Plugins

Modern web testing: 5 skills (browser-extension-tests, pwa-install-flow-tests, service-worker-tests, sw-cache-strategy-author, web-vitals-inp-deep) and 1 agent (modern-web-health-agent). Covers PWA + Chromium MV3 extensions + INP responsiveness.

Tenant-isolation testing for B2B SaaS: row-level security, cross-tenant leak detection, tenant-id propagation tracing, isolation-model references (silo / pool / bridge), and adversarial review of tenant-leak risk.

Mutation testing across languages: 5 skills (mull-mutation, mutmut-mutation, pitest-mutation, stryker-mutation, stryker-net-mutation) and 2 agents (mutation-survivor-explainer, mutation-tool-selector).

Notifications + messaging testing across email/SMS/push/webhooks: 7 skills (email-flow-test-author, in-app-notification-test-author, mailhog-testing, mailpit-testing, push-notification-test-author, sms-test-author, webhook-delivery-tester) and 1 agent (notification-delivery-critic).

Multi-agent QA toolkit with 10 specialized agents covering the full QA lifecycle — orchestrator, environment-manager, functional-reviewer, test-scenario-designer, browser-validator, automation-writer, manual-validator, bug-reporter, release-analyzer, and smart-test-selector. Stack-agnostic, output-chained, designed around live validation via Chrome MCP.

Payment platform sandbox testing: Stripe test cards + webhooks, Adyen test mode, PayPal sandbox, Braintree test cards; 3DS test flow + PCI DSS scope + payment flow states references; refund + chargeback + webhook-replay builders. Distinct from qa-compliance/pci-dss-scope-checker (compliance / scope verification); this plugin is platform-specific sandbox testing + payment flow state matrices.

PDF + print rendering tests: 4 skills (html-to-pdf-regression, pdf-accessibility-checker, pdf-snapshot-tester, print-stylesheet-tests) and 1 agent (pdf-test-author). Covers print/PDF output where qa-visual-regression covers screen output.

Persona-driven E2E testing for multi-user SaaS apps. AI agents drive named personas (with intent, scope, and a point of view) through your system in two layers — fast API automation first, then a browser walkthrough that catches the works-but-unusable UX gaps. Catalog and bug tracker grow with every feature ship.

Test process + methodology: 19 skills + 7 agents covering risk-based testing, DoD, test strategy, blameless post-mortems, release readiness, smoke gating, pyramid analysis, TDD coaching, E2E budgets.

Property-based testing libraries: 5 skills covering Hypothesis (Python), fast-check (JS/TS), proptest (Rust), jqwik (JVM), and QuickCheck (Haskell) + ScalaCheck - each ships authoring + run + shrinking + CI integration - plus 3 agents (property-based-test-author, property-based-tool-selector, vacuous-property-critic).

Workbox recipes, offline fallback patterns, Lighthouse PWA audit interpretation, and web-push subscription lifecycle testing — distinct from qa-modern-web's generic SW/install/cache-strategy skills and qa-notifications' cross-channel push harness

Real-time protocol testing: 7 skills (grpc-streaming-tests, mqtt-tests, server-sent-events-tests, sse-load-test, stomp-amqp-tests, webhook-replay-tests, websocket-tests) and 1 agent (realtime-protocol-reviewer). Anchored on RFC 6455, WHATWG SSE, gRPC streaming, MQTT v5, and the Standard Webhooks signature scheme.

Resilience drills: 6 skills (backup-verification-author, dr-drill-runner, error-budget-tests, mttr-mtbf-tracker, restore-time-tests, slo-negotiation-prep) and 2 agents (dr-drill-orchestrator, reliability-review-agent). Production-grade DR drills + backup verification + RTO + error-budget gating + incident metrics.

AI/ML & data-pipeline QA role bundle: one-command install of LLM evaluation, ML model testing, AI-assisted test generation, search relevance, data notebooks, and data quality.

Test automation engineer role bundle: one-command install of web E2E, API testing, mobile automation, BDD, visual regression, CI integration, flake triage, test-code review, test data, and browser/OS compatibility. Organized around the job role, not a technology stack.

Backend, API & distributed-systems QA role bundle: one-command install of API/contract/GraphQL/gRPC/real-time testing, auth flows, notifications, payment, async jobs, DB migrations, caching, concurrency, saga/CQRS, distributed tracing, serverless, time/timezones, feature flags, and experimentation.

Frontend & web-app QA role bundle: one-command install of web E2E, visual regression, accessibility, modern web, PWA, browser-extension, localization, charts, PDF/print, browser/OS compatibility, and JS/TS unit testing.

QA leadership & test-management role bundle: one-command install of the QA role org-chart, test process, test management, impact analysis, reporting, hiring, shift-left, defect management, and production-code quality governance.

Manual tester / QA analyst role bundle: one-command install of manual scripted + exploratory testing, test case management, defect management, bug reproduction, test reporting, test process, test data, and browser/OS compatibility. Organized around the job role, not a technology stack.

Mobile, desktop & cross-platform QA role bundle: one-command install of mobile-native, desktop, embedded, game, and browser/OS compatibility testing.

Performance & reliability QA role bundle: one-command install of load testing, chaos engineering, resilience drills, and shift-left / shift-right production QA.

SDET role bundle: one-command install of the full automation-engineer stack plus per-language unit testing (JS/TS, Python, JVM, .NET, Go/Rust), contract testing, mutation testing, code quality, test impact analysis, and load testing. Organized around the job role, not a technology stack.

Application-security & compliance QA role bundle: one-command install of SAST, DAST, SCA, secrets scanning, SBOM, fuzzing, compliance, multi-tenancy isolation, test-data privacy, and IaC policy testing.

QA org chart of 15 sharply-scoped role agents across four tiers. Tier 1 IC: exploratory-charter-author, automation-harness-bootstrapper, load-test-plan-designer, security-test-plan-builder, a11y-manual-test-scripter, data-quality-engineer, production-tester. Tier 2 Lead: test-architect, test-effort-estimator, quality-coach, test-quality-coach. Tier 3 Manager: release-engineer, release-cutover-coordinator, qa-manager. Tier 4 Head/Director: head-of-quality. No generic persona-as-scope agents.

Saga + CQRS + event sourcing test patterns: 5 skills (cqrs-projection-tests, event-sourcing-tests, eventual-consistency-tests, outbox-pattern-test-author, saga-transaction-tests) and 1 agent (saga-critic). Covers ACD-without-isolation saga tests, replay determinism, and projection consistency windows.

SAST (static application security testing): 7 skills (bandit-python, codeql-queries, eslint-security-rules, gosec-go, pmd-apex-rules, semgrep-rules, sonarqube-rules) and 1 agent (sast-finding-triager). Every scanner skill includes a mandatory False-positive triage section.

SBOM generation + container image scanning + vuln prioritization: 7 skills (cyclonedx-format, grype-scanning, sbom-diff, spdx-format, syft-generation, trivy-image, vex-author) and 1 agent (vuln-prioritizer). Required for US EO 14028 + EU CRA + FDA medical-device guidance.

SCA (software composition analysis): 8 skills (bundle-audit-ruby, cargo-audit-rust, dependabot-config, npm-pip-maven-audit, osv-scanner, reachability-analyzer, renovate-config, snyk-test) and 1 agent (sca-prioritizer).

Search relevance testing: 6 skills (elasticsearch-relevance-tests, hybrid-search-eval-author, judgment-list-author, opensearch-relevance-tests, solr-relevance-tests, vector-search-precision-tests) and 1 agent (relevance-regression-reviewer). IR-metrics-driven NDCG / MRR / Recall@k regression detection.

Secrets scanning + rotation: 5 skills (gitleaks-scanning, kingfisher-scanning, secrets-baseline-manager, secrets-rotation-runner, trufflehog-scanning) and 1 agent (secrets-finding-triager). Covers detection AND rotation workflow (git-history scrub doesn't fix the leak).