mo-qa Skill for Claude Code: What It Does and How to Install It

Makes Claude run bug bashes with Mo, Momentic's hosted QA agent, using the qa CLI: brief it, follow it, answer it, export the report.

Installs: 23.2K; on skills.sh
Stars: 16; on GitHub
Files: 10; besides SKILL.md
Updated: Oct 2026; last repo commit

This skill makes Claude drive Mo, a QA agent that runs a browser in a hosted sandbox. Claude installs and signs in to the qa CLI, writes a brief, starts a session, polls its status, answers Mo's questions, then exports a report and stops the session.

It can test a GitHub PR, reach a local app through a tunnel, and recheck bugs after you fix them. It needs a Momentic sign-in and the qa CLI.

Good for

Developers who want a hosted QA pass on a PR, a preview or staging
QA leads running bug bashes and tracking findings to a fix

Install mo-qa

Claude Code

Copy this prompt.

Install the mo-qa skill in Claude Code. Run this command:

/plugin marketplace add momentic-ai/skills
/plugin install momentic@momentic

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

The plugin route installs all 6 skills (skills/*/SKILL.md in the repo tree) and registers two local MCP servers from .mcp.json, which mo-qa does not use. The skill runs the qa CLI, so install it with the qa CLI method below and run qa login. The README calls the CLI mo and its install command is mo skills; SKILL.md and its references call it qa and say older installs can still be named mo. It runs CLI commands in a shell, so there is no Claude app upload route.

From the project README. Source.

What's in the skill

When it loads

Run and control Mo QA sessions with Momentic's `qa` CLI. Use for bug bashes, status checks, report export, replies to Mo, file transfer, or repairs based on Mo findings.

Sections in SKILL.md

Workflow at a glance
Prepare the brief
Start the session
Follow the session
Read and answer Mo
Work while Mo runs
Finish

Key facts

Author: Momentic (vendor's own repo)
License: None stated: the repo has no LICENSE file and its plugin manifests list no license
Installs on skills.sh: 23,214 (Nov 2, 2026)
GitHub stars: 16 for the whole repo (Nov 2, 2026)
Last repo commit: Oct 28, 2026
Audits on skills.sh: Gen Agent Trust Hub: pass, Socket: pass, Snyk: warn
What it includes: 11 files including SKILL.md: agents/openai.yaml and 9 reference guides (from the repo tree)
Needs: The qa CLI (installed with the Momentic installer) and a Momentic sign-in; the commands in SKILL.md also use jq
Part of: The Momentic plugin: 6 skills (skills/*/SKILL.md in the repo tree) and 2 local MCP servers listed in .mcp.json
Upstream sync: The README says a bot copies most files in skills/ from an upstream source, so edits made in the repo are overwritten

What it includes

qa version, qa upgrade, qa login (or MOMENTIC_API_KEY in CI)
The installer writes qa to $HOME/.local/bin; login saves the key in ~/.momentic/auth.json.
Runs code · Install and sign in
Target URL, goal, sign-in method, test data, things Mo must not do
Facts, not a test plan. Effort is low (15 min), medium (30), high (60) or max (120).
Try: “Run a bug bash with Mo on https://staging.example.com, test accounts only, no payments”
Write the brief
Starts a session and returns a session id and a web link
Options include --effort, --pr, --url, --patch, --tunnel, --environment, --env-file and --env-var.
Runs code · qa start
qa status --full about every 30 seconds; qa read and qa wait
Stops after 3 failed status calls or twice the effort's testing time.
Runs code · Follow the session
qa send answers a question card; --question-id picks one
Mo can ask for access, a decision or an answer; Claude never invents or reveals a secret.
Runs code · Answer Mo
qa tunnel start localhost:3000, then qa tunnel stop
Exposes only the address you name so Mo can reach a local or private app.
Runs code · Tunnel to a private app
qa start --pr <url> [--url preview] [--patch file]; qa upload
Patches are text-only Git diffs of at most 256 KiB, and the PR session posts a GitHub comment.
Runs code · PR and source context
qa report --output <dir>, qa bugs describe, qa bugs fix
Then qa stop --subagents to end spending. Bug fixes happen only if you asked for them.
Runs code · Report and fixes

From the official docs

Permissions

High risk

This skill sends your brief, secrets you pass, patches and a tunnel to Momentic's hosted QA agent, and it posts to GitHub in PR mode. Our advice: pass only the env values Mo needs, expose only the address under test, and stop the session when you finish.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

A tunnel exposes your local app to Mo
qa tunnel start localhost:3000 opens a tunnel so Mo can reach a private target. The reference says to expose only the required address, to stop the tunnel after the last session, and not to expose more if setup fails. github.com
Secrets and source can leave your machine
Env files and --env-var values are passed to Mo at session start, and a source snapshot or patch can be uploaded. The references say to exclude .env files, keys and tokens, review every hunk, and never put secrets in a brief or message. github.com
PR mode posts to GitHub
Each PR session posts a GitHub comment with its session link and updates it with the results. A new session collapses older Mo comments as outdated. github.com
Sessions run for minutes and use sub-agents
Effort sets testing time (15 to 120 minutes) and up to 10 to 40 sub-agents. SKILL.md says to end spending with qa stop --subagents, even if the export failed. github.com
The installer is a downloaded script
references/installation.md installs the qa CLI with curl -fsSL https://cli.momentic.ai/qa | sh, which writes qa to $HOME/.local/bin. github.com
Mo can test real actions in your app
The brief example lists what Mo must not do, such as submitting payment, sending email or deleting data. Our advice: write those limits into every brief and use test accounts. github.com
The plugin route adds two local MCP servers
The plugin route installs the repo's .mcp.json, which starts momentic and momentic-mobile with npx -y. The repo tree has no hooks. Two skills (mo-qa and momentic-spec) bundle an agents/openai.yaml that holds a display name, a short description and a default prompt. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details

Turning on read-only	SKILL.md describes no read-only mode.
Talks to	cli.momentic.ai (qa installer). Momentic hosted sandbox and web app (session link). GitHub (PR sessions post and update a comment)
Sign-in and keys	qa login saves the API key and server URL in ~/.momentic/auth.json. In CI, MOMENTIC_API_KEY overrides the saved login (references/authentication.md).
Scopes	Runs the qa CLI in your shell (start, status, read, send, wait, report, stop, bugs, tunnel, upload) Installs the qa CLI with a downloaded script Writes a report folder, and can change your app code only when you ask for bug fixes Can upload a reviewed source snapshot or patch and pass env files or variables to Mo

Questions

What does the mo-qa skill do?

It makes Claude run Mo, Momentic's hosted QA agent, with the qa CLI. Claude writes a brief, starts a session, polls it, answers Mo's questions, exports the report and stops the session. It can also test a GitHub PR and recheck bugs after fixes.

How do I install it?

Use the install box at the top of this page. Install the skill with the plugin or the skills CLI, then install the qa CLI with the qa CLI method and run qa login. The README calls the CLI mo, while SKILL.md calls it qa.

Do I need a Momentic account?

It needs a Momentic sign-in. qa login saves the API key in ~/.momentic/auth.json, and in CI MOMENTIC_API_KEY overrides it.

Is it an official Momentic skill?

Yes. It lives in Momentic's own repo, momentic-ai/skills, and the plugin manifest names Momentic as author. The README says a bot copies most skill files from an upstream source, so Momentic asks outside contributors to open an issue instead of a pull request.

Is it safe?

It starts a hosted QA session that can reach your app through a tunnel, receive env values you pass, and post a comment on a GitHub PR. It runs a downloaded installer for the qa CLI. Our advice: use test accounts, list what Mo must not do in the brief, and stop the session when you finish.

Does it work in Cursor or Codex?

The README documents a Cursor plugin from the Cursor Marketplace and a Devin plugin. It also says install-mcp writes the MCP server entry for Claude Code, Cursor, VS Code, Codex, Windsurf and other clients. The skill files are plain SKILL.md, so the skills CLI can install them in other agents.

Is the CLI called mo or qa?

The README describes the mo CLI and mo skills. SKILL.md and its installation reference call the command qa and say older standalone installs can still be named mo.

Does Mo run on my machine?

SKILL.md says Mo runs browser QA in a hosted sandbox and that its files and processes are remote. For a local app you start a tunnel so Mo can reach it.

How long does a session run?

It depends on --effort: low is 15 minutes with up to 10 sub-agents, medium (the default) 30 and 20, high 60 and 30, max 120 and 40.

Information

updated Nov 2, 2026

Repository: momentic-ai/skills
Folder: skills/mo-qa

momentic-ai/skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 11

README · github.com
.mcp.json · github.com
marketplace.json · github.com
mo-qa SKILL.md · github.com
mo-qa authentication.md · github.com
mo-qa tunneling.md · github.com
mo-qa source-context.md · github.com
mo-qa installation.md · github.com
mo-qa brief.md · github.com
mo-qa session-control.md · github.com
mo-qa browser-settings.md · github.com