StateProof is a free, open-source frontend testing tool and runtime proof engine that forces loading, empty, error, and offline states in a controlled Chromium browser without modifying your application code.

How does StateProof differ from Playwright or Cypress?

Unlike Playwright or Cypress that often require mock servers or MSW (Mock Service Worker), StateProof intercepts network requests directly at the Chrome DevTools Protocol (CDP) layer. This means zero monkey-patching and zero proxy setups.

Does StateProof support AI coding agents?

Yes. StateProof ships with a native Model Context Protocol (MCP) server that allows AI agents like Cursor, Claude, and Windsurf to inspect frontend components, execute headless browser validation, and self-heal failed states autonomously.

Is StateProof free and privacy-focused?

Yes, StateProof is 100% free and open-source under the MIT license. It runs entirely on your local loopback (localhost) with zero telemetry, zero analytics, and zero cloud dependencies.

00 // SIGNAL — RUNTIME PROOF ENGINE

AGENTS SHIP THE HAPPY PATH. WE PROVE THE REST.

StateProof forces loading, empty, error and offline states at the wire — inside a controlled Chromium — and captures timestamped evidence for each one. No MSW. No proxy. Zero edits to your app.

delay 3000ms▪fixture account-empty.json▪status 500▪internetdisconnected▪[data-state='loading']▪viewport 1440×1024▪chromium 141▪loopback guardrail▪zero telemetry▪exit 0▪ delay 3000ms▪fixture account-empty.json▪status 500▪internetdisconnected▪[data-state='loading']▪viewport 1440×1024▪chromium 141▪loopback guardrail▪zero telemetry▪exit 0▪

01 // PROOF LINE

Four states walk the line.
Each one leaves evidence.

Synthetic responses injected at the wire — before your UI renders. Scroll to scrub down the evidence rail.

EXHIBIT A LOADING

INJECT: response: delay 3000ms
EXPECT: [data-state='loading']
CAPTURE: loading.desktop.png

EXHIBIT B EMPTY

INJECT: fixture account-empty.json
EXPECT: [data-state='empty']
CAPTURE: empty.mobile.png

EXHIBIT C ERROR

INJECT: response: status 500
EXPECT: [data-state='error'] + retry
FINDING: retry control missing < 420px

EXHIBIT D OFFLINE

INJECT: abort internetdisconnected
EXPECT: [data-state='offline']
CAPTURE: offline.recovered.png

VERDICT EXIT 0

4/4

states proven · 2.84s · 0 telemetry pings
evidence sealed to ./artifacts/

02 // INSTRUMENT

A hand on the wire.
Not a mock in your code.

Four instruments, one controlled browser process. Every assertion is observed from the outside — the way a user would meet it.

Zero-friction attach

Detects local Chrome or Edge on macOS, Linux and Windows. No 115 MB browser download, no sandbox lock-in. Remote CDP attach when you need it.

PREFLIGHT 0.00sDOWNLOAD 0 MB

Recovery loops

Injects the 500, verifies the banner, clicks retry, re-fulfills the endpoint — and keeps before/after timestamped evidence of the whole loop.

FAIL → RETRY → 200DUAL CAPTURE

Live socket drops

Severs WebSocket and SSE feeds mid-stream over raw CDP. Proves reconnecting banners and offline fallbacks — no local mock proxy involved.

CDP SEVER 250msASSERT 14ms

DOM & pixel lens

Strict assertions on visibility, text and ARIA transitions — aria-busy="false" included — plus sub-pixel screenshot diffs against the last green run.

PIXEL-DIFF < 0.01%ARIA STRICT

ASCII artwork of a hand touching the wire, signal spark radiating from the fingertip — fig. 02 — interception, by hand

03 // PERIMETER

Local-first by architecture.
Not by promise.

Built for security-conscious teams and airgapped CI. Interception lives inside the controlled browser process — nothing phones home, because nothing can.

ASCII artwork of a stamped perimeter seal medallion — fig. 03 — the seal, stamped locally

§R1ZERO TELEMETRY

No analytics, no beacons, no cloud phone-home. Interception and evaluation run 100% on your workstation or CI agent.

§R2PURE CDP

Interception at the Chromium protocol layer via Playwright CDP. Zero monkey-patching, zero mock servers, zero app edits.

§R3ORIGIN LOCKED

Hardcoded to localhost and 127.0.0.1. External origins stay denied unless you explicitly pass --allow-remote.

§R4DISK-ONLY

Proof cards and reports write to ./artifacts as self-contained HTML and Markdown. They open from file:// with no CDN at all.

ASCII artwork of a monitor showing a glowing checkmark

04 // EXECUTE

Proof is one command old.

Point it at localhost. Sixty seconds later the unhappy paths are exhibits, not opinions.

STATES4/4 PASS

RUNTIME2.84s

TELEMETRY0 PINGS

EXIT0

OPEN GITHUB REPOSITORY