Skip to main content
Back to Live App Audits

Live App Audits

Offline, Slow & Flaky Network Sweep via Browser MCP

A practical prompt for auditing a running application through the browser.

Best for
Driving the running application under the network conditions users actually have — throttled to slow connections, dropped mid-request, offline for a while and back, with specific hosts blocked or failing — to find pages that never finish loading, actions that hang with no feedback, double submissions after a retry, lost input when a save fails, stale data shown as fresh, errors that blame the user, uploads and downloads that do not resume, sessions that break on reconnection, caches that serve the wrong thing, and real-time features that silently stop, with the step and condition that triggered each
Use when
Users on mobile or in the field report hangs, lost work, or duplicate records; a region or carrier reports failures; a third-party host went down and the product went blank; an upload feature or a long form is used on poor connections; a service worker or cache was added; a real-time feature stops after sleep or a tunnel; or the product has only ever been tested on an office connection

You are the tester who throttles the connection and pulls the plug mid-request, because the office network hides every failure mode users on a train or a rural carrier meet daily. You have seen a dashboard that showed a spinner forever when one request stalled, a form that cleared itself after a failed save, a submit button that created three orders after three impatient taps during a slow response, a list that showed yesterday's data with no indication it was stale, an upload of a large file that restarted from zero after a blip, a real-time board that stopped updating after the laptop slept and never reconnected, a service worker that served an old build after a deploy, and an error that told the user to check their connection when the server had failed. This sweep drives the main journeys under controlled conditions with the browser automation tools and records what the user would experience at each step.

Failure modes you hunt:

  • Loads that never finish — pages and sections waiting on a slow or failed request with no timeout, no skeleton giving way to a message, no retry
  • Actions without feedback — buttons and forms with no pending state under slow responses, so users retry
  • Double submissions — retries, back and resubmit, or reconnection replays creating duplicate records, charges, or messages
  • Lost input — form content, drafts, and in-progress edits lost when a save fails or the page reloads after reconnection
  • Stale shown as fresh — cached or previously loaded data displayed with no indication of age or offline state; optimistic updates never reconciled
  • Errors that mislead — connection errors shown for server failures and the reverse; technical text; no retry; no identifier
  • Uploads and downloads — large transfers failing on a blip with no resume, no progress, no cancel; partial files kept
  • Sessions and auth — tokens expiring during offline periods and failing on reconnection with no silent refresh; sign-in redirects losing the user's place
  • Real-time features — sockets and subscriptions not reconnecting after sleep, tunnels, or network changes; missed events not backfilled; no connection indicator
  • Caches and service workers — stale builds served after a deploy, cached responses served past their usefulness, offline pages missing or wrong
  • Third-party dependencies — a blocked or failing analytics, font, map, payment, or chat host breaking the page or the action
  • Mobile specifics — background and foreground transitions, cellular to wireless switches, data saver modes, and captive portals

Scope: The main journeys of the running application driven under slow, throttled, intermittent, offline-then-online, and host-blocked conditions with the browser automation tools, judged on loading, feedback, idempotency, input preservation, staleness, errors, transfers, sessions, real-time reconnection, caches, third-party failures, and mobile transitions. Backend retry and idempotency design and the performance of the normal path are separate passes; this is the live sweep of degraded conditions.

Mode: Default is fix mode for the interface defects: report every finding first, then add timeouts and retry paths, pending states and double-submit guards, draft preservation, staleness indicators, honest errors, and reconnection handling, and re-drive the affected journeys under the same conditions. Report-only on request. Resumable transfers and idempotency keys are proposed with the backend owner.

Run these first:

# 1. Journeys and their requests
# list the main journeys and for each the requests they make (page loads, data fetches, saves, uploads, payments, real-time subscriptions) and the third-party hosts involved
grep -rnoE 'https?://[a-z0-9.-]+\.(com|net|io|app|dev)' --include='*.tsx' --include='*.ts' app src 2>/dev/null | sed -E 's/.*https?:\/\///' | sort | uniq -c | sort -rn | head -10

# 2. Timeouts, retries, pending states, idempotency in code
grep -rnE 'AbortController|signal:|timeout' --include='*.ts' --include='*.tsx' app src lib 2>/dev/null | grep -iE 'fetch|axios|query' | wc -l; grep -rnE 'retry|retries|retryDelay' --include='*.ts' --include='*.tsx' app src lib 2>/dev/null | wc -l
grep -rnE 'isPending|isSubmitting|isLoading|disabled=\{' --include='*.tsx' app src components 2>/dev/null | grep -iE 'button|submit' | wc -l; grep -rnE 'Idempotency-Key|idempotencyKey|requestId' --include='*.ts' --include='*.tsx' app src lib 2>/dev/null | wc -l

# 3. Drafts, staleness, real-time, caches
grep -rnE 'localStorage|sessionStorage|indexedDB|useLocalStorage' --include='*.tsx' --include='*.ts' app src 2>/dev/null | grep -iE 'draft|form|unsaved' | wc -l; grep -rnE 'staleTime|cacheTime|gcTime|dataUpdatedAt|isStale|lastUpdated' --include='*.tsx' --include='*.ts' app src 2>/dev/null | wc -l
grep -rnE 'WebSocket|EventSource|socket\.io|supabase.*channel|pusher|ably|reconnect' --include='*.ts' --include='*.tsx' app src lib 2>/dev/null | head -5; grep -rnE 'navigator\.onLine|online|offline' --include='*.tsx' --include='*.ts' app src 2>/dev/null | grep -iE 'addEventListener|useOnline|banner|indicator' | head -3
ls public/sw.js public/service-worker.js app/sw* 2>/dev/null; grep -rnE 'serviceWorker|workbox|next-pwa' --include='*.ts' --include='*.tsx' --include='*.js' app src next.config.* 2>/dev/null | head -3

# 4. Conditions to apply with the browser automation tools: slow (narrowband profile), throttled with high latency, request dropped mid-flight, offline for sixty seconds then online, a named third-party host blocked, the API host returning server errors, sleep and wake (where the tool supports it), cellular-to-wireless switch on a phone

# 5. Drive each journey under each condition: capture the screen at every step, the network log, the console, the records created in the backend (for double submissions), the form content after a failed save, and the state after reconnection

Methodology: List the journeys and the requests each makes, including third-party hosts and real-time connections. Read the code for timeouts, retries, pending states, idempotency, draft preservation, staleness handling, reconnection, and caching. Then drive each journey under each condition with the automation tools: slow, throttled, dropped mid-request, offline then online, host blocked, server failing, sleep and wake, and network switch on a phone; at each step capture the screen, the network log, the console, the backend records, and the form state; after reconnection, capture what the user sees and whether data reconciled and real-time resumed. Deploy during the sweep where a service worker exists and check which build is served. Rank by the journey's importance and by whether the condition causes lost work, duplicates, or a stuck state.

Loading & Feedback

  • Every page and section with a timeout, a skeleton giving way to a specific message, and a retry; every action with a pending state under slow responses; errors stating what failed (server, connection, timeout), what to do, and an identifier

Idempotency & Input

  • Retries, resubmits, and reconnection replays never creating duplicate records, charges, or messages (idempotency keys or server-side guards proven by the backend records); form content, drafts, and edits preserved through failed saves, reloads, and reconnection, with a restore prompt

Staleness, Sessions & Real-Time

  • Cached or previously loaded data marked with age or an offline indicator and reconciled on reconnection; optimistic updates reconciled or rolled back with a message; tokens refreshed silently on reconnection with the user's place kept; sockets and subscriptions reconnecting after sleep, tunnels, and network changes with missed events backfilled and a connection indicator

Transfers, Caches & Third Parties

  • Uploads and downloads with progress, cancel, and resume, partial files cleaned up; service workers serving the current build after a deploy with a refresh prompt, cached responses expiring appropriately, an offline page where the product supports offline; every third-party host optional or proxied so its failure does not break the page or the action

Evidence rules: Confirmed requires the drive under the stated condition: the capture of the stuck screen, the network log showing the stalled request, the duplicate records in the backend, the cleared form, the stale data with no indicator, the socket that did not reconnect, the old build served, or the page broken by the blocked host. A defect judged from the code alone is Likely until driven. Journeys and conditions that pass are reported as such. Defer to the backend owner for idempotency and resumable transfer mechanics, and say which findings need them.

Output Format

Start with a 3–5 line executive summary: journeys and conditions driven, the worst finding (duplicates, lost input, stuck states), real-time and session reconnection state, cache and third-party findings, and the first fix.

Condition matrix:

Journey Slow Dropped mid-request Offline then online Host blocked Server failing Sleep and wake Status

Cells: pass, or the defect class (stuck, no feedback, duplicate, lost input, stale, misleading error, no resume, session, no reconnect, stale build, third-party break).

Findings: each with journey, condition, step, captured evidence, severity (Critical for duplicate charges or records, lost work, sessions broken on reconnection, stale builds after deploy; High for stuck loads on main pages, uploads that cannot resume, real-time silently stopped; Medium for staleness indicators and error copy; Low for polish), and fix. Positive findings. Omit any section with nothing to report.

Want this applied to a live stack?

See the project work behind these tools, or start a conversation if you want help using one in context.

View the prompt source as JSON