<!-- Stranger Agent — QA and security agents that run where the code is -->

Agentic

# Stranger Agent

QA and security agents that run where the code is.

Each agent does one job: work out why a suite is failing, write the tests a project never had, or probe a running application and sort the real findings from the noise. Name the one you want, or describe the problem and let it choose.

## What they do

Each agent is a specialist, called by name. When you do not know which you need, describe the problem instead.

**orchestrator**
Takes a problem in plain words and puts the right specialist on it.

**auditor**
Works out why a test is failing, and which cause to fix first. It only reads — it will not touch your code.

**healer**
Repairs a failing test, editing source or test files. Every change can be undone.

**creator**
Writes the tests a file or a module never had.

**extractor**
Reads a suite you already have and reports what it covers, what it reuses, and what it misses.

**selector**
Finds selectors that survive a redesign, and writes the page object that uses them.

**scanner**
Probes a running application for vulnerabilities, through OWASP ZAP.

**triage**
Turns a pile of scanner alerts into filed tickets, without filing the same one twice.

Two of them answer in JSON rather than prose, for scripts rather than people.

## Where you run them

The same agents, behaving the same way, wherever the work already happens.

**Terminal**
Ask a question and read the answer.

**CI**
Run on every pipeline, and fail the build on what comes back.

**HTTP**
Call them from tooling you have already built.

**MCP**
Use them from Claude, or any assistant that speaks MCP.

**Security scanning**
Point one at a running application and triage what it finds.

## Scan triage

A scan of a real application returns hundreds of alerts and most of them are not real. Teams either work through them by hand or stop opening the report, and a report nobody opens is a scanner nobody should be paying for. Stranger Agent tries to reproduce each alert, files the ones that hold up with a confidence score, and remembers the ones that do not.

So the second scan of a codebase costs less than the first. What it learned was specific to that codebase.

## Runs without sending code anywhere

It can run against a local model, with no API key and nothing leaving your network. For code that cannot leave the building, that is the difference between a tool you can use and one you cannot.

## Put agents on the work

Run them from a terminal, a pipeline, or the assistant you already use. Tell us what your suite looks like and we will tell you which agents earn their place.

[Contact us](/contact)