Qase Test Management

NPM · @QASE/MCP-SERVER · 2 COMPONENTS · SCANNED AUG 3

Official MCP server for Qase — manage test cases, runs, suites, defects via AI tools.

Available components

remote · mcp.qase.io 38 npm · @qase/mcp-server 76

+51 this week 76 76 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (250 of 313), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (250 of 313), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency97

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Cryptographically verified build provenance (signed, bound to qase-tms/qase-mcp-server). View diagnostics → Pass
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 10 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability80

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (excellent).Pass
Context-footprint check failed: tool/resource definitions use about 1938 tokens (~149/item across 13 items; 13 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management0

Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified

Tool Coverage90

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
64% of tool parameters carry a description.Partial
Structured output schemas are declared (46% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Unverified: 1 category

A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · @qase/mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add io-qase-mcp-server -- npx -y @qase/mcp-server

# add to Codex CLI

codex mcp add io-qase-mcp-server -- npx -y @qase/mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "io-qase-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@qase/mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add io-qase-mcp-server --command npx --arg -y --arg @qase/mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  io-qase-mcp-server:
    command: "npx"
    args: ["-y", "@qase/mcp-server"]

// mcp.json

{
  "mcpServers": {
    "io-qase-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@qase/mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

3 Aug 26 +2

No change was recorded against any check on this day. Supply Chain Security went from 83 to 87.
2 Aug 26 +69
- Install scripts: unverified → pass ▲ security
- Provenance: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- The attested source repository moved: qase-tms/qase-mcp-server security
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- Licence: MIT functional
1 Aug 26 −19
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
31 Jul 26 +18
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −22
- Malware scan: pass → unverified ▼ security
- Security disclosure: unverified → fail ▼ functional
- Dependency health: partial → unverified ▼ functional
29 Jul 26 +4
- Security disclosure: fail → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
28 Jul 26 −1
- Security disclosure: unverified → fail ▼ functional
- Dependency health: partial → unverified ▼ functional
26 Jul 26 25

First indexed and scored.

Show 5 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/@qase/[email protected]

Provenance verified

Ecosystem: npm · Outcome: verified

Reason: verified

Source repo:: qase-tms/qase-mcp-server
Certificate issuer:: https://token.actions.githubusercontent.com
Certificate SAN:: https://github.com/qase-tms/qase-mcp-server/.github/workflows/npm.yml@refs/tags/v2.0.0
Rekor log index:: 2224259335
Predicate type:: https://slsa.dev/provenance/v1
Subject digest:: sha512:bab3be82dc7b62d69d070f0eec17aba84a22ba87912a51309d3a809336df5d6d880f11106e92c4b6d6254bdcc6032678a73126fa1c15cdbe100a0db61
Discovery method:: attestation_endpoint

Dependencies 250 packages

250 packages in the resolved dependency tree · 155 deprecated · 65 stale · 1 without a linked repository.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 13 exposed · ~1,938 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

qase_api ~130

Direct Qase REST API call for endpoints not covered by other tools. Pass the HTTP method, path (starting with /v1/), and optional body/query. See https://developers.qase.io for API reference. Use this as an escape hatch when the dedicated tools do not cover your use case.

Input Output Examples

Name	Type	Req	Description
body	object	—	Request body for POST/PUT/PATCH
method	string	—	HTTP method
path	string	yes	API path starting with /v1/ (e.g., "/v1/project/DEMO/run")
query	object	—	Query parameters

No output schema declared.

No examples provided.

qase_case_upsert ~341

Create or update a test case. If `id` is provided, updates the existing case; if omitted, creates a new one. Enum fields (priority, severity, type, etc.) accept both labels ("high", "blocker") and numeric IDs — the server normalizes automatically.

Input Output Examples

Name	Type	Req	Description
attachments	array	—	—
automation	string	—	Automation status (label, slug, or numeric ID: 0=Manual / is-not-automated, 1=To be automated, 2=Automated)
behavior	string	—	Behavior label or numeric ID
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)
custom_field	object	—	—
description	string	—	—
id	integer	—	Case ID — if provided, updates the case; if omitted, creates a new one
is_flaky	boolean	—	—
layer	string	—	Layer label or numeric ID
milestone_id	integer	—	—
postconditions	string	—	—
preconditions	string	—	—
priority	string	—	Priority label or numeric ID (0=not set, 1=high, 2=medium, 3=low)
severity	string	—	Severity label or numeric ID
status	string	—	Status label or numeric ID
steps	array	—	—
steps_type	string	—	—
suite_id	integer	—	—
tags	array	—	—
title	string	yes	Test case title
type	string	—	Type label or numeric ID

No output schema declared.

No examples provided.

qase_ci_report ~153

Report CI/CD test results in one call: creates a run, records all results, and optionally completes the run. Replaces the 3-4 step manual workflow of create_run → bulk_create_results → complete_run. Designed for CI pipeline integration.

Input Output Examples

Name	Type	Req	Description
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)
complete	boolean	—	Complete the run after recording results (default: true)
environment_id	integer	—	—
is_autotest	boolean	—	Mark as automated run (default: true)
results	array	yes	Test results to record
title	string	yes	Run title (e.g., "CI Build #1234")

Name	Type	Req	Description
results_recorded	integer	yes	Number of results recorded
run_id	integer	yes	Created run ID
run_status	string	yes	—

No examples provided.

qase_defect_upsert ~157

Create or update a defect. If `id` is provided, updates (including status changes and resolve). If omitted, creates a new defect. Set `status: "resolved"` to resolve an existing defect.

Input Output Examples

Name	Type	Req	Description
actual_result	string	—	—
attachments	array	—	—
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)
custom_field	object	—	—
id	integer	—	Defect ID — if provided, updates; if omitted, creates
severity	string	—	—
status	string	—	Set to "resolved" to resolve the defect
tags	array	—	—
title	string	yes	Defect title

No output schema declared.

No examples provided.

qase_discover_tools ~122

Search for and activate additional Qase tools. By default, only core tools are visible. Use this to find tools for specific needs: deletions, milestone management, attachments, etc. Found tools are automatically activated and become available for use.

Input Output Examples

Name	Type	Req	Description
activate	boolean	—	If true (default), found tools are activated and become available for use
category	string	—	Filter by tool category
query	string	—	Search query to find tools by name or description. Examples: "delete", "milestone", "attachment", "suite"

Name	Type	Req	Description
activated	integer	yes	Number of newly activated tools
found	integer	yes	Number of matching tools
tools	array	yes	—

No examples provided.

qase_get ~149

Get any Qase entity by type and ID. Supports field projection via the `fields` parameter. For project-scoped entities (case, suite, run, result, plan, defect, milestone, environment, shared_step, shared_parameter, configuration), `code` is required. For global entities (user, author, attachment, custom_field), `code` can be omitted.

Input Output Examples

Name	Type	Req	Description
code	string	—	Project code (required for most entities)
entity	string	yes	Entity type to fetch
fields	array	—	Optional field projection — only return these top-level fields. Pass ["*"] for all fields.
id	—	yes	Entity ID (number) or hash (string)

No output schema declared.

No examples provided.

qase_project_context ~90

Get full project context in one call: project details, suites tree, milestones, environments, custom fields, and users. Cached for 5 minutes. Use this as the first call when starting work with a project — it seeds all the metadata the LLM needs without making 6 separate list calls.

Input Output Examples

Name	Type	Req	Description
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)

Name	Type	Req	Description
custom_fields	object	—	Custom fields list
environments	object	yes	Environments list
milestones	object	yes	Milestones list
project	object	yes	Project details
suites	object	yes	Suites list with entities array
users	object	—	Team members list

No examples provided.

qase_regression_run ~155

Set up a regression test run in one call. Accepts case selection by suite IDs, explicit case IDs, or plan ID. Creates the run and adds all matching cases. Replaces the multi-step workflow of find cases → create run → add cases.

Input Output Examples

Name	Type	Req	Description
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)
description	string	—	—
environment_id	integer	—	—
include_cases	array	—	Explicit case IDs to include
milestone_id	integer	—	—
plan_id	integer	—	Create run from an existing test plan
suite_ids	array	—	Include cases from these suites
title	string	yes	Run title

Name	Type	Req	Description
cases_added	integer	yes	Number of cases added to the run
run	object	—	Full run entity
run_id	integer	yes	Created run ID

No examples provided.

qase_result_record ~100

Record one or more test results into a run. Accepts an array of results — a single entry uses the single-result API, multiple entries use bulk. Each result must include a status; case_id is recommended.

Input Output Examples

Name	Type	Req	Description
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)
results	array	yes	One or more results to record
run_id	integer	yes	Run ID to record results into

No output schema declared.

No examples provided.

qase_run_upsert ~188

Create or update a test run. If `id` is provided, updates; if omitted, creates.

Input Output Examples

Name	Type	Req	Description
cases	array	—	Case IDs to include
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)
custom_field	object	—	—
description	string	—	—
end_time	string	—	RFC3339 end time
environment_id	integer	—	—
id	integer	—	Run ID — if provided, this is an update (note: Qase API has limited run update support)
is_autotest	boolean	—	—
milestone_id	integer	—	—
plan_id	integer	—	Test plan to base run on
start_time	string	—	RFC3339 start time
tags	array	—	—
title	string	yes	Run title

No output schema declared.

No examples provided.

qase_triage_defect ~152

Create a defect from a test failure and optionally link it to failed results. Streamlines the triage workflow: create defect → link to failing tests.

Input Output Examples

Name	Type	Req	Description
actual_result	string	—	Observed behavior
attachments	array	—	—
code	string	yes	Project code (2-10 uppercase letters, numbers, or underscores)
custom_field	object	—	—
description	string	—	—
failed_result_ids	array	—	Result hashes to link to this defect (from the run)
run_id	integer	—	Run containing the failed results
severity	string	—	—
tags	array	—	—
title	string	yes	Defect title

Name	Type	Req	Description
defect	object	—	Full defect entity
defect_id	integer	yes	Created defect ID
linked_results	integer	yes	Number of linked result hashes

No examples provided.

qql_help ~40

Get help and examples for Qase Query Language (QQL) syntax

Input Output Examples

Name	Type	Req	Description
topic	string	—	Specific help topic, or omit for general overview

No output schema declared.

No examples provided.

qql_search ~161

Search entities using Qase Query Language (QQL) with powerful filtering and cross-project queries

Input Output Examples

Name	Type	Req	Description
limit	integer	—	Maximum number of results to return (default: 10, max: 100)
offset	integer	—	Number of results to skip for pagination
query	string	yes	QQL query expression. Examples: - entity = "case" and project = "DEMO" and status = "Actual" - entity = "defect" and severity = "blocker" and status = "open" - entity = "result" and status = "failed"…

Name	Type	Req	Description
entities	array	yes	Matching entities
total	integer	yes	Total matching entities

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

26 Jul 3 Aug