Autotest

Every uploaded version is tested in a real browser before it can be submitted. You can run the same test locally first: gamealia test or the MCP tool gamealia_run_autotest.

What it does

Static analysis of the files, before running anything: missing files, localhost and http:// URLs, incomplete engine exports, and security rules (other games' storage, cookies, the portal page, remote code, undeclared hosts, permissions, service workers, miners, obfuscation).
Two browser runs in headless Chromium: desktop 1280x720 and mobile 390x844 with touch. Each run loads the game inside a copy of the portal frame, waits up to 15 s for loadingStop(), takes a screenshot at 5 s, clicks or taps the screen, presses Space and Enter, answers ad requests with mock ads, and watches the console and the network.
A runtime audit during both runs: every request and WebSocket, popups, top-page navigation attempts and permission prompts. The test seeds fake "other game" data in storage and a fake cookie; if either leaves the game, the build fails.

The result is pass, warn or fail. A failed required check fails the version; warnings are allowed, and the reviewer sees them. Locally you get the report and the screenshots; on the server the report appears in the version page, in gamealia status and in gamealia_get_status.

Checks

Check	Required	What it verifies and how to fix it
`unpack`	yes	The zip unpacks. Upload a normal zip of the build folder (the CLI and MCP make it for you)
`size`	yes	At most 250 MB and 5000 files. Remove unused assets; compress textures and audio
`entry`	yes	`index.html` is at the root. Upload the build folder itself, not its parent
`missing_assets`	yes	Every file the html, js and css reference exists. Paths are case-sensitive
`engine_integrity`	yes	Unity, Godot and GameMaker exports have all their engine files. Upload the whole export
`localhost_refs`	yes	No `localhost` or `127.0.0.1` URLs. Use relative URLs
`mixed_content`	yes	No `http://` loads. Use `https://` or relative URLs
`network_blocklist`	no	No requests to blocked hosts (ad networks, trackers, miners)
`no_external_ads`	yes	No ad code that is not Gamealia's. Use `Gamealia.ad.*`
`security_miner`	yes	No crypto-miner code
`cross_game_storage`	yes	No reading or listing of other games' `localStorage` or IndexedDB keys. Use your own prefixed keys or `Gamealia.data`
`cookie_access`	yes	No `document.cookie`. Use `Gamealia.data`
`parent_access`	yes	No access to `window.parent` or `window.top`. Talk to the portal only through the SDK
`remote_code`	yes	No `eval`, `new Function` or script injection of code downloaded at runtime
`runtime_exfiltration`	yes	The seeded fake data never left the game
`exfiltration`	no	The code only talks to declared hosts. Declare your servers in `backendHosts`
`undeclared_hosts`	no	At runtime the game only contacted declared hosts
`permissions`	no	No permission prompts, except microphone or camera the listing declares (Device permissions)
`service_worker`	no	No service worker registration
`obfuscation`	no	Code is not heavily obfuscated. Minified is fine
`sdk_loaded`	yes	The Gamealia SDK (or a shim) is loaded
`sdk_init`	yes	`Gamealia.init()` is the first SDK call
`loading_stop`	yes	`Gamealia.game.loadingStop()` is called within 15 s
`no_console_errors`	no	No uncaught errors in the console. `gamealia preview` shows them
`not_blank`	yes	The screen is not blank 5 s after loading. Draw a title screen early
`input_response`	no	A click or tap on the center and Space/Enter change the screen (if not, the largest visible button is tapped too)
`gameplay_start`	no	`gameplayStart()` is called after the first input
`ad_handling`	no	Ad breaks the game requested were shown and finished
`purchase_ui`	no	No purchase screens or "remove ads" buttons
`own_login`	no	No login or account system of the game's own

purchase_ui, own_login and the other warnings do not block the upload, but the reviewer rejects a game that breaks the policy.

Locally

gamealia test            # build, then test; exit code 1 when a required check fails
gamealia test --json     # the full report
gamealia preview --open  # play it yourself inside the portal frame, with mock ads

The screenshots and report.json are written to a temporary folder printed at the end. The local test needs playwright-core and a headless Chromium (Local browser).

With the MCP, gamealia_run_autotest returns the screenshots as images so your assistant can see the game, and gamealia_playtest lets it play the game step by step.

When the server and your machine disagree

The server runs the same checks, with the permissions, backend hosts and isolation of the listing at the time of the upload. If you change the requested permissions, the version is tested again before you can submit it.