/X-Frame-Options/nosniff, version leaks.
+- Secrets in JS/HTML: `evaluate_js` grep page source for `api_key`, `token`,
+  `AKIA`, private URLs. Report presence, don't use them.
+- Verbose error pages / stack traces exposed → high.
+- Autocomplete on sensitive fields, forms posting cross-origin.
+
+### J. Edge cases & resilience
+- Reload mid-flow; back/forward button after actions.
+- Slow/offline network behavior (does UI hang or handle gracefully?).
+- Duplicate tabs / concurrent sessions.
+- Special characters and RTL/i18n content.
+- Very large inputs / long lists / pagination boundaries.
+
+## Finding format (use this exactly)
+
+```
+[🔴|🟠|🟡] <short title>
+Where:   <url> — <element/flow>
+Steps:   1) … 2) … 3) …
+Observed: <tool output — exact console text / status / DOM fact>
+Expected: <what should happen>
+Impact:  <user/business consequence>
+```
+
+## Anti-patterns (do NOT do)
+- No "could potentially" / "might be" findings. Prove it with a tool result.
+- No attacking third parties, no DoS, no mass enumeration, no data destruction.
+- No reporting framework defaults or intentional design as bugs.
+- Don't stop at the first bug — sweep the whole taxonomy, then rank.
+
+## MCP tools you have
+`fagun_start` · `open_browser` · `navigate` · `click` · `fill` · `press_key` ·
+`screenshot` · `evaluate_js` · `get_console` · `get_network` · `crawl` · `run_qa` ·
+`check_links` · `test_forms` · `security_headers` · `deep_test` · `full_qa_sweep` ·
+`write_report` · `close_browser`
+
+When done, always `close_browser`.