analyze-tests

Run the analysis on your repository to execute coverage tools like dotnet test, jest --coverage, or pytest --cov, then compare results against existing tests. The output lists untested scenarios in Given-When-Then format, prioritized from CRITICAL to LOW with code examples.

It supports xUnit, NUnit, and MSTest for .NET; Jest, Mocha, and Vitest for JavaScript; pytest for Python; Go testing; JUnit for Java and Kotlin; XCTest for Swift; RSpec for Ruby; PHPUnit for PHP; plus Pester, Bats, pgTAP, and Terratest.

Yes. It flags time-dependent tests using DateTime.Now or unseeded random values, network-dependent tests without mocks, and order-dependent tests. It also measures execution time against thresholds of 1s for unit, 10s for integration, and 30s for e2e tests.

Yes. It verifies tests exist for authentication and authorization failures, SQL injection, XSS, command injection, path traversal, IDOR, rate limiting, CSRF, and sensitive data exposure in logs. Missing security tests are reported as HIGH priority.

Delegation to the black-box-analyzer agent occurs when the project has 50 or more endpoints, 100 or more test files, or multiple modules. One agent is spawned per module for parallel analysis, and results are aggregated into a single report.

Coverage percentages measure executed lines, not assertion quality, so high coverage can coexist with weak tests. Mutation testing tools like Stryker or mutmut address this but must be installed separately, and business rule mapping requires accessible requirement documentation.