Heal

• Running a weekly whole-product bug hunt on a SaaS app that ships most of its code through AI coding agents
• Checking a release candidate for user-facing regressions across features a pull request did not touch
• Testing flows that depend on payments, email or third-party APIs that are switched off or unreliable in staging
• Finding cross-tenant data access, stored XSS and other runtime vulnerabilities by testing the running app signed in as two users
• Handing reproduced defects to Claude Code over MCP, letting it patch them, and re-running Heal's failing test to confirm each fix
• Catching slow queries and other performance regressions introduced by recent changes before they reach users

Heal's useful idea is to accept a noisy hunt and filter it with a sandbox: generate lots of suspicions, then file only what a test reproduces. That makes it a different tool from the AI code reviewers it benchmarks against. It looks at the whole running product rather than one diff, it can exercise payment and email flows that staging usually switches off, and it hands back a failing test rather than an argument. That suits teams shipping a lot of agent-written code who want a weekly check that a coding agent can then work through over MCP. The gaps are mostly about maturity. The bug-hunting agent only shipped in mid-September 2026, pricing beyond a free beta is unpublished, supported stacks are undocumented, the docs site still describes the old product, and runs are slow enough that it complements a PR gate rather than replacing one. The benchmark is a reasonable argument for complementarity, but it is the vendor's own and small. Treat the free beta as the time to see whether it can stand up your stack and whether its defects are ones you would fix.

About Heal

Heal (heal.dev, from the Paris company MYIA SAS) started as an AI QA tool for writing and fixing Playwright end-to-end tests. Heal 2.0, released on September 16, 2026, rebuilt the product around a new agent with a narrower job: find and reproduce defects in your running app. You connect a GitHub repository and the agent first reads the code to map the product's features and entry points (screens, API routes, and per its benchmark write-up also CLIs, SDKs, webhooks and scheduled jobs). It then builds what Heal calls the application sandbox, a production-like environment with seeded test data in which the web app, API and database run for real and services that cannot run locally, such as payments, email or Slack, are mocked or emulated. Heal says it asks a few targeted questions to get that sandbox right instead of presenting a plan. The hunt follows a deliberate pattern: generate many suspicions from reading the code, from security and runtime tools run against the sandbox (the site lists schemathesis, ZAP, dalfox, jwt_tool, nuclei, semgrep, trufflehog and sqlmap, among others) and from a knowledge base of common QA defects, then try to prove each one. A defect is filed only if a test fails twice and fails again when Heal re-runs it itself; anything it cannot reproduce is dropped. Security checks run signed in as two different users, so the agent can test whether one account can reach another's data, and a link crawl looks for dead pages and assets that do not load. Third-party calls can be replayed failing, slow or answering twice to exercise error paths. Performance testing arrived in version 2.5.0 (October 8, 2026), and you choose which test types to run (behaviour, security, performance) and at what depth, which changes speed and cost. Heal says runs can happen locally or in the cloud: there is a web app and a desktop app, Studio, whose changelog entries refer to sandbox Docker stacks. Each defect comes with the situation, the actual and expected result, captures, where to look in the code, and the failing Playwright test that turns green once it is fixed. Defects can be exported as Markdown, and Heal's MCP server lets Claude or another coding agent pull a defect, fix it, re-run Heal's test to confirm the fix, or mark a finding as noise. Heal positions itself as a complement to AI code review rather than a replacement: reviewers comment on a diff in minutes, while a Heal run covers the whole product, changed code or not, and takes minutes to hours, so the company suggests running it weekly or before a release. Its own benchmark against three review bots makes the same argument (see the FAQ). The tradeoffs: heal.dev publishes no price list for the bug-hunting agent (the homepage offers a free trial and the founders say it is free during the beta), supported languages and frameworks are not documented, repositories connect only through GitHub, the docs site still describes the Playwright test-writing CLI rather than the 2.x agent, and by design Heal skips code no user reaches, such as CI configuration, migrations and dependency versions.