RealDone

Prove that a web app works — in a real browser, with real evidence.

RealDone answers one question: does the feature a user can see actually work?

It opens your app in a real browser, discovers visible actions, performs the safe ones, reloads or reads back the result, and saves evidence that can be replayed.

It does not score visual design or trust a button, TODO, mock response, HTTP 200, success toast, or coding-agent claim by itself.

The app appears to…	RealDone checks…
save a record	whether it survives reload or exists in the source of truth
enforce a role	whether another role, direct route, and API are actually denied
upload or export	whether real non-empty bytes were transferred
complete an AI coding task	whether existing behavior regressed after the change

Open app → find actions → perform action → observe network/UI/storage
         → reload/read back → classify result → save evidence + replay

Try it

Run this inside any web project—no test files, account, AI, or cloud service required:

npx realdone scan

RealDone automatically manages Node projects (including projects without a lockfile), static HTML, Django, FastAPI, Flask, Laravel, Rails, ASP.NET Core, Spring Boot, Deno, Go, Rust, and Composer-based PHP conventions. For a custom runtime or an app that is already running, pass its HTTP URL—the browser verifier itself is language- and framework-independent.

Chromium is downloaded automatically on the first scan if it is missing.

Before operating a project, the interactive CLI asks once whether it is disposable local/staging data; non-interactive automation must pass --yes explicitly. External and destructive actions still require their separate flags.

If the app is already running, pass its URL:

npx realdone scan http://localhost:3000

RealDone prints the path to a local HTML report:

Three ways to use it

1. Scan an app

npx realdone scan

Best for a quick first check. Default mode uses one Chromium worker, safe actions only, no AI, no account, and no database credential.

Its finite budget is coverage-balanced rather than “the first controls in DOM order”: RealDone represents different routes, action kinds, intents, and Enter/submit paths, then reports exactly what was selected or omitted. Use --full when you need broader safe coverage.

2. Record and verify an important flow

npx realdone record http://localhost:3000 --name "Create customer"
npx realdone verify .realdone/flows/create-customer.json

Use this for login, checkout, CRUD, upload, export, or multi-step flows. The recorder stores semantic locators and masked rrweb evidence; deterministic verification uses the versioned RealDone contract.

3. Let a coding agent call RealDone

npx realdone mcp --project ../my-app --allow-project-actions

The local MCP server lets Codex, Claude, or another AI call scan, baseline, verify-change, replay, and report tools directly. --allow-project-actions is the user's one-time consent for that MCP project session; it does not enable external or destructive actions. RealDone still decides pass/fail from independent browser evidence. See MCP integration.

What it can verify

Surface	Evidence
Browser behavior	UI state, URL, requests/responses, console, storage, reload
Persistence	memory, tab, session, browser-local, backend, source of truth
Complex flows	keyboard, upload, rich text, drag/drop, popup, download
Regression	baseline, affected-flow selection, expected change vs regression
Authorization	named roles, direct API/routes, cross-user and revoked-role probes
Databases	SQLite, PostgreSQL, Supabase, Firebase, MongoDB, Prisma/custom
Providers	Stripe test mode, Resend, SendGrid, Mailgun, S3, Supabase Storage, OAuth
Browsers/OS	Chromium, Firefox, WebKit; Windows, macOS, Linux

Database, provider, multi-role, trace, video, and multi-browser checks are optional. The quick scan stays small.

Safe by default

• Mutations run automatically only on localhost, .test, .local, or an explicit staging host.
• Destructive and external-effect actions require explicit opt-in; live form targets are rechecked immediately before execution.
• Stripe live keys are rejected; remote provider/database access is fail-closed by default.
• Credentials come from environment variables and are redacted from evidence.
• Cleanup is a dry run unless separately confirmed.

Review policies before testing any environment with real users or money.

Tested on real projects

Ten pinned MIT projects—Flatnotes, Linkding, Flame, TakeNote, Grimoire, Dashy, JSPaint, 2048, Flowy, and Quiver—were run in real local runtimes. Every injected no-op Create button was discovered and reported as NO_EFFECT / RD002; clean-control limitations remain visible. See the compact 10-project evidence.

Current status

RealDone v1.3.3 meets the full normative product specification for its signed fingerprint and includes the 10-project regression qualification above.

• Released fingerprint 68d4a8cb… is bound to fresh TodoMVC, Actual Budget, Conduit SQLite/PostgreSQL/Supabase, Pocket Ledger, role, CRUD-cleanup, and Codex MCP evidence; the v1.3.3 package path passed all 15 normative gates on Windows, macOS, and Linux in signed hosted run 30189340006.
• All 22 normative product areas and all 58 detector classes are IMPLEMENTED and executable-gated.
• GitHub signed the hosted release evidence; the authenticated Codex regression/repair cycle and all nine external capability classes are SHA-256-bound and validator-parsed.
• realdone is published on npm and the registry-installed npx realdone scan path is smoke-verified.

PRODUCT_STATUS.md is the only area-completeness ledger. PRODUCT_SPECIFICATION.md is the full source of truth. A completed roadmap phase is not the same as a completed full product.

Documentation

• Start and advanced verification
• Record and verify flows
• Database adapters
• Provider adapters and plugins
• CI and GitHub Action
• MCP integration for coding agents
• Architecture and threat model
• Evidence-based product status

Contributing

Detector changes need an intentionally broken case, a correct control, and observable evidence. See CONTRIBUTING.md and SECURITY.md.

MIT licensed. See LICENSE and third-party notices.