# Qodex > AI agent that reviews pull requests by running API, UI and security tests against the real app. Qodex is an AI testing and code review agent for software teams. Qodex installs as a GitHub app, reads each pull request, runs API, UI and security scenarios against a preview or staging URL, and posts findings with the failing request, response or screenshot plus a merge recommendation. Qodex has a free Individual tier and paid team plans. **Best for:** Engineering teams merging a high volume of pull requests, including AI-written code, who want each change exercised against a running app before it merges. - Official site: https://qodex.ai - Listed in: [AI Code Assistant](https://trendhub.net/ai-tools/category/code-assistant), [AI Agents & Automation](https://trendhub.net/ai-tools/category/ai-agents) - Last checked: 2026-10-09 (facts taken from qodex.ai) - Source page: https://trendhub.net/ai-tools/qodex-ai-code-review-backed-real-test ## Key facts - Platforms: Web, API, MCP - Pricing model: Freemium - Free plan: Yes - API: Yes - Made by: Qodex.ai ## What is Qodex? Qodex is a continuous testing platform that ties AI code review to actual test execution. When a developer or coding agent opens a pull request, Qodex reads the diff and the surrounding repository, selects the relevant API, UI and security checks, and runs them against a preview deployment or shared staging environment. Results arrive as status checks and comments containing evidence: the request that failed, the response, or a screenshot. Failures are sorted into real bugs, stale tests, for which Qodex proposes a fix as a diff, and environment problems. Scenarios are written once by the model and replayed afterwards as plain Playwright and HTTP code without further model calls, and teams can export them. Production incidents can be converted into regression scenarios. Security coverage follows OWASP categories, including BOLA and IDOR. Integrations include GitHub, GitLab, Slack, Jira, Sentry and Datadog. ## Key features - **Execution-Backed PR Review**: Comments on a pull request only after running scenarios against the live preview, and attaches what was sent and returned. - **API Testing**: Builds runnable HTTP and GraphQL tests from an OpenAPI spec, a Postman collection, a spreadsheet or existing tests. - **UI Testing**: Drives the application in a browser with Playwright scenarios and captures screenshots of failures. - **Security Testing**: Probes endpoints for OWASP-class issues such as broken object-level authorization, injection and auth bypass. - **Failure Classification**: Labels each failed run as a product bug, an outdated test or an infrastructure issue so that noise does not block merges. - **Incident-to-Test Autopilot**: Turns a production incident into a regression scenario that later pull requests are checked against. ## How Qodex works 1. **Open a pull request**: A developer or a coding agent proposes a change in a connected repository. 2. **Qodex gathers context**: The agent reads the diff together with the code around it. 3. **Checks run on the preview**: Relevant API, UI and security scenarios are executed against the preview or staging URL. 4. **Evidence and verdict are posted**: Findings include the failing request, response or screenshot, and the pull request receives a merge recommendation. 5. **Incidents feed the suite**: Problems seen in production are saved as scenarios and applied to later changes. ## Use cases - **Gating AI-Generated Code**: Check pull requests opened by coding agents before a human approves them. - **Bootstrapping API Tests**: Import an API specification and get an initial suite without writing tests by hand. - **Catching Access-Control Bugs**: Detect cases where one tenant can read another tenant's data. - **Keeping a Test Suite Current**: Review proposed scenario updates when the product changes and approve them as diffs. - **Preventing Repeat Incidents**: Add a regression check every time something breaks in production. ## Things to know - **A person decides the merge**: Qodex blocks or recommends but does not merge, deploy or alter source code on its own. - **Tests are exportable**: Scenarios are standard Playwright and HTTP code that a team keeps and can run without Qodex. - **Bring your own model key**: Teams may supply their own model provider key, and every call is logged; replays of saved scenarios make no model call. - **Data location**: Customer data is kept on US-based servers and separated by project. ## FAQs ### What is Qodex? Qodex is an AI agent for code review and continuous testing that runs API, UI and security tests on pull requests and reports what actually failed. ### What is Qodex used for? Qodex is used to test every code change before it merges, generate and maintain test scenarios, and find security flaws such as broken access control. ### Is Qodex free? Qodex: a free plan is available. Paid plan rates are published on qodex.ai. Check the official pricing page for current amounts. ### How much does Qodex cost? The two paid figures are starting prices adjusted to team size and usage. ### Does Qodex change or merge code by itself? No. Qodex posts findings and status checks on pull requests and leaves the merge decision to a person; test repairs are offered as diffs for approval. ### What access does Qodex need to my repository? Qodex's GitHub app asks for read access to pull requests and not write access to source code. The company says data is encrypted, stored in the United States and not used for model training. ### Do I need a preview environment to use Qodex? Qodex needs a reachable URL to test against, which can be a per-pull-request preview deployment or a shared staging environment. ### Does Qodex have an API? Yes. Qodex's plan comparison lists webhooks and API access as part of the Scale plan. --- Source: https://trendhub.net/ai-tools/qodex-ai-code-review-backed-real-test (trendhub)