Show HN: Dochia – automated API testing for agentic build-test-fix loops (opens in new tab)

(dochia.dev)

2 pointsludovicianul1mo ago1 comments

I've enhanced Dochia with the ability to generate agent skills. Being a CLI already, it makes it really simple to plug it into agentic workflows.

Run `dochia init-skills` and the coding agent(s) can trigger tests as it builds:

  1. Agent writes endpoint and the OpenAPI spec (or that get's generated from code)
  2. Agent runs: dochia test -c api.yml -s localhost:3000
  3. Dochia produces dochia-summary-report.json + per-endpoint test files
  4. Agent reads errors, fixes code, re-runs
  5. Loop

The JSON output is structured specifically so agents can read and act on it directly, not just humans parsing logs.

It's a native binary (GraalVM), so it's fast on all platforms.

Would love feedback on: is it something you will integrate into your flow, which test playbooks are missing, whether the report format is actually useful in agentic loops, any edge cases you'd expect a tool like this to catch?

GitHub: https://github.com/dochia-dev/dochia-cli Docs: https://docs.dochia.dev

For background, Dochia takes your OpenAPI spec and runs 120+ test playbooks: deterministic negative and boundary scenarios plus chaos testing. No test cases to write, no configuration beyond pointing it at your OpenAPI spec and a running server.

1 comments

yohann_senthex1mo ago

Solid approach on the agent readable JSON. The real value here isn't just "catch bugs faster" it's that agents can now run comprehensive negative testing as part of the build loop, which is increasingly critical with agentic workflows.

One angle worth exploring: injection attacks. When Dochia fuzzes your endpoints, does it specifically test for prompt injection vectors if the API backend is an LLM? Most security tools miss that because they're generic but if an agent is writing an API that wraps Claude or GPT, you'd want fuzzing that includes things like "what if the user input gets templated into a system prompt?"

Same with token limits if the fuzzer generates massive payloads, does it distinguish between "API can't handle large inputs" vs "you'll bankrupt the user with token costs if this endpoint is exposed"?

Might be niche, but seems like low hanging fruit in the agentic testing space.

j / k navigate · click thread line to collapse

1 comments

yohann_senthex1mo ago

Might be niche, but seems like low hanging fruit in the agentic testing space.

j / k navigate · click thread line to collapse