Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

Qase Test Management

NPM · @QASE/MCP-SERVER · 2 COMPONENTS · SCANNED SEP 20

Official MCP server for Qase — manage test cases, runs, suites, defects via AI tools.

−1 this week 92 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security99
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 67 of 260 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency100
  • Source repository is publicly reachable at the declared URL. View diagnostics → Pass
  • Cryptographically verified build provenance (signed, bound to qase-tms/qase-mcp-server). View diagnostics → Pass
  • Clear OSI-approved license (MIT).Pass
  • Actively maintained (last published 1 days ago).Pass
  • Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability75
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4925 tokens (~351/item across 14 items; 14 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management80
  • Stability observed for 24 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage92
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 70% of tool parameters carry a description.Partial
  • Structured output schemas are declared (43% of tools); any adoption earns full credit.Pass
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 15 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the Qase Test Management MCP server?

Qase Test Management runs locally as an npm package, launched with npx -y @qase/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @qase/mcp-server

# add to Claude Code
claude mcp add io-qase-mcp-server -- npx -y @qase/mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "io-qase-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@qase/mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "io-qase-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@qase/mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add io-qase-mcp-server -- npx -y @qase/mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-qase-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@qase/mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add io-qase-mcp-server --command npx --arg -y --arg @qase/mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  io-qase-mcp-server:
    command: "npx"
    args: ["-y", "@qase/mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "io-qase-mcp-server": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@qase/mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add io-qase-mcp-server -t stdio -c npx -a -y @qase/mcp-server
// mcp.json
{
  "mcpServers": {
    "io-qase-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@qase/mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 20 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 77 to 80. That category is still filling its 30-day observation window: 23 days of observed history at the previous scan, 24 at this one. The score rises as the window fills, whether or not the server changes.

  • 19 Sept 26 −4
    • Stability: pass → 0.77 functional
  • 18 Sept 26 +1
    • Security disclosure: unverified → pass functional
  • 17 Sept 26 0
    • Security disclosure: fail → unverified functional
  • 16 Sept 26 0
    • Stability: 0.97 → pass security
  • 15 Sept 26 +1
    • Security disclosure: unverified → fail functional
  • 14 Sept 26 0
    • Security disclosure: fail → unverified functional
  • 13 Sept 26 −1
    • Stability: pass → 0.90 functional
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Sept 2026 · Analysed npm/@qase/mcp-server@2.4.1

Provenance Verified

A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.

Result Verified
Ecosystem npm
Reason Verified
Discovered via Registry attestation endpoint
Source repo qase-tms/qase-mcp-server
Certificate issuer https://token.actions.githubusercontent.com
Certificate SAN https://github.com/qase-tms/qase-mcp-server/.github/workflows/npm.yml@refs/tags/v2.4.1
Rekor log index 2758774996
Predicate type https://slsa.dev/provenance/v1
Subject digest sha512:290204b6b20110b5787a884b9c64e18407e2206067a5a94c263ae1484e0d2b2f17c4c350fd51facb478c112489b9fcd8d68b7fcedd2235a3dcef0b9ab

Background: How many MCP packages publish verified provenance →

Dependencies 260 packages
Packages resolved 260
Stale 67
No linked repository 1
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 14 exposed · ~4,435 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
qase_api ~222

Call any Qase REST endpoint directly, for the few things no dedicated tool covers. Pass the HTTP method, a path starting with /v1/, and an optional body or query. See developers.qase.io for the reference. Prefer a dedicated tool wherever one exists: they normalize enums, validate arguments before spending a round trip, and shape the response for a model. This one hands back whatever the API returns. It sends JSON only and cannot upload files — multipart uploads go through qase_attachment_upload. A DELETE through this tool asks for confirmation the same way the dedicated delete tools do. Cost: one API call, typically 0.3-1.5s depending on the endpoint. No caching, no pagination help, no retries beyond the client defaults.

NameTypeReqDescription
bodyobjectRequest body for POST/PUT/PATCH
methodstringHTTP method
pathstringyesAPI path starting with /v1/ (e.g., "/v1/project/DEMO/run")
queryobjectQuery parameters

No output schema declared.

No examples provided.

qase_attachment_upload ~395

Upload a file and get back the hash that other tools reference it by — screenshots, logs, HAR files, videos. Pass `file_base64` with the base64-encoded bytes, or `file_path` with an absolute path; `filename` with its extension is always required. Use `file_base64` unless the server runs on the same machine as the file: a remote server, the hosted connector included, cannot see your filesystem, and `file_path` will simply not find the file. The returned hash is what goes in the `attachments` field of qase_case_upsert, qase_result_record, qase_defect_upsert or qase_triage_defect — uploading alone attaches nothing, the hash has to be passed on. This is the only tool that sends multipart/form-data, which is why qase_api cannot send them. Upload once and reuse the hash rather than re-uploading the same evidence per case. Cost: one API call per file, dominated by file size rather than round trip — well under a second for a screenshot, seconds for a video. Base64 inflates the payload by about a third.

NameTypeReqDescription
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
filestringDeprecated: prefer file_base64 or file_path, which say which one you mean. Accepts either an absolute path to an existing file or base64 content.
file_base64stringFile content, base64 encoded. Use this whenever the server is not on the same machine as the file — including the hosted connector, where it is the only option.
file_pathstringAbsolute path to a file on the machine running THIS server. Only usable for a local stdio server; a remote server cannot see your filesystem — send file_base64 instead.
filenamestringyesOriginal filename with extension

No output schema declared.

No examples provided.

qase_case_upsert ~496

Create or update a single test case. With `id` it updates that case, without `id` it creates a new one. Enum fields (priority, severity, type, layer, behavior, automation) accept either a label such as "high" or "blocker" or the project's numeric ID — the server normalizes both. Steps can be classic action/expected pairs or Gherkin, and may reference shared steps by hash. Writing more than one case? Use qase_case_bulk_create instead: it takes a list and sends one request. If the project has "Test case review" enabled, direct writes may need to go through a review — run qase_discover_tools with "review" for those tools. Cost: one API call, about 0.6s to create and 0.4s to update. Ten sequential calls measured 5.6s against 1.2s for one qase_case_bulk_create writing the same ten, so a loop is roughly four times slower.

NameTypeReqDescription
attachmentsarrayAttachment hashes from qase_attachment_upload
automationstringAutomation status (label, slug, or numeric ID: 0=Manual / is-not-automated, 1=To be automated, 2=Automated)
behaviorstringBehavior label or numeric ID
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
custom_fieldobject
descriptionstring
idintegerCase ID — if provided, updates the case; if omitted, creates a new one
is_flakyboolean
layerstringLayer label or numeric ID
milestone_idinteger
postconditionsstring
preconditionsstring
prioritystringPriority label or numeric ID (0=not set, 1=high, 2=medium, 3=low)
severitystringSeverity label or numeric ID
statusstringStatus label or numeric ID
stepsarray
steps_typestring
suite_idinteger
tagsarray
titlestringyesTest case title
typestringType label or numeric ID

No output schema declared.

No examples provided.

qase_ci_report ~323

Report a whole CI run in one call: creates the run, records every result, and completes it. This is the tool for a pipeline that has just finished — it replaces qase_run_upsert, then qase_result_record, then qase_run_complete, and leaves no half-open run behind if the agent stops early. Each result needs a numeric `case_id` plus a status, and may carry duration, comment, stacktrace and attachment hashes. Use qase_result_record instead when the run already exists and results arrive in stages; use qase_run_upsert when you need the run left open. A batch larger than 200 is split across requests for you, up to 2000 results in one report. Cost: one tool call covering three API operations, plus one extra request per 200 results. A run with two results measured about 0.7s, against roughly 1.5s for the same work as three separate calls, and it grows with the number of results rather than with the number of round trips.

NameTypeReqDescription
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
completebooleanComplete the run after recording results (default: true)
environment_idinteger
is_autotestbooleanMark as automated run (default: true)
resultsarrayyesTest results to record, 1 to 2000 per call
titlestringyesRun title (e.g., "CI Build #1234")
NameTypeReqDescription
results_recordedintegeryesNumber of results recorded
run_idintegeryesCreated run ID
run_statusstringyes

No examples provided.

qase_defect_upsert ~338

Create or update a defect — a tracked problem found by testing. Without `id` it creates, with `id` it updates. Creating one requires `title`, `actual_result` and `severity`; the API rejects a defect missing any of the three. Severity is given as a label ("blocker", "critical", "major", "normal", "minor", "trivial") and the server maps it to the workspace's numeric ID, custom options included. Status is a label too ("open", "in_progress", "resolved", "invalid") and passes through as written; setting it to "resolved" on an existing defect goes through the dedicated resolve endpoint. When the defect comes from a specific test failure, use qase_triage_defect instead. The API has no way to attach runs or results to a defect, so reference the failing results in the text rather than expecting a link. Find existing defects with qql_search before filing a duplicate. Cost: one API call, about 0.5s, plus a cached lookup of the severity options.

NameTypeReqDescription
actual_resultstring
attachmentsarrayAttachment hashes from qase_attachment_upload
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
custom_fieldobject
idintegerDefect ID — if provided, updates; if omitted, creates
severitystring
statusstringSet to "resolved" to resolve the defect
tagsarray
titlestringyesDefect title

No output schema declared.

No examples provided.

qase_discover_tools ~224

Find and switch on tools that are hidden by default. Only core tools appear in the tool list; deletes, shared steps and parameters, attachments, external issue links, case reviews, defect triage, and project and custom-field management all exist but stay hidden until discovered. Search by what you are trying to do — "delete", "milestone", "attachment", "review", "custom field" — and matching tools are activated and become callable. Every word in the query must appear in a tool's name or description, so prefer two or three words over a sentence. Never conclude a capability is missing without searching here first. Cost: no API call, matching happens in memory, about 3ms. Free to call as often as needed.

NameTypeReqDescription
activatebooleanIf true (default), found tools are activated and become available for use
categorystringFilter by tool category
querystringSearch query to find tools by name or description. Examples: "delete", "milestone", "attachment", "suite"
NameTypeReqDescription
activatedintegeryesNumber of newly activated tools
foundintegeryesNumber of matching tools
toolsarrayyes

No examples provided.

qase_get ~321

Fetch one known record by type and ID: case, suite, run, result, plan, defect, milestone, environment, shared_step, shared_parameter, configuration, attachment, author, user, review, or custom_field. `code` is required for project-scoped entities and can be omitted for global ones (user, author, attachment, custom_field). Narrow the payload with `fields`, or pass ["*"] for everything. Use this only when you already know the ID and want a single record. For several records, for anything filtered or cross-project, or when you are about to call this in a loop, use qql_search instead — one search returns the whole page at once. Cost: one API call, 0.3-0.5s. Ten of these in sequence measured 5.3s against 1.2s for a single qql_search returning the same ten records, so a loop over IDs is roughly four times slower and ten times more calls.

NameTypeReqDescription
codestringProject code (required for most entities)
entitystringyesEntity type to fetch
fieldsarrayOptional field projection — only return these top-level fields. Pass ["*"] for all fields.
idyesEntity ID (number) or hash (string)
includestringComma-separated list of related entities to include in the response. Cases and runs already request their external issue links by default ("external_issues" / "external_issue"); pass this only to ove…

No output schema declared.

No examples provided.

qase_project_context ~324

Seed everything about a project in one call: project details, the full suite tree, milestones, environments, custom fields, and users. This is the first call to make when starting work on a project — it replaces six separate list calls and gives the model the metadata it needs to build any later query. Each collection returns its first 100 entities; the `coverage` field reports { total, loaded, truncated } per collection, so check it before assuming a list is complete, and pass `full: true` to page through everything. For a single record you already have the ID for, qase_get is cheaper; for filtered or cross-project questions, use qql_search. Cost: six API calls behind one tool call, 0.5-1.3s cold, and 16-48KB of response depending on project size. Cached for 5 minutes, so repeat calls inside that window return in about 5ms. `full: true` costs one extra call per 100 entities and can return thousands of items.

NameTypeReqDescription
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
fullbooleanPage through every suite, milestone, environment, custom field, and user instead of fetching only the first 100 of each (default: false). Use this when a collection is reported as truncated and you n…
NameTypeReqDescription
coverageobjectyesPer-collection completeness: each of suites, milestones, environments, custom_fields, and users maps to { total, loaded, truncated }. When truncated is true the list holds only the first `loaded` of…
custom_fieldsobjectCustom fields list
environmentsobjectyesEnvironments list
milestonesobjectyesMilestones list
projectobjectyesProject details
suitesobjectyesSuites list with entities array
usersobjectTeam members list

No examples provided.

qase_regression_run ~249

Build and start a test run from a suite, a test plan, or an explicit list of case IDs, in one step. Use it to launch a regression cycle without first querying for cases and then creating a run around them — give it the source and it resolves the cases itself. For a run you assemble by hand, use qase_run_upsert and pass the case IDs. For a pipeline that has already finished and just needs its results filed, use qase_ci_report instead: this tool opens a run, it does not close one. Cost: two API calls behind one tool call — resolving the source, then creating the run — roughly 1s, growing with the number of cases the source resolves to.

NameTypeReqDescription
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
descriptionstring
environment_idinteger
include_casesarrayExplicit case IDs to include
milestone_idinteger
plan_idintegerCreate run from an existing test plan
suite_idsarrayInclude cases from these suites
titlestringyesRun title
NameTypeReqDescription
cases_addedintegeryesNumber of cases added to the run
runobjectFull run entity
run_idintegeryesCreated run ID

No examples provided.

qase_result_record ~279

Record up to 200 results into an existing run. A case says what should be tested; a result says what happened when it ran — status, duration, comment, stacktrace, attachments — so a result always needs a run to live in. Pass several results in one call rather than calling once per test: the tool takes a list and sends them together. 200 is the ceiling for one call, and a longer list is refused before anything is written — split it into consecutive calls rather than dropping the tail. If the run does not exist yet and this is a finished CI job, qase_ci_report is the single call that creates the run, records the results and completes it, and it splits a larger batch for you. Status is a label, one of "passed", "failed", "blocked", "skipped" or "invalid" — unlike the case enums, numeric IDs are not accepted here. Cost: one API call for the whole list, about 0.5s for a small batch, growing with payload rather than with the number of results.

NameTypeReqDescription
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
resultsarrayyesResults to record, 1 to 200 per call
run_idintegeryesRun ID to record results into

No output schema declared.

No examples provided.

qase_run_upsert ~310

Create or update a test run. Without `id` it opens a new run; with `id` it updates that one. A run is the container results are recorded into, so open it before calling qase_result_record. Optionally scope it to a milestone, an environment, a plan, or an explicit list of case IDs. To build a run from a suite or plan without listing cases yourself, use qase_regression_run. For a CI job that has already finished, use qase_ci_report instead — it opens the run, files the results and closes it in one call, so no half-finished run is left behind. Cost: one API call, about 0.5s.

NameTypeReqDescription
casesarrayCase IDs to include
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
custom_fieldobject
descriptionstring
end_timestringRFC3339 end time
environment_idinteger
idintegerRun ID — if provided, this is an update (note: Qase API has limited run update support)
is_autotestboolean
milestone_idinteger
plan_idintegerTest plan to base run on
start_timestringRFC3339 start time
tagsarray
titlestringyesRun title

No output schema declared.

No examples provided.

qase_triage_defect ~269

Create a defect from a test failure, with the failure context written into it. Requires title, actual_result and severity — the API rejects a defect missing any of the three. Note: the API offers no way to attach existing runs or results to a defect. The runs and results seen on a defect in the UI are populated by the test runner when it reports a result as a defect, so there is nothing to pass here for that — reference the failing results inside actual_result instead, and do not expect a link to appear. For a defect unrelated to a test failure use qase_defect_upsert. Cost: one API call, about 0.5s. Triaging a whole run means one call per defect, so cluster identical failures and file one defect per distinct cause rather than one per failed test.

NameTypeReqDescription
actual_resultstringyesObserved behavior. Required by the API
attachmentsarrayAttachment hashes from qase_attachment_upload
codestringyesProject code (2-10 uppercase letters, numbers, or underscores)
custom_fieldobject
descriptionstring
severitystringyesRequired by the API
tagsarray
titlestringyesDefect title
NameTypeReqDescription
defectobjectFull defect entity
defect_idintegeryesCreated defect ID

No examples provided.

qql_help ~336

Read the QQL reference before writing a query. Pass a `topic`: overview, syntax, entities, operators, functions, examples, aggregation, or enumValues. `entities` lists the fields each entity actually exposes, and `enumValues` gives the accepted values for status, priority, severity and the rest — both matter, because QQL rejects a query naming an attribute that does not exist on the entity rather than ignoring it, and the field names differ from those in the write tools. Read this once per session before the first qql_search rather than guessing and retrying. Cost: no API call, static text, about 2ms. Free to call, and cheaper than one rejected query.

NameTypeReqDescription
topicstringyesWhich section to return (required — one section per call): - overview: what QQL is, overall query structure, subscription requirement - syntax: structure, ordering, custom fields, case-sensitivity, b…

No output schema declared.

No examples provided.

qql_search ~349

Search any entity with Qase Query Language: filtering, cross-project queries, sorting, and aggregation. This is the right tool for every question that is not "give me this one record by ID" — "cases without automation", "results that failed this week", "open blockers across projects" — and the right way to fetch many records at once instead of looping over qase_get. Call qql_help first for the syntax, the fields available per entity, and the enum values; a query naming an unknown attribute is rejected outright. Use qase_get instead when you already know the entity and its ID and want just that one. Cost: one API call. 0.5-0.9s for pages up to 50 records; a page of 100 measured 0.9-2.8s depending on how much each record carries. Prefer one search over N single fetches: the same ten records cost 1.2s here against 5.3s as ten qase_get calls.

NameTypeReqDescription
limitintegerMaximum number of results to return (default: 10, max: 100)
offsetintegerNumber of results to skip for pagination
querystringyesQQL query expression. Examples: - entity = "case" and project = "DEMO" and status = "Actual" - entity = "defect" and severity = "blocker" and status = "open" - entity = "result" and status = "failed"…
NameTypeReqDescription
entitiesarrayyesMatching entities
totalintegeryesTotal matching entities

No examples provided.

Common questions

What is the Qase Test Management MCP server?

Qase Test Management is an MCP server listed in the public MCP registry as io.qase/mcp-server. Official MCP server for Qase, manage test cases, runs, suites, defects via AI tools. This page covers its npm package (@qase/mcp-server).

Is the Qase Test Management MCP server safe to use?

Qase Test Management scores 92 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the Qase Test Management MCP server expose?

Qase Test Management exposes 14 tools: qase_api, qase_attachment_upload, qase_case_upsert, qase_ci_report, qase_defect_upsert, and 9 more. Their descriptions and schemas cost roughly 4,435 tokens of context every time the server is loaded.

Is the Qase Test Management MCP server still maintained?

Qase Test Management is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the Qase Test Management MCP server under?

Qase Test Management declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.