# Applitools (npm · @applitools/mcp)

The Applitools MCP server helps you create, update, and analyze visual tests using Applitools Eyes.

- Trust score: 61/100 (medium)
- Change this week: +11
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@applitools/mcp`: 61/100 (this document), [markdown](https://verifymcp.io/servers/applitools-applitools/applitools-mcp.md), [page](https://verifymcp.io/servers/applitools-applitools/applitools-mcp)

## Channel facts

- Registry: `npm`
- Package: `@applitools/mcp`
- Version: `0.5.4`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 80/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects sharp 0.34.5, reached via @applitools/core-base > @applitools/image > sharp. A fixed version is available.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (155 of 156), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: the license (SEE LICENSE IN LICENSE) isn't a recognized OSI-approved license.
  - Actively maintained (last published 10 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 57/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (fair).
  - Context-footprint check failed: tool/resource definitions use about 2140 tokens (~267/item across 8 items; 7 tools + 1 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (43% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add applitools-applitools -- npx -y @applitools/mcp
```

### Codex

```bash
codex mcp add applitools-applitools -- npx -y @applitools/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "applitools-applitools": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@applitools/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add applitools-applitools --command npx --arg -y --arg @applitools/mcp
```

### Hermes

```yaml
mcp_servers:
  applitools-applitools:
    command: "npx"
    args: ["-y", "@applitools/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "applitools-applitools": {
      "command": "npx",
      "args": [
        "-y",
        "@applitools/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 61, +4)

- [functional improvement] Stability: unverified → 0.27

### 2026-08-02 (score 57, +18)

- [security regression] GHSA-f88m-g3jw-g9cj affects this package: high
- [security regression] Provenance: unverified → fail
- [security regression] Known CVEs: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional regression] License: unverified → fail
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
- [functional improvement] Schema quality: unverified → fair
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: SEE LICENSE IN LICENSE

### 2026-08-01 (score 39, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-07-31 (score 24, −8)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 32, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 50)

First indexed and scored.

## MCP tools (7)

### `eyes_verify_api_key` (~175 tokens)

Validate your Applitools API key and optional server URL. Searches for API key in .env, applitools.config.js/ts/cjs/mjs, and playwright.config.js/ts/cjs/mjs files.

Input parameters:

- `apiKey` (string): Optional API key to validate (will search config files if not provided)
- `serverUrl` (string): Optional Applitools server URL (defaults to https://eyes.applitools.com)
- `setAsDefault` (boolean): If true, save the validated API key and server URL as the default configuration in cache
- `workingDirectory` (string): Working directory to search for .env and config files (optional, defaults to process.cwd())
- `workspaceRoot` (string): Workspace root to search for .env and config files (optional, defaults to current directory)

### `eyes_setup_project` (~250 tokens)

Get step-by-step instructions to set up a Playwright JS project with Applitools Eyes (Fixtures variant)

[CORE REQUIREMENT: URL INTEGRITY] Playwright visual results return URLs ending in ~~. These are not typos. You are strictly forbidden from stripping trailing tildes from these links. Use markdown [Visual Test results](URL with tildes) for links. Output the raw, verbatim URL string exactly as captured from the test output.

Input parameters:

- `activeFile` (string): Path to the currently active file or folder in the IDE (optional). Used to improve framework detection in Node.js monorepos by finding the nearest package.json relative to the active context.
- `apiKey` (string): Optional API key (will use validated key from session if not provided)
- `projectName` (string): Optional project name
- `workspaceRoot` (string): Workspace root directory (optional, defaults to current directory). If the workspace root is a Node.js monorepo (contains a package.json with a "workspaces" field), ask the user which package they wa…

### `eyes_setup_ufg` (~240 tokens)

Configure Ultrafast Grid (UFG) for cross-browser and cross-device testing

[CORE REQUIREMENT: URL INTEGRITY] Playwright visual results return URLs ending in ~~. These are not typos. You are strictly forbidden from stripping trailing tildes from these links. Use markdown [Visual Test results](URL with tildes) for links. Output the raw, verbatim URL string exactly as captured from the test output.

Input parameters:

- `activeFile` (string): Path to the currently active file or folder in the IDE (optional). Used to improve framework detection in Node.js monorepos by finding the nearest package.json relative to the active context.
- `playwrightConfigPath` (string): Path to playwright.config.js/ts file (optional, will be auto-detected)
- `workspaceRoot` (string): Workspace root directory (optional, defaults to current directory). If the workspace root is a Node.js monorepo (contains a package.json with a "workspaces" field), ask the user which package they wa…

### `eyes_add_checkpoints_to_test` (~213 tokens)

Add visual checkpoints to existing Playwright tests following best practices

Input parameters:

- `activeFile` (string): Path to the currently active file or folder in the IDE (optional). Used to improve framework detection in Node.js monorepos by finding the nearest package.json relative to the active context.
- `fileContent` (string): Test file content (optional if filePath provided or if IDE provides it)
- `filePath` (string): Path to the test file that will be edited (optional if fileContent provided)
- `selection` (object): Selected code range from IDE (pass if provided to get better context, optional if not provided will process entire file)
- `workspaceRoot` (string): Workspace root directory (optional, defaults to current directory). If the workspace root is a Node.js monorepo (contains a package.json with a "workspaces" field), ask the user which package they wa…

### `eyes_get_batch_url` (~131 tokens)

═══════════════════════════════════════
📋 SHOW THIS MESSAGE TO USER AS-IS
═══════════════════════════════════════

      Extract and convert Eyes test result URLs from console output. Parses the test execution output to find session URLs and converts them to batch URLs for viewing all test results together in the Eyes dashboard. This tool extracts URLs only - use eyes_fetch_visual_results to get detailed test status and results data.

Input parameters:

- `testOutput` (string, required): The console output from running the Playwright test
- `workspaceRoot` (string): Workspace root directory (optional, defaults to current directory)

Output parameters:

- `batchUrls`: Array of batch URLs for viewing all test results together in the Eyes dashboard. Null if no URLs found.
- `message` (string): Human-readable summary of URL extraction results
- `sessionUrls`: Array of individual session URLs from test output (may end with ~~). Null if no URLs found.
- `testResults`: Additional test result metadata if available

### `eyes_fetch_visual_results` (~690 tokens)

Fetch current up-to-date visual test results from the Playwright HTML report and the Eyes server.

IMPORTANT:
\- This tool reads the Playwright HTML report directly from disk.
\- **Do NOT copy or move the report file.** Instead, always point this tool to the actual report location using the `reportPath` argument when it's not in the default location.
\- For standard Playwright runs, the default report is at `playwright-report/index.html` in the workspace root.
\- For the Eyes example (`npx eyes-setup run-example`), the report is generated at:
  \`<workspaceRoot>/eyes-examples/eyes-playwright-report/index.html`
  In that case, call the tool with:
  \- `reportPath: "<workspaceRoot>/eyes-examples/eyes-playwright-report/index.html"`
  \- `workspaceRoot: "<workspaceRoot>"`

\**CRITICAL: Do NOT run Playwright with `--reporter=list`, `--reporter=dot`, `--reporter=line`, or any other `--reporter` flag that overrides the configured reporters. Doing so suppresses the Eyes reporter, preventing it from writing results to the HTML report. This tool will then read a stale report from a previous run and return outdated results.**

Always run Playwright without reporter overrides, for example:
\- ✅ CORRECT: `npx playwright test`
\- ❌ INCORRECT: `npx playwright test --reporter=list`

\**Stale report detection (optional):** If you know the batch IDs from the current Playwright run output, pass them via the `expectedBatchIds` parameter. This tool will warn you if those batch IDs are not found in the report, indicating the report may be from a previous run.

The tool returns structured test results that can be displayed in a table, including:
\- Test name
\- Visual test status (passed/failed/unresolved/new/aborted)
\- Retry attempt number
\- Browser/device configuration

[CORE REQUIREMENT: URL INTEGRITY] Visual-results URLs returned by Eyes end with `~~`. These tildes are a dashboard sentinel, not typos. You are strictly forbidden from stripping trailing tildes from these links. Render them with mar…

Input parameters:

- `activeFile` (string): Path to the currently active file or folder in the IDE (optional). Used to improve framework detection in Node.js monorepos by finding the nearest package.json relative to the active context.
- `expectedBatchIds` (array): Optional list of batch IDs extracted from the Playwright run output. When provided, the tool verifies these IDs appear in the report to confirm it is current and not stale from a previous run.
- `reportPath` (string): Path to the Playwright HTML report (optional, defaults to playwright-report/index.html)
- `serverUrl` (string): Optional Applitools server URL (defaults to https://eyes.applitools.com)
- `workspaceRoot` (string): Workspace root directory (optional, defaults to current directory). If the workspace root is a Node.js monorepo (contains a package.json with a "workspaces" field), ask the user which package they wa…

Output parameters:

- `message` (string): Human-readable summary of the visual test results
- `results` (array): Detailed results grouped by batch
- `summary` (object): Aggregated statistics summarizing test results across all batches. Counts tests by their visual comparison status.

### `eyes_analyze_batch` (~421 tokens)

Fetch visual test results and textual diff descriptions from an Applitools Eyes batch URL.

Use this tool when the user provides a batch URL from the Applitools dashboard (e.g. https://eyes.applitools.com/app/test-results/{batchId}) or a bare batch ID, and you need to analyze its visual test results without a Playwright HTML report on disk.

This is the counterpart to `eyes_fetch_visual_results` for cases where:
\- The user is looking at results from a CI run or a previous run
\- There is no Playwright report available locally
\- The user pastes a batch URL from the Eyes dashboard

The tool returns the same structured output as `eyes_fetch_visual_results`, including:
\- Per-test status (passed / failed / unresolved / new / aborted)
\- Textual diff descriptions for steps with visual differences
\- Aggregate summary statistics

Note: Textual diff descriptions require DOM-based diff analysis on the server side. Steps without DOM capture (e.g. Figma, mobile native) may not have diff descriptions even when diffs are present.

Input parameters:

- `activeFile` (string): Path to the currently active file or folder in the IDE (optional). Used to improve framework detection in Node.js monorepos by finding the nearest package.json relative to the active context.
- `batchUrl` (string, required): The Applitools Eyes batch URL (e.g. https://eyes.applitools.com/app/test-results/{batchId}) or a bare batch ID.
- `serverUrl` (string): Eyes server base URL (optional, auto-detected from batchUrl or defaults to https://eyes.applitools.com). Set this for on-premises Eyes deployments.
- `workspaceRoot` (string): Workspace root directory (optional, defaults to current directory). If the workspace root is a Node.js monorepo (contains a package.json with a "workspaces" field), ask the user which package they wa…

Output parameters:

- `message` (string): Human-readable summary of the visual test results
- `results` (array): Detailed results grouped by batch
- `summary` (object): Aggregated statistics summarizing test results across all batches. Counts tests by their visual comparison status.

## Diagnostics

Captured diagnostic sections: Provenance, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/applitools-applitools/applitools-mcp#diagnostics

## Score history

- 2026-08-03: 61
- 2026-08-02: 57
- 2026-08-01: 39
- 2026-07-31: 24
- 2026-07-30: 32
- 2026-07-28: 50
- 2026-07-27: 50

## Links

- npm package: https://www.npmjs.com/package/@applitools/mcp
- Socket report: https://socket.dev/npm/package/@applitools/mcp
- Repository: https://github.com/applitools/mcp
- Website: https://applitools.com/
- Changelog RSS feed: https://verifymcp.io/servers/applitools-applitools/applitools-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/applitools-applitools/applitools-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/applitools-applitools/applitools-mcp