Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Qase Test Management

NPM · @QASE/MCP-SERVER · 2 COMPONENTS

Official MCP server for Qase — manage test cases, runs, suites, defects via AI tools.

−2 this week 90 Trust /100

Last scanned (6 hours ago)

Scores higher than 93% of npm servers

Category Testing and QA

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security94
  • No malware found by supply-chain analysis.Pass
  • CVE check failed: a known medium-severity CVE affects glob 13.0.6, reached via npm > glob. A fixed version is available. View diagnostics → Fail
  • No install/post-install scripts declared.Pass
  • 60 of 243 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to qase-tms/qase-mcp-server). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 0 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 8407 tokens (~200/item across 42 items; 42 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management82
  • Stability check failed: the tool surface changed between 2.7.4 and 3.0.6: 0 tool removals, 6 breaking changes, 25 additions. See how to fix → Fail
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Tool Safety75
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • 0 of 13 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "qase_attachment_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
  • An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a current MCP spec version (2026-07-28).Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +15
    • Malware scan: unverified → pass ▲ security
  • 4 Nov 26 −15
    • Malware scan: pass → unverified ▼ security
    • Security disclosure: unverified → pass ▲ functional
    • Package version: 3.0.4 → 3.0.6 functional
  • 3 Nov 26 0
    • Security disclosure: pass → unverified ▼ functional
  • 31 Oct 26 +13
    • CVE-2026-118773 affects this package: medium ▼ security
    • CVE-2026-118764 affects this package: medium ▼ security
    • Known CVEs: pass → fail ▼ security
    • Malware scan: unverified → pass ▲ security
  • 30 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 3.0.3 → 3.0.4 functional
  • 29 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
  • 28 Oct 26 −15
    • Malware scan: pass → unverified ▼ security
    • Package version: 3.0.2 → 3.0.3 functional
  • 27 Oct 26 +15
    • Malware scan: unverified → pass ▲ security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/@qase/mcp-server@3.0.6

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo qase-tms/qase-mcp-server
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/qase-tms/qase-mcp-server/.github/workflows/npm.yml@refs/tags/v3.0.6
Rekor log index 3688456620
Predicate type SLSA build provenance https://slsa.dev/provenance/v1
Subject digest sha512:6007975d70495ab312839a9acbe2072b9e412b741d1a7ebca61e487a90ed1ac8950dd8ca4692783f2e88d6fe0d0f1fd921bd48bbb674b536c63634200

Background: How many MCP packages publish verified provenance →

Vulnerabilities 2 findings
ID CVE Severity Vector Fix available
GHSA-3g3m-2fjr-6pw4 CVE-2026-118773 medium yes
GHSA-g3hv-75wg-m249 CVE-2026-118764 medium yes

Background: What a vulnerability scan can and cannot prove →

Dependencies 243 packages
Packages resolved 243
Deprecated 1
Stale 59
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 42 exposed · ~7,822 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
qase_api ~160

Call any Qase REST endpoint directly, for the few things no dedicated tool covers: method, a /v1/… path on the configured host, optional body or query. Prefer a dedicated tool where one exists — they normalize enums and validate before spending a call. JSON only; uploads go through qase_attachment_upload. A DELETE asks for confirmation like the dedicated delete tools. Cost: one API call, 0.3-1.5s.

NameTypeReqDescription
bodyobject–Request body for POST/PUT/PATCH
methodstring–HTTP method
pathstringyesAPI path starting with a version segment (e.g., "/v1/project/DEMO/run")
queryobject–Query parameters

No output schema declared.

No examples provided.

qase_attachment_delete ~71

Delete an attachment by its hash (from qase_attachment_upload). Anything referencing it keeps the reference but the file is gone; this cannot be undone. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
hashstringyesAttachment hash identifier

No output schema declared.

No examples provided.

qase_attachment_upload ~294

Upload files and get back the hashes other tools reference them by. Pass `file_base64` plus `filename` for one file, or `files` for several in one request; `file_path` only works when the server runs on the same machine as the file — never on the hosted connector. The hash must then be passed in an `attachments` field; uploading alone attaches nothing. This is the only tool that sends multipart/form-data, which is why qase_api cannot send files. Cost: one API call per request, dominated by size.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
filestring–Deprecated: use file_base64 or file_path. Accepts an absolute path or base64 content.
file_base64string–Single-file form. File content, base64 encoded. Use this unless the server runs on the same machine as the file.
file_pathstring–Single-file form. Absolute path on the machine running THIS server; a remote server cannot see it — send file_base64 instead.
filenamestring–Original filename with extension. Required for the single-file form.
filesarray–Several files in one request, each entry with its own filename plus file_base64 or file_path. One round trip, hashes returned in the same order. Limits and sizing are in qase_tool_help.

No output schema declared.

No examples provided.

qase_case_bulk_create ~134

Create up to 100 test cases in one request — the batch form of qase_case_upsert, and the right tool whenever more than one case is being written. Same fields and enum handling as qase_case_upsert; creates only, update through qase_case_upsert with `id`. Cost: one API call regardless of batch size — ten cases measured 1.2s against 5.6s as ten separate calls.

NameTypeReqDescription
casesarrayyesTest cases to create, 1 to 100 per call
codestringyesProject code, e.g. DEMO

No output schema declared.

No examples provided.

qase_case_delete ~96

Delete a test case by project code and ID. Its execution history goes with it and this cannot be undone; consider marking it deprecated through qase_case_upsert instead. No bulk delete — one call each, each asking the user for confirmation. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_case_upsert ~494

Create or update a single test case: with `id` it updates, without it creates. Enum fields accept a label such as "high" or the project's numeric ID. Writing more than one case? Use qase_case_bulk_create — one request instead of one per case. If the project has "Test case review" enabled, writes may need a review — run qase_discover_tools with "review". Cost: one API call, about 0.6s to create, 0.4s to update.

NameTypeReqDescription
attachmentsarray–Hashes from qase_attachment_upload
automationstring–Automation: 0=Manual, 1=To be automated, 2=Automated (label or ID)
behaviorstring–Behavior label or numeric ID
codestringyesProject code, e.g. DEMO
custom_fieldobject–Custom fields by ID, e.g. { "12": "value" }
descriptionstring–Free-form description of what the case covers
idinteger–Case ID — if provided, updates the case; if omitted, creates a new one
is_flakystring–Is flaky: 0=No, 1=Yes; a boolean works too.
layerstring–Layer label or numeric ID
milestone_idinteger–ID of the milestone the case belongs to
postconditionsstring–State to restore or verify after the steps run
preconditionsstring–State the system must be in before the steps run
prioritystring–Priority label or numeric ID (0=not set, 1=high, 2=medium, 3=low)
severitystring–Severity label or numeric ID
statusstring–Status label or numeric ID
stepsarray–Ordered test steps; omit for a case without steps
steps_typestring–Step style: "classic" action/expected, or "gherkin" scenario text
suite_idinteger–ID of the suite that holds the case
tagsarray–Tag names, e.g. ["smoke", "billing"]
titlestringyesTest case title
typestring–Type label or numeric ID

No output schema declared.

No examples provided.

qase_ci_report ~201

Report a whole finished CI run in one call: creates the run, records every result, completes it. Use qase_result_record instead when the run already exists and results arrive in stages. Each result needs a numeric `case_id` and a status; batches over 200 are split for you, up to 2000. Cost: three API operations behind one call, about 0.7s for a small run.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
completeboolean–Complete the run after recording results (default: true)
environment_idinteger–ID of the environment the build ran against
is_autotestboolean–Mark as automated run (default: true)
resultsarrayyesTest results to record, 1 to 2000 per call
titlestringyesRun title (e.g., "CI Build #1234")

No output schema declared.

No examples provided.

qase_custom_field_delete ~93

Delete a custom field by ID. Reach is workspace-wide: it disappears from every project, with the values entered for it, and this cannot be undone. To remove it from one project only, edit `projects_codes` with qase_custom_field_upsert. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_custom_field_upsert ~319

Create or update a custom field. On create, `entity` (case, run, defect) and `type` are required and fixed forever — the update endpoint cannot change them. Fields are workspace-wide; scope with `projects_codes` or is_enabled_for_all_projects. Read existing fields with qase_project_context or qase_get. Cost: one call to create, two to update, 0.5-0.9s.

NameTypeReqDescription
default_valuestring–Value a new entity gets when none is entered
entitystring–What the field is attached to. Required when creating; cannot be changed later
idinteger–Custom field ID — if provided, updates; if omitted, creates
is_enabled_for_all_projectsboolean–Apply to every project in the workspace, instead of only those in projects_codes
is_filterableboolean–Whether the field can be used as a filter
is_requiredboolean–Whether a value must be given on create
is_visibleboolean–Whether the field is shown on the entity
placeholderstring–Hint shown in the empty field
projects_codesarray–Projects the field applies to. Ignored when is_enabled_for_all_projects is true
titlestringyesField title
typestring–Field type. Required when creating; cannot be changed later
valuearray–Option titles — required for selectbox, radio and multiselect

No output schema declared.

No examples provided.

qase_defect_delete ~102

Delete a defect by project code and ID; its links to results go with it and this cannot be undone. Usually resolving it through qase_defect_upsert with `id` is the right move, so the record survives. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_defect_upsert ~254

Create or update a defect: with `id` it updates, without it creates, and then `title`, `actual_result` and `severity` are required. Severity and status are labels ("blocker", "open"…), mapped for you. For a defect born from a specific test failure use qase_triage_defect; search with qql_search before filing a duplicate. Cost: one API call, about 0.5s.

NameTypeReqDescription
actual_resultstring–What actually happened — required when creating a defect
attachmentsarray–Hashes from qase_attachment_upload
codestringyesProject code, e.g. DEMO
custom_fieldobject–Custom fields by ID, e.g. { "12": "value" }
idinteger–Defect ID — if provided, updates; if omitted, creates
severitystring–How bad the defect is — required when creating a defect
statusstring–Set to "resolved" to resolve the defect
tagsarray–Tag names, e.g. ["regression", "payments"]
titlestringyesDefect title

No output schema declared.

No examples provided.

qase_discover_tools ~133

Search the tool catalogue by what you are trying to do — "delete", "milestone", "review", "custom field" — and get back the matching tools with their descriptions. Every tool is already listed and callable; use this when you do not know which one fits, rather than re-reading the whole list. Cost: no API call, matching happens in memory, about 3ms.

NameTypeReqDescription
categorystring–Filter by tool category
querystring–Search query to find tools by name or description. Examples: "delete", "milestone", "attachment", "suite"

No output schema declared.

No examples provided.

qase_environment_delete ~86

Delete an environment by project code and ID. Runs that referenced it lose the attribution, so filtering history by that environment stops working; this cannot be undone. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_environment_upsert ~142

Create or update an environment — a named target such as staging or production that runs are attributed to. With `id` it updates, without it creates. Existing environments come back from qase_project_context. Cost: one API call, about 0.5s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
descriptionstring–Free-form description of the environment
hoststring–Environment host/URL
idinteger–Environment ID — if provided, updates; if omitted, creates
slugstring–URL-friendly identifier
titlestringyesEnvironment title

No output schema declared.

No examples provided.

qase_external_issue_link ~163

Link or unlink test cases and runs to issues in Jira Cloud or Jira Server — the only trackers supported. A case may link several issues; a run holds one, and a new link replaces it. Read links back with qase_get. Cost: one API call for the whole set of links, about 0.5s.

NameTypeReqDescription
actionstringyesattach creates the link, detach removes it (for runs, clears the single link)
codestringyesProject code, e.g. DEMO
entitystringyesEntity to link — test case or test run
linksarrayyesEntities to link, processed in a single API request
typestringyesIssue tracker integration configured for the project

No output schema declared.

No examples provided.

qase_get ~231

Fetch one known record by type and ID — case, suite, run, result, plan, defect, milestone, environment, shared_step, review, custom_field and more. Use it only when you already have the ID and want that one record; for several, anything filtered, or a loop over IDs, use qql_search — one search returns the whole page. Cost: one API call, 0.3-0.5s; ten in sequence measured 5.3s against 1.2s for one qql_search.

NameTypeReqDescription
codestring–Project code (required for most entities)
entitystringyesEntity type to fetch
fieldsarray–Optional field projection — only return these top-level fields. Pass ["*"] for all fields.
id–yesEntity ID (number) or hash (string)
includestring–Comma-separated list of related entities to include in the response. Cases and runs already request their external issue links by default ("external_issues" / "external_issue"); pass this only to ove…

No output schema declared.

No examples provided.

qase_milestone_delete ~90

Delete a milestone by project code and ID. Runs and cases keep existing but lose the association, so release reporting built on it stops working; this cannot be undone. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_milestone_upsert ~153

Create or update a milestone — a dated marker, typically a release, that runs and cases are grouped under. With `id` it updates, without it creates. Existing milestones come back from qase_project_context. Cost: one API call, about 0.5s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
descriptionstring–Free-form description of the milestone
due_datenumber–Due date as Unix timestamp
idinteger–Milestone ID — if provided, updates; if omitted, creates
statusstring–active (default) or completed
titlestringyesMilestone title

No output schema declared.

No examples provided.

qase_plan_delete ~105

Delete a test plan by project code and ID. Only the plan goes — its cases and the runs made from it stay — but anything launching it by ID breaks; this cannot be undone. To change its cases use qase_plan_upsert instead. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_plan_upsert ~148

Create or update a test plan — a named, reusable set of case IDs such as a smoke or regression pack. With `id` it updates, without it creates. qase_regression_run turns a plan into a run in one call. Cost: one API call, about 0.5s, growing with the number of cases.

NameTypeReqDescription
casesarray–Case IDs to include
codestringyesProject code, e.g. DEMO
descriptionstring–Free-form description of the plan
idinteger–Plan ID — if provided, updates; if omitted, creates
titlestringyesTest plan title

No output schema declared.

No examples provided.

qase_project_context ~167

Seed everything about a project in one call: details, the full suite tree, milestones, environments, custom fields and users — make it first when starting on a project. Each collection returns its first 100; check `coverage` and pass `full: true` to page. For one record by ID qase_get is cheaper; for filtered questions use qql_search. Cost: six API calls behind one, 0.5-1.3s cold, cached 5 minutes.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
fullboolean–Page through every collection instead of the first 100 of each (default: false). Use it when `coverage` reports one truncated; see qase_tool_help for what it costs.

No output schema declared.

No examples provided.

qase_project_create ~171

Create a project. The code must be unique in the workspace, and there is no update endpoint afterwards — title, code and access cannot be changed through the API, so choose them deliberately. Read an existing project with qase_project_context. Cost: one API call, about 1.5s.

NameTypeReqDescription
accessstring–Who can access the project: everyone, a team group, or nobody but the owner
codestringyesProject code — unique per workspace, 2 to 10 characters of uppercase letters, digits or underscores
descriptionstring–Free-form description of the project
groupstring–Team group hash — required when access is "group"
settingsobject–Additional project settings
titlestringyesProject title

No output schema declared.

No examples provided.

qase_project_delete ~103

Delete an entire project by code — every case, suite, run, result, defect and milestone in it, with no trash to recover from; this cannot be undone. The most destructive call in the API; confirm the code with qase_project_context first. Asks the user for confirmation and does not proceed without it. Cost: one API call, about 0.5s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO

No output schema declared.

No examples provided.

qase_regression_run ~198

Build and start a test run from a suite, a plan, or an explicit list of case IDs, in one step — it resolves the cases itself. It opens a run, it does not close one: for a finished pipeline use qase_ci_report; to assemble a run by hand use qase_run_upsert. Cost: two API calls behind one, about 1s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
descriptionstring–What this regression run covers
environment_idinteger–ID of the environment the run executes against
include_casesarray–Explicit case IDs to include
milestone_idinteger–ID of the milestone the run belongs to
plan_idinteger–Create run from an existing test plan
suite_idsarray–Include cases from these suites
titlestringyesRun title

No output schema declared.

No examples provided.

qase_result_delete ~112

Delete one result from a run, by run ID and result hash. The case and the rest of the run are untouched; pass rates shift and this cannot be undone. To discard a whole run use qase_run_delete. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
hashstringyesResult hash to delete
run_idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_result_record ~147

Record up to 200 results into an existing run — status, duration, comment, stacktrace, attachments — in one call, not one per test. Status is a label only: passed, failed, blocked, skipped, invalid. If the run does not exist yet and the job is finished, qase_ci_report creates, records and completes in one call. Cost: one API call for the whole list, about 0.5s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
resultsarrayyesResults to record, 1 to 200 per call
run_idintegeryesRun ID to record results into

No output schema declared.

No examples provided.

qase_review_bulk_create ~147

Open several test case reviews in one request — the batch form of qase_review_create, for proposing more than one change. Same fields as qase_review_create; `case_id` for an edit review, omitted for a create review. The API has no endpoints for approving, merging or declining — those are UI-only; read status with qase_review_list. Cost: one API call regardless of batch size.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
reviewsarrayyesReviews to open. Validated as a whole: if any item is invalid, NOTHING is created. Once valid, each item is processed individually and reported separately.

No output schema declared.

No examples provided.

qase_review_create ~571

Open a test case review — the pull-request flow for cases. Pass `case_id` to propose changes to an existing case (send only the fields that change), or omit it to propose a new one. Several at once? Use qase_review_bulk_create. The API has no endpoints for approving, merging or declining — those are UI-only; read status with qase_review_list. Cost: one API call, about 0.5s.

NameTypeReqDescription
attachmentsarray–Hashes from qase_attachment_upload
automationstring–Automation: 0=Manual, 1=To be automated, 2=Automated (label or ID)
behaviorstring–Behavior label or numeric ID
case_idinteger–Test case to propose changes to. With it, an "edit" review is created and only the fields being changed need to be sent. Without it, a "create" review is opened for a brand-new case draft and `title`…
codestringyesProject code, e.g. DEMO
custom_fieldobject–Custom fields by ID, e.g. { "12": "value" }
descriptionstring–Free-form description of what the case covers
is_flakystring–Is flaky: 0=No, 1=Yes; a boolean works too.
layerstring–Layer label or numeric ID
milestone_idinteger–ID of the milestone the case belongs to
postconditionsstring–State to restore or verify after the steps run
preconditionsstring–State the system must be in before the steps run
prioritystring–Priority label or numeric ID (0=not set, 1=high, 2=medium, 3=low)
reviewersarray–Reviewers: AUTHOR UUIDs (see qase_get { entity: "author" }) or emails, which resolve to them. Not user IDs. The token owner authors the review and cannot review their own review. Omit to assign them…
severitystring–Severity label or numeric ID
statusstring–Status label or numeric ID
stepsarray–Ordered test steps; omit for a case without steps
steps_typestring–Step style: "classic" action/expected, or "gherkin" scenario text
suite_idinteger–ID of the suite that holds the case
tagsarray–Tag names, e.g. ["smoke", "billing"]
titlestring–Test case title
typestring–Type label or numeric ID

No output schema declared.

No examples provided.

qase_review_delete ~95

Delete a review by ID. This removes the proposal entirely — it does not decline it, and declining is UI-only — and merged reviews cannot be deleted; the referenced case is untouched. Cannot be undone; asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesReview ID

No output schema declared.

No examples provided.

qase_review_list ~222

List a project's reviews with their current state — the only way to learn what happened to a review you opened, since the API has no endpoints for approving or merging — those are UI-only. Filter by status to see what is still open. For one review by ID, qase_get is cheaper. Cost: one API call, about 0.5s.

NameTypeReqDescription
author_uuidstring–Only reviews opened by this author UUID
case_idinteger–Only reviews of this test case
codestringyesProject code, e.g. DEMO
limitinteger–Default 25, max 100
offsetinteger–Skip this many reviews, for paging
reviewer_uuidstring–Only reviews this author UUID is a reviewer on
searchstring–Substring match on the review title
statusstring–Only reviews in this state
typestring–"create" proposes a new case, "edit" proposes changes to an existing one

No output schema declared.

No examples provided.

qase_review_update ~490

Update an open review: the proposed case fields, the reviewers, or both, by review ID. IMPORTANT: changing the proposal RESETS every approval already given; updating only `reviewers` keeps them. The API has no endpoints for approving, merging or declining — those are UI-only; read status with qase_review_list. Cost: one API call, about 0.5s.

NameTypeReqDescription
attachmentsarray–Hashes from qase_attachment_upload
automationstring–Automation: 0=Manual, 1=To be automated, 2=Automated (label or ID)
behaviorstring–Behavior label or numeric ID
codestringyesProject code, e.g. DEMO
custom_fieldobject–Custom fields by ID, e.g. { "12": "value" }
descriptionstring–Free-form description of what the case covers
idintegeryesReview ID
is_flakystring–Is flaky: 0=No, 1=Yes; a boolean works too.
layerstring–Layer label or numeric ID
milestone_idinteger–ID of the milestone the case belongs to
postconditionsstring–State to restore or verify after the steps run
preconditionsstring–State the system must be in before the steps run
prioritystring–Priority label or numeric ID (0=not set, 1=high, 2=medium, 3=low)
reviewersarray–Replaces the current reviewer list; an empty array removes everyone. Omit to leave it unchanged. Author UUIDs or emails. Changing ONLY reviewers keeps existing approvals.
severitystring–Severity label or numeric ID
statusstring–Status label or numeric ID
stepsarray–Ordered test steps; omit for a case without steps
steps_typestring–Step style: "classic" action/expected, or "gherkin" scenario text
suite_idinteger–ID of the suite that holds the case
tagsarray–Tag names, e.g. ["smoke", "billing"]
titlestring–Test case title
typestring–Type label or numeric ID

No output schema declared.

No examples provided.

qase_run_complete ~98

Mark a test run complete so it reports as finished. It is a reporting state, not a lock — results recorded afterwards still land and change its counts. If all results are in hand at once, qase_ci_report does this as its final step. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_run_delete ~103

Delete a test run by project code and ID, together with every result in it; this cannot be undone. Rarely what you want: to stop accepting results use qase_run_complete, to fix one result use qase_result_delete. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_run_upsert ~307

Create or update a test run — the container results are recorded into, so open it before qase_result_record. Scope it to a milestone, environment, plan or case list. To build one from a suite or plan use qase_regression_run; for a finished CI job use qase_ci_report, which opens, records and closes in one call. Cost: one API call, about 0.5s.

NameTypeReqDescription
casesarray–Case IDs to include
codestringyesProject code, e.g. DEMO
custom_fieldobject–Custom fields by ID, e.g. { "12": "value" }
descriptionstring–What this run covers
end_timestring–RFC3339 end time
environment_idinteger–ID of the environment the run executes against
idinteger–Run ID — if provided, this is an update (note: Qase API has limited run update support)
is_autotestboolean–True when the run is produced by automation rather than a person
milestone_idinteger–ID of the milestone the run belongs to
plan_idinteger–Test plan to base run on
start_timestring–RFC3339 start time
tagsarray–Tag names, e.g. ["nightly", "smoke"]
titlestringyesRun title

No output schema declared.

No examples provided.

qase_shared_step_delete ~106

Delete a shared step by project code and hash. Every case referencing it loses those steps, so the reach is far wider than one record; check references first. Cannot be undone; to change content use qase_shared_step_upsert instead. Asks the user for confirmation first. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
hashstringyesShared step hash identifier

No output schema declared.

No examples provided.

qase_shared_step_upsert ~139

Create or update a shared step — a block of steps written once and reused across cases. With `hash` it updates, without it creates; shared steps are identified by hash, which qase_case_upsert takes in a step's `shared` field. Updating changes every referencing case. Cost: one API call, about 0.5s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
hashstring–Shared step hash — if provided, updates; if omitted, creates
stepsarray–Array of step definitions
titlestringyesShared step title

No output schema declared.

No examples provided.

qase_suite_delete ~148

Delete a test suite by project code and ID. WARNING: the cases inside, and any child suites, are deleted with it along with their history, and `delete_cases` currently has no effect. Read the tree from qase_project_context and move what matters first. Asks the user for confirmation. Cost: one API call, about 0.4s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
delete_casesboolean–Has no effect today: the server sends a field this endpoint does not accept, so the cases are deleted either way. Kept so existing callers do not break.
idintegeryesEntity ID

No output schema declared.

No examples provided.

qase_suite_upsert ~171

Create or update a test suite — the folder cases live in. With `id` it updates, without it creates; nest with `parent_id`. The existing tree comes back from qase_project_context, so read it rather than guess parent IDs. Cost: one API call, about 0.5s.

NameTypeReqDescription
codestringyesProject code, e.g. DEMO
descriptionstring–What this suite groups — shown under the suite title in the tree
idinteger–Suite ID — if provided, updates; if omitted, creates
parent_idinteger–Parent suite ID for nesting
preconditionsstring–Setup every case in this suite assumes, inherited by its child suites
titlestringyesSuite title

No output schema declared.

No examples provided.

qase_tool_help ~125

Read the full documentation of one tool before calling it for the first time in a session. Every description in the tool list is deliberately short — what the tool is for and what it costs — and the details that prevent a wrong first call live here: argument semantics, limits, what cannot be undone, and which tool to use instead. Pass the tool name exactly as listed. Cost: no API call, static text, about 1ms. Cheaper than one rejected call.

NameTypeReqDescription
toolstringyesThe tool name, exactly as it appears in the tool list

No output schema declared.

No examples provided.

qase_triage_defect ~216

Create a defect from a test failure with the context written into it; `title`, `actual_result` and `severity` are required. The API has no way to attach runs or results to a defect — reference them in actual_result. For a defect unrelated to a failure use qase_defect_upsert. Cost: one API call, about 0.5s; file one defect per distinct cause.

NameTypeReqDescription
actual_resultstringyesObserved behavior. Required by the API
attachmentsarray–Hashes from qase_attachment_upload
codestringyesProject code, e.g. DEMO
custom_fieldobject–Custom fields by ID, e.g. { "12": "value" }
descriptionstring–Extra context beyond the observed behavior
severitystringyesRequired by the API
tagsarray–Tag names, e.g. ["regression", "payments"]
titlestringyesDefect title

No output schema declared.

No examples provided.

qql_help ~272

Read the QQL reference before writing a query. Pass a `topic`: overview, syntax, entities, operators, functions, examples, aggregation or enumValues. Field names differ per entity and from the write tools, and a query naming an unknown attribute is rejected — read `entities` first. Cost: no API call, about 2ms; cheaper than one rejected qql_search.

NameTypeReqDescription
topicstringyesWhich section to return (required — one section per call): - overview: what QQL is, overall query structure, subscription requirement - syntax: structure, ordering, custom fields, case-sensitivity, b…

No output schema declared.

No examples provided.

qql_search ~245

Search any entity with Qase Query Language — filtering, cross-project, sorting, aggregation — and the right way to fetch many records at once instead of looping over qase_get. Call qql_help first for syntax, fields and enum values. Use qase_get when you already know the one ID you want. Cost: one API call, 0.5-0.9s per page; ten records here cost 1.2s against 5.3s as ten qase_get calls.

NameTypeReqDescription
limitinteger–Maximum number of results to return (default: 10, max: 100)
offsetinteger–Number of results to skip for pagination
querystringyesQQL query expression. Examples: - entity = "case" and project = "DEMO" and status = "Actual" - entity = "defect" and severity = "blocker" and status = "open" - entity = "result" and status = "failed"…

No output schema declared.

No examples provided.

Install

How do I install the Qase Test Management MCP server?

Qase Test Management runs locally as an npm package, launched with npx -y @qase/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @qase/mcp-server

# add to Claude Code
claude mcp add io-qase-mcp-server -- npx -y @qase/mcp-server
Common questions

What is the Qase Test Management MCP server?

Qase Test Management is an MCP server listed in the public MCP registry as io.qase/mcp-server. Official MCP server for Qase, manage test cases, runs, suites, defects via AI tools. This page covers its npm package (@qase/mcp-server).

Is the Qase Test Management MCP server safe to use?

Qase Test Management scores 90 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Qase Test Management MCP server expose?

Qase Test Management exposes 42 tools: qase_api, qase_attachment_delete, qase_attachment_upload, qase_case_bulk_create, qase_case_delete, and 37 more. Their descriptions and schemas cost roughly 7,822 tokens of context every time the server is loaded.

Is the Qase Test Management MCP server still maintained?

Qase Test Management is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Qase Test Management MCP server under?

Qase Test Management declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.