ViewportWitness by Apex Labs

ViewportWitness by Apex Labs

Check a deployed website before sign-off. Get screenshots, accessibility and layout evidence across three screen sizes without setting up a browser. Public HTTPS pages only.

Free sample report · Start with a no-payment budget preview

The sample is a static local-test demonstration. Its public URL becomes available when this change is deployed.

Two low-resource paid agent tools complement browser QA: extract_page converts one public HTML page to deterministic Markdown for $0.005 USDC, and web_release_gate passively checks one public page's release security controls for $0.05 USDC. Both share the Base/Solana x402 rails, idempotency protection, single-worker queue, and seven-day report lifecycle. They do not accept caller-supplied HTML, credentials, cookies, custom headers, uploads, or private-network targets.

Remote MCP server and x402 API for AI-agent browser QA. Submit a public HTTPS URL and receive screenshots, accessibility findings, layout analysis, and structured JSON across phone and desktop viewports.

The live service is at https://qa.honeygate.app. A standard report costs $0.08 USDC, read-only assertions cost $0.10, and a baseline comparison costs $0.12. Local instances can run in test mode without payment.

• Official MCP Registry listing
• MCP setup for ChatGPT, Claude, Codex, Cursor, and VS Code
• Privacy policy · Terms · Support

---

Live service

# Probe the live service (returns 402 with payment requirements)
curl -s -X POST https://qa.honeygate.app/v1/checks \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://example.com"}'

# Payment discovery
curl -s https://qa.honeygate.app/.well-known/x402 | jq .

# Agent skill manifest
curl -s https://qa.honeygate.app/skill.md

Use an x402-aware client (e.g. @x402/fetch with a funded wallet) for paid requests. See llms.txt for the full agent usage guide.

---

Paid product examples

An ordinary HTTP request to any paid endpoint returns HTTP 402 — an x402 challenge containing the network, asset, amount, and destination address. An x402-aware client (such as @x402/fetch with a funded wallet) pays the challenge and retries automatically; your code receives the successful JSON result. The examples below show the request shape only — do not call the live service or send payment during development; use PAYMENT_MODE=test locally (see Local development).

POST /v1/checks — 0.08 USDC

Submit a public HTTPS URL and receive screenshots, accessibility findings, layout analysis, and browser errors across phone and desktop viewports.

// x402-aware client pays the 402 challenge and retries automatically
const { id, pollUrl } = await fetch402('https://qa.honeygate.app/v1/checks', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ url: 'https://example.com' }),
}).then((r) => r.json())
// Poll GET pollUrl until { status: 'complete' }

POST /v1/verify — 0.10 USDC

Run explicit read-only assertions against a live public HTTPS URL. The worker performs only non-mutating checks — no forms are submitted, no purchase or delete controls are clicked.

const { id, pollUrl } = await fetch402('https://qa.honeygate.app/v1/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    url: 'https://example.com',
    assertions: [
      { type: 'selectorVisible', selector: 'h1' },
      { type: 'titleIncludes', value: 'Example Domain' },
    ],
  }),
}).then((r) => r.json())

POST /v1/compare — 0.12 USDC

Diff the current render against a baseline job. baselineJobId must identify a completed, unexpired ViewportWitness check that has screenshots for all three viewports (phonePortrait, phoneLandscape, desktop). Baselines expire after seven days. The request is rejected if the baseline job is pending, failed, or missing any viewport screenshot.

const { id, pollUrl } = await fetch402('https://qa.honeygate.app/v1/compare', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    url: 'https://example.com',
    baselineJobId: 'JOB_ID_FROM_PREVIOUS_CHECKS',
  }),
}).then((r) => r.json())

Safety: Only public HTTPS URLs are accepted. Loopback, private, link-local, and metadata addresses are blocked at every hop. The browser worker is non-mutating — no forms are submitted and no state-changing interactions are performed.

---

Local development

npm install
npx playwright install chromium
cp .env.example .env
npm run dev

# Create a check (test mode — no payment required)
curl -s -X POST http://localhost:3000/v1/checks \
  -H 'Content-Type: application/json' \
  -d '{"url": "https://example.com"}' | jq .

# Poll result
curl -s http://localhost:3000/v1/checks/JOB_ID | jq .status

# Get screenshot
curl -o desktop.png http://localhost:3000/v1/checks/JOB_ID/screenshots/desktop

Local defaults to PAYMENT_MODE=test. No CDP keys needed for test mode. Results are labeled paymentMode: "test" and do not represent real payment settlements.

---

API

Method	Path	Description
GET	/	Service info
GET	/health	Liveness probe
GET	/ready	Readiness probe (DB + worker)
GET	/openapi.json	OpenAPI 3.1 spec
GET	/llms.txt	Agent usage guide
GET	/skill.md	Concise agent skill manifest
GET	/privacy	Privacy policy
GET	/terms	Terms of service
GET	/logo.png	Directory and integration logo
GET	/.well-known/x402	Payment discovery
POST	/v1/checks	Create a QA check job
POST	/v1/verify	Check explicit read-only assertions
POST	/v1/compare	Compare against an unexpired baseline job
POST	/mcp	Remote MCP interface with x402-paid tools
GET	/v1/checks/:id	Poll job status / get report
GET	/v1/checks/:id/screenshots/:viewport	Download screenshot PNG
GET	/v1/checks/:id/diffs/:viewport	Download comparison diff PNG

Page history archive (off by default)

With ARCHIVE_ENABLED=true, every completed check, verify and compare report is also copied into a separate archive (ARCHIVE_DIR) that outlives the seven-day job retention. Agents can then ask for past snapshots of one exact public URL. The archived copy holds only public page evidence (screenshots, findings, verdict); it drops the job ID, payment data, caller assertions and baseline references.

Method	Path	Description
GET	/v1/history/availability?url=	Free: how many snapshots exist and their range
POST	/v1/history	Paid (HISTORY_PRICE_USDC, default 0.02): list
GET	/v1/history/snapshots/:id	Full archived snapshot (ID from the paid listing)
GET	/v1/history/snapshots/:id/screenshots/:viewport	Archived screenshot PNG

POST /v1/history takes { "url": "https://example.com", "limit": 5, "before": "<ISO time>" } and returns snapshots newest first with a nextBefore cursor. A signed request for a URL with no snapshots gets 404 no_snapshots before any payment settles. Limits are set in .env: ARCHIVE_RETENTION_DAYS (90), ARCHIVE_MAX_STORAGE_GB (5), ARCHIVE_MAX_SNAPSHOTS_PER_URL (30), HISTORY_MAX_RESULTS (10).

Viewports: phonePortrait (375×812), phoneLandscape (812×375), desktop (1440×900)

---

Payment modes

Mode	Payment required	Network
test	No	— (local dev only)
testnet	Yes (x402)	Base Sepolia; optional Solana Devnet
production	Yes (x402, $0.08 USDC)	Base mainnet; optional Solana mainnet

Production mode requires ENABLE_MAINNET_PAYMENTS=true and a reviewed release. Solana is separately off by default. Enabling it requires ENABLE_SOLANA_PAYMENTS=true, the public test and revenue destinations, facilitator capability confirmation, and its own settlement test. The application selects the correct destination from PAYMENT_MODE. Paid modes also require a private CUSTOMER_HASH_SECRET of at least 32 characters. It creates a stable, one-way customer label for repeat-use measurements; raw payer wallet addresses are not stored. Attribution is best-effort and never blocks delivery after a verified payment. Changing this secret starts a new measurement series and does not rewrite old jobs. See docs/RUNBOOK.md for activation steps.

---

Run tests

npm test              # unit tests (no browser required)
npm run test:e2e      # local e2e (requires Playwright Chromium)
npm run typecheck     # TypeScript strict check

---

Docker

docker compose build
docker compose up -d
curl http://localhost:3000/health

---

Further reading

• Build specification — full product and safety spec
• Runbook — operations, backups, upgrades, mainnet activation
• Agent guide — machine-readable usage instructions
• Skill manifest — concise agent skill guide
• MCP install guide — connect ChatGPT, Claude, Codex, Cursor, and VS Code
• Privacy policy and terms
• Customer feedback — request a capability or report a result without posting secrets
• Build evidence — test results and known limits

---

MIT License