Yes. The README directly documents this dual-Judge configuration and says it costs less than a full Sonnet run.

• The recommended setup uses google/gemini-2.5-pro and openai/gpt-5.4-mini, both through one OpenRouter key.
• It is labeled “More affordable,” with an estimated full-suite total of about $10–14, compared with roughly $12–18 for a single Sonnet Judge.
• Multiple Judges avoid letting one model or vendor determine the grade; conflicts are resolved conservatively in the order fail > partial > pass.
• Full mode requires a hand-built fixture and the full suite makes roughly 2,000 Judge calls; the tested Agent is billed separately.

The cost is an estimate based on mid-2026 OpenRouter list prices, so actual spending can vary with model pricing, fixture size, and retries. The README does not explain whether item-level Judge disagreements are exported in detail.

Yes. Policy Lab explicitly combines harmful-action-sequence discovery with verification of legitimate completion goals.

• Quick start describes Policy Lab as finding the shortest harmful sequences of permitted actions and checking whether permission repairs still satisfy legitimate completion goals.
• The README includes an offline refund-store example and explicit local-callable replay, giving the refund scenario a directly relevant reference.
• The default 10 inspections include B01 role/tool authorization, B08 user-permission inheritance, and P01 unauthorized destructive actions; all three are mandatory minimums.
• Testing can target a real Agent endpoint or use a fixture to describe roles, tools, permissions, policies, and task goals, making refund rules explicit.

However, a refund system with real external side effects should not be connected to production accounts. The README does not state how Policy Lab handles asynchronous refunds, database transactions, or third-party payment rollback.

Yes. The default 10-inspection run covers all three risk areas, but it is not a complete security proof.

• B01 checks that a role uses only permitted tools, while B08 checks that the Agent cannot be persuaded to obtain more access than the user has; both are mandatory minimums.
• B12 checks prompt injection and B27 checks that one user’s private data is not given to another; both are part of the default essential suite.
• The README recommends anthropic/claude-sonnet-4.6 as “Single judge: Sonnet,” with an estimated full-suite cost of about $12–18.
• The default run performs roughly one-sixth of the full call volume and still produces a grade, but it contains only 10 inspections; the full suite contains 60.

If the Agent does not expose its tool-authorization layer, B01 and P01 conclusions are limited; a textual refusal cannot fully prove that no tool was executed. The README also does not provide Sonnet’s false-positive rate for domain-specific edge cases.

Yes. The explicit CLI mode is designed for CI, automation, and audit-ready scripted batches.

• The README lists “CLI: explicit flags” as best for “CI, automation, audit-ready scripted batches,” avoiding interactive setup.
• The target may be any provider or the Agent’s real endpoint, so an OpenAI provider or a custom Agent can be tested.
• Outputs include JSON, Markdown reports, and a terminal scorecard; JSON is the machine-readable source of truth and fits CI artifacts.
• The default run performs 10 inspections. --full-run expands coverage to all 60, but roughly 5,500 Agent calls and 4,700 Judge calls make it substantially slower and more expensive.

For meaningful version comparison, fixture, Judge, suite, and configuration should remain fixed. The README does not provide a ready-made CI platform template.

Yes. Plugin or Skill mode is specifically designed for guided execution inside an existing Agent environment.

• The README says the Agent acts as “the operator”: it discovers the setup, builds the fixture, runs the tests, and explains the scorecard.
• Plugins are available for Claude Code and Codex; the listed Skill-compatible environments also include Cursor, VS Code, Windsurf, Cline, Continue, Gemini, and Zed.
• Plugin and Skill entry points use the same diagnostic engine as the CLI, avoiding separate evaluation logic.
• Results are delivered as an interactive artifact with JSON as the source of truth, plus a static-report fallback.

This is not completely configuration-free: the tested Agent’s provider, endpoint, credential environment variables, and accurate business roles, tools, and permissions are still required. The README does not provide a compatibility matrix for every client version.

It depends. iFixAi can test a real Agent endpoint and the default checks cover these conversational behaviors, but depth depends on whether the endpoint exposes tools and state.

• B06 checks whether the Agent expresses uncertainty instead of confidently guessing; B16 checks failure reporting instead of pretending success; B18 checks task-boundary adherence.
• The README says the target can be “your agent’s real endpoint,” so the Agent need not be implemented in Python. Python is the CLI’s main language, not a stated requirement for the tested system.
• Most of the default 10 inspections only require the Agent to answer chat messages, which fits a chat-only interface.
• However, B01 and P01 read the tool-authorization layer. If the endpoint does not expose it, those results are limited and cannot prove actual authorization safety.

The README does not specify requirements for custom-endpoint protocols, authentication, streaming responses, or asynchronous tasks, so language alone cannot establish integration feasibility.