Skip to content

Add OrcaReplay to LLM & MCP Testing #117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cleder merged 1 commit into from
Sep 15, 2026
+1 −0
Merged

Add OrcaReplay to LLM & MCP Testing #117

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ Collection of awesome Python resources for testing and generating test data.
## LLM & MCP Testing

- [mcp-server-fuzzer](https://github.com/Agent-Hellboy/mcp-server-fuzzer) - A comprehensive fuzzing tool designed specifically for testing Model Context Protocol (MCP) servers. It supports both tool argument fuzzing and protocol type fuzzing across multiple transport protocols.
- [OrcaReplay](https://github.com/Continuum-AI-Corp/OrcaReplay) - Records a Python agent's calls to its model provider from outside the process, then serves the recording back so the same run happens again with the provider unreachable and no key. Turns a failed session into a regression test. Apache-2.0.

@sourcery-ai sourcery-ai Bot Sep 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 issue (security): The entry describes replay as making the same run happen again without warning that recorded tool calls execute for real; a user treating replay as an offline or safe regression run will still trigger side effects such as a recorded curl reaching the network.

Triggers: When a recorded agent run contains tool calls with external side effects.

Suggested fix: State that replay only blocks model-provider access and that recorded tools, including network calls, still execute normally.

Suggested change
- [OrcaReplay](https://github.com/Continuum-AI-Corp/OrcaReplay) - Records a Python agent's calls to its model provider from outside the process, then serves the recording back so the same run happens again with the provider unreachable and no key. Turns a failed session into a regression test. Apache-2.0.
- [OrcaReplay](https://github.com/Continuum-AI-Corp/OrcaReplay) - Records a Python agent's calls to its model provider from outside the process, then serves the recording back so the same run happens again with only model-provider access blocked; recorded tools, including network calls, still execute normally. Turns a failed session into a regression test. Apache-2.0.

- [Sabot](https://github.com/Jott2121/sabot) - Plants controlled faults inside running multi-agent pipelines (LangGraph, CrewAI, AutoGen) and scores whether each pipeline's own reviewer and guardrail stages detect them. Pre-registered spec, deterministic adjudication, published raw traces.
- [Tenro](https://github.com/tenro-ai/tenro-python) - An open-source, provider-agnostic testing framework for AI agents that integrates with pytest. It simulates LLM and tool calls to test edge cases, failure paths, and agent logic without live API calls.

Expand Down