AI Agent Project Setup: Prerequisites and a Safe Local Environment

A good AI agent project setup prevents problems that are painful to fix later. This is Phase 0 of the project. You will check your tools, create a working folder and decide how secrets will be handled, all before writing any agent code.

---

💡 AI Agent Project Setup Checklist

Tool	Why you need it
Node.js LTS and npm	Runs TypeScript tools and Playwright
Visual Studio Code	Edits TypeScript comfortably
Git	Lets you review and undo changes
Playwright	Runs the browser tests
An API key	Only needed from Lesson 67, for a real model

Use the current LTS release of Node.js. This project was tested with Node.js 26. Check your tools with these commands.

node --version
npm --version
git --version

---

🔍 Create the Project Folder

mkdir qa-automation-ai-agent
cd qa-automation-ai-agent
git init
npm init -y
npm pkg set type=module

The last command tells Node.js to treat your files as modern ES modules. New to Git? See the Git and GitHub tutorial.

---

🧩 Create a Safe Environment File

Create .env.example. This file is a safe template with no real secrets, so it can go into Git.

LLM_PROVIDER=mock
LLM_MODEL=replace-with-supported-model
LLM_API_KEY=
BASE_URL=http://127.0.0.1:4321
HEADLESS=true
ALLOW_TEST_EXECUTION=false
TEST_USER_EMAIL=demo@example.test
TEST_USER_PASSWORD=Demo-Pass-123

Then copy it to a private file.

cp .env.example .env

On Windows Command Prompt, use copy .env.example .env.

The defaults are deliberately safe. The model is a mock, and ALLOW_TEST_EXECUTION is false until you turn it on. The account belongs to a small demo page that you will create in Lesson 58, and it works nowhere else.

---

🛠️ Keep Secrets Out of Git

Create .gitignore.

node_modules/
.env
artifacts/
reports/
playwright-report/
test-results/

Confirm that Git is ignoring the file. This command should print .env.

git check-ignore .env

---

📌 Choosing a Target to Test

Only automate systems that you are authorised to test. Shared demo websites are also real systems, and an automated agent can create a lot of traffic. A local demo avoids that problem completely. For more safety rules, see AI Data Privacy for Testers.

---

🌍 Real-Life Example: The Key in the Commit

A tester pastes a real API key into a config file to save time, then commits it. Automated scanners find it on a public repository within hours, and the bill arrives soon after. Five minutes spent on .env and .gitignore would have prevented it.

---

🧪 Try It Yourself

1. Run the three version commands and record the results.
2. Create the folder and both files.
3. Run the git check-ignore command.
4. Write down your tool versions in a README.md.
5. Ask the prompt below to review your setup.

---

📋 Ready-to-Copy Prompt

You are a careful DevOps mentor helping a software tester.

My operating system: [Windows, macOS or Linux]
Output of node --version, npm --version and git --version:
[paste output]

My .gitignore:
[paste it]

Check that my tools are suitable for a TypeScript and Playwright project,
and that my secrets are protected.

Do not ask me to paste real secrets. Give exact commands for my system.

---

⚠️ Common Mistakes

• Skipping the version check
• Putting a real key in .env.example
• Committing .env even once
• Using a real account for test logins
• Pointing the project at a site you may not test

---

🎯 Key Takeaways

• Finish Phase 0 before writing any code.
• Keep a safe template and a private environment file.
• Default settings should be the safest ones.
• Test only what you are authorised to test.

---

🎤 Interview Questions

1. How do you manage secrets in a test automation project?

Model answer: I keep them in environment variables or a secrets manager, ignore the .env file in Git and provide a safe template. In CI, I use the platform’s secret store.

2. What would you do if an API key was committed?

Model answer: I would treat it as compromised and revoke it immediately, then issue a new one. I would also check usage logs and clean the history if needed.

3. Why provide a .env.example file?

Model answer: It documents which settings are needed without exposing real values. A new team member can copy it and fill in their own.

4. Why use synthetic test accounts?

Model answer: They avoid exposing real personal data and limit the damage if something leaks. They can also be reset without affecting anyone.

5. Why should safe defaults matter in an AI agent?

Model answer: A forgotten setting should never cause harm. If execution is off by default, a mistake results in a stopped run rather than an unwanted action.

---

📝 Assignment

Finish the setup, and add a README.md with your tool versions and approved test target. Commit the project, then confirm with git status and git log that .env is not included.

---

❓ FAQ

Which AI model should I choose?

You do not need one yet. Lesson 67 explains how to choose and connect one safely.

npm warned me about install scripts. Is that a problem?

Newer npm versions can block package install scripts and warn you. The project still ran correctly in our testing, so read the warning and continue only if the packages are the ones you expected.

---

🚀 Next Steps

Well done on finishing this lesson. Complete the assignment, then continue with AI Agent Project Structure: Repository, Scripts and TypeScript Setup.