AI review agents that build, test, and run your code on every PR.

Zag runs AI agents in real macOS and Linux environments - Xcode, Node, Postgres, and your complete toolchain. Describe agents in TypeScript or Swift that do code review, QA, security, or compliance, and run them on every PR.

Book a demo See how it works

Backed by Y Combinator

zag - PR #47 - 2 agents running

qaAgent

session.build() - succeeded (14.2s)session.install() - iPhone 17 Prosession.launch() - runningsession.codexWithSimulator()Button clipped on iPhone SENo overlapping viewsDynamic Type scales correctly

securityAudit

session.build() - succeededScanning Keychain usage...kSecAttrAccessible set correctlyHTTP endpoint in Config.plistCertificate pinning enabledNo hardcoded API keys

qaAgent.ts - MyApp

Chromium 131Build Succeeded

MyApp

zag

env.ts

qaAgent.ts

securityAudit.ts

codeReview.ts

1234567891011121314151617

import { defineTask } from "@zag/sdk" export const qaAgent = defineTask({ on: "presubmit", given: env, then: async (session) => { await session.build() await session.install() await session.launch("chromium") await session.codexWithBrowser({ url: "/checkout", prompt: "Test checkout at 320px and 1440px.", }) },})

localhost:3000/checkout

MyApp

Secure checkout

Air Max 90 - Triple Black

US 10 - Quantity 1

$120.00

jane@example.com

4242 4242 4242 4242QA Agent - inspecting

Mixed content - /api/stripe loaded over HTTP

zag - PR #47 - 2 agents running

qaCheck

session.build() - succeeded (14.2s)session.install() - deps installedsession.launch("chromium") - launchedsession.codexWithBrowser()Running Codex with Playwright MCP...Navigating to /checkout...Screenshot: checkout_complete.pngCTA clipped at 320px widthNo layout shifts (CLS 0.02)Responsive 320px -> 1440px

securityAudit

session.build() - succeededsession.codex()Scanning env.ts for leaks...No secrets committedScanning network layer...Mixed content in /api/stripeCSP headers enforcedNo known CVEs

Agents

Describe agents for your project.

Write agents in TypeScript or Swift that review your code, test your UI, audit your security, or check App Store compliance. Each one runs in a real staging sandbox, building and running your app.

Pen TestLaunches your app and actively tries to break it. Intercepts network traffic, probes authentication, and attempts to access protected data.

zag[bot] - penTestPen Test - 1 vulnerability CRITICAL: /api/user/profileUnencrypted request with auth tokenover HTTP. Replay attack successful. Certificate pinning verifiedNo data leakage in bg snapshot

Database MigrationRuns your migration against a real database, then hits your API routes with test data. Catches broken queries, missing columns, and type mismatches before they take down production.

zag[bot] - dbMigrationDatabase Migration - 1 issue foundMigration 004_add_billing appliedPOST /api/webhooks/stripe ... 200GET /api/users/profile ... 500column "plan_type" not found in select 12 other routes passed

QA AgentBuilds your app, launches it on every device size, and navigates your key flows. Catches layout issues, clipped text, and broken navigation before users do.

zag[bot] - PR #47 - qaCheckQA Check - 2 issues found PaymentView.swift:47Button clipped on iPhone SE OnboardingView.swift:12Text truncated at Dynamic Type XXL 14 other flows passed

App StoreChecks your app against Apple's review guidelines before you submit. Catches the things that get your app rejected and cost you a week.

zag[bot] - appStoreComplianceApp Store - 1 issue foundInfo.plistMissing NSCameraUsageDescription Privacy manifests presentNo deprecated APIsMin deployment target met

Code ReviewBuilds your project, resolves types, runs your tests, and reviews with full context. Not just reading the diff. Understanding your codebase.

zag[bot] - codeReviewCode Review - 3 commentsPaymentManager.swift:23Closure captures self strongly.Creates a retain cycle. Use [weak self] NetworkClient.swift:41Force-unwrap will crash on 404.

Environment

Create environments with your entire stack.

Zag agents run in real Linux and macOS sandboxes with a local database, queue, server, and other services. Define what you need, and Zag environments boot in milliseconds with cached silicon and Firecracker VMs.

env.ts

import { type Environment } from "@zag/sdk" export const env: Environment = { machine: "ubuntu:24.04", apt: ["node:22", "postgresql@16", "redis"], npm: ["./package.json", "playwright"], setup: async ($) => { await $`npx supabase start` await $`npm run db:migrate` await $`npm run build` }, secrets: ".env.encrypted",}

env.swift

import Zag let env = Environment( machine: .m4, apps: [.xcode(.v16_2)], brew: [.postgresql(16), .redis], setup: { $ in try await Simulator.create(.iPhone16, os: .iOS18_2) try await Simulator.create(.iPadPro13, os: .iPadOS18_2) try await $("createdb testdb") try await $("xcodebuild -resolvePackageDependencies") }, secrets: ".env.encrypted")

Zag agents collaborate with Claude Code.

Every Zag session is a live stream. Your coding agents subscribe, react, and spin up new agents on the fly. Install the GitHub App and they run on every PR.

stream - qaCheck - PR #47build() - succeeded (14.2s)install() - iPhone 17 Prolaunch() - runningButton clipped on SE14 flows passed

01StreamsEvery Zag session produces a live stream. Claude Code and Codex subscribe to it, react in real time, and see what actually happened instead of a flaky test result.

10 sessions - running

iPhone SEiPhone 16iPhone 16 ProiPhone 16 MaxiPad miniChrome 124

02EnvironmentsLet Claude Code create Zag sessions for a feature it's working on to QA test on 10 devices at once.

zag[bot] reviewed just now✓QA Check passed✓Security Audit passed✓Code Review - no issues

03CollaborationInstall the Zag GitHub App. Every pull request triggers your agents automatically on real Apple Silicon or fast Firecracker microVMs.

AI review agents that build, test, and run your code on every PR.

Describe agents for your project.

Create environments with your entire stack.

Zag agents collaborate with Claude Code.

Merge agent-driven changes with confidence.