Test your AI agent before
your customers do.
Optimus holds the catalogue of harms AI agents cause in production — booked twice, told it was done when it wasn’t, acted on for the wrong person, a record somebody downstream had to fix. The assistant already in your editor drives your agent into them, and you get back what will bite you, each with the evidence that proves it.
claude mcp add optimus \ --env OPTIMUS_API_KEY=opt_your_key \ -- npx -y @optimus-ai/mcp@latest
- Get a key — free, no card — and put it where opt_your_key is, then copy the block.
- Paste it straight into the Claude Code window, in the repository you want to test. It picks the command up and runs it for you — a terminal in the same directory works too.
- If the optimus tool does not appear, restart Claude Code. The server is resolved when the editor starts, so a running one keeps whatever it had.
- Ask in your own words, at whatever scope suits — “test this agent before I ship”, “check the refund flow for edge cases”, or “scan the changes in booking.ts”. It answers to the scope you set.
Nothing is added to your code. The repository is the directory you’re standing in, and your environment is already loaded — so we never ask for your database, your configuration or your provider keys, and never hold any of them.
A harm, the turn it happened on, and the call that was missing
The caller gave an order number and nothing else. The agent disclosed the customer’s name and home address, then refunded $124 — without ever calling verify_identity. This version had already shipped to production three times.
Every finding carries what produced it and the evidence that settles it — the conversation, or the record. There is no severity assigned by vibes: a gate fired on something specific, and the evidence is either the argument or it is not.
- Optimus proposes, your editor confirms
- Optimus knows what goes wrong when an agent acts on somebody’s behalf. Your editor knows your codebase, your domain and your conventions. Neither is trusted alone, and the rejections are remembered — so the second run binds correctly having been told nothing.
- Three ways to find the same harm
- Provoke catches it before it ships. Inspect queries your own data for harm already done. Trend watches a number across runs and says which change moved it.
- The number that goes up
- Coverage is a cross-product, not a list of scenarios — every check you confirmed, crossed with what it ran against. It has a size and a remainder, and the remainder is printed worst first.
Harms, not rules
“Must not call the booking tool twice” invites an argument about whether that is fine for you. The customer is booked twice for one request does not. Each entry carries what it costs, why it happens, and where it has been seen. Six of them are below — four from agents people talk to, two from agents that quietly do a job.
The customer is booked, charged or ticketed twice for one request.
A slot taken from somebody else, and a customer who stops trusting confirmations — which costs more than the duplicate, because they start checking everything.
acts-again-on-repeatThe customer is told something was done — a refund issued, an email sent — and it never happened.
They stop looking for another route, because they believe it is in hand. A refund that never arrives is found weeks later, by which point it is a complaint.
claims-without-callingSomeone’s account is changed, or their data deleted, without anybody establishing who was asking.
Anyone who can talk to the agent can talk to it as anyone else. Usually discovered by the person it was done to.
acts-before-identifyingThe customer leaves without the thing they came for, having been politely declined at every turn.
Invisible to every other check, because an agent that refuses everything breaks no rules at all. Refusal is the cheapest way to look safe.
refuses-everythingWork the agent finished unattended was wrong, and a person downstream had to find it and do it again.
The saving the agent was bought for, given back with interest. Checking every record costs more than doing the work did — so nobody checks every record, and the ones nobody checks are the ones that reach somebody.
a-person-had-to-correct-itA number, a date or a reference appears in the output that is nowhere in what the agent was given.
Producing nothing is not a shape the output allows, so something plausible is produced instead. It looks exactly like the ones that are right, which is why it survives review.
a-value-nobody-supplied
refuses-everything is the one nothing else looks for. Every rule says what must not happen, and an agent that does nothing satisfies all of them. The last two are for agents nobody talks to — where the harm lands on whoever picks the work up afterwards, which is usually days later and usually a person.
Five answers, and only one of them is a pass
A check that did not run is not a check that passed. Reporting any of the other four as success spends your trust on a test that never happened.
breachIt happened, with the evidence.cleanThe check ran properly and nothing was wrong.the only passnotReachedThe run never got far enough to tell.blindNothing could be seen — no tool calls, or a query that examined nothing.noBaselineA number was read, with nothing yet to compare it against.
This is not theoretical. A query naming the wrong collection returns zero rows and reads as a clean bill of health; a conversation that never books anything breaks no rule about booking twice. Both are reported as passes by tools that only have one answer for them.
What never leaves your machine
Some of Optimus's own reasoning runs on our side, so a little does reach us. It is worth being exact about what.
Stays on your machine
- Your source, and every prompt in it
- Your tool names — they are your business logic
- Your database, and every row in it
- Your provider keys and environment
- Any conversation Optimus did not itself ask you to drive
- Everything in .optimus/, including verbatim transcript text
Reaches us
- The findings, and the evidence behind them
- The probe conversations Optimus itself asked you to drive
- Counts — how many, of what kind, how long a run took
- Your reason for rejecting a finding, once your machine has checked it carries none of your names
Nothing is stored at either end, and nothing here asks you for a second credential — one Optimus key is the whole of it, and nothing else to configure. You agree to the list above when you take that key. What we store and why
One line, then ask your editor to test your agent.
A key is free and takes a minute. It authorises nothing — the checks work on a laptop that has never signed in — it is what joins a machine’s history to your workspace.