Qase Test Management
NPM · @QASE/MCP-SERVER · 2 COMPONENTS
Official MCP server for Qase — manage test cases, runs, suites, defects via AI tools.
Available components
Last scanned (6 hours ago)
Scores higher than 93% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security94
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known medium-severity CVE affects glob 13.0.6, reached via npm > glob. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 60 of 243 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency100
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to qase-tms/qase-mcp-server). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 0 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability78
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 8407 tokens (~200/item across 42 items; 42 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management82
- Stability check failed: the tool surface changed between 2.7.4 and 3.0.6: 0 tool removals, 6 breaking changes, 25 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 13 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "qase_attachment_delete" implies "delete" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 43 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +15
- Malware scan: unverified → pass ▲ security
- 4 Nov 26 −15
- Malware scan: pass → unverified ▼ security
- Security disclosure: unverified → pass ▲ functional
- Package version: 3.0.4 → 3.0.6 functional
- 3 Nov 26 0
- Security disclosure: pass → unverified ▼ functional
- 31 Oct 26 +13
- CVE-2026-118773 affects this package: medium ▼ security
- CVE-2026-118764 affects this package: medium ▼ security
- Known CVEs: pass → fail ▼ security
- Malware scan: unverified → pass ▲ security
- 30 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 3.0.3 → 3.0.4 functional
- 29 Oct 26 +15
- Malware scan: unverified → pass ▲ security
- 28 Oct 26 −15
- Malware scan: pass → unverified ▼ security
- Package version: 3.0.2 → 3.0.3 functional
- 27 Oct 26 +15
- Malware scan: unverified → pass ▲ security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/@qase/mcp-server@3.0.6
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | qase-tms/qase-mcp-server |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/qase-tms/qase-mcp-server/.github/workflows/npm.yml@refs/tags/v3.0.6 |
| Rekor log index | 3688456620 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:6007975d70495ab312839a9acbe2072b9e412b741d1a7ebca61e487a90ed1ac8950dd8ca4692783f2e88d6fe0d0f1fd921bd48bbb674b536c63634200 |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 2 findings
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-3g3m-2fjr-6pw4 | CVE-2026-118773 | medium | yes | |
| GHSA-g3hv-75wg-m249 | CVE-2026-118764 | medium | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 243 packages
| Packages resolved | 243 |
|---|---|
| Deprecated | 1 |
| Stale | 59 |
| No linked repository | 1 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
qase_api Call Qase API ~160
Call any Qase REST endpoint directly, for the few things no dedicated tool covers: method, a /v1/… path on the configured host, optional body or query. Prefer a dedicated tool where one exists — they normalize enums and validate before spending a call. JSON only; uploads go through qase_attachment_upload. A DELETE asks for confirmation like the dedicated delete tools. Cost: one API call, 0.3-1.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| body | object | – | Request body for POST/PUT/PATCH |
| method | string | – | HTTP method |
| path | string | yes | API path starting with a version segment (e.g., "/v1/project/DEMO/run") |
| query | object | – | Query parameters |
No output schema declared.
No examples provided.
qase_attachment_delete Delete attachment ~71
Delete an attachment by its hash (from qase_attachment_upload). Anything referencing it keeps the reference but the file is gone; this cannot be undone. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| hash | string | yes | Attachment hash identifier |
No output schema declared.
No examples provided.
qase_attachment_upload Upload attachment ~294
Upload files and get back the hashes other tools reference them by. Pass `file_base64` plus `filename` for one file, or `files` for several in one request; `file_path` only works when the server runs on the same machine as the file — never on the hosted connector. The hash must then be passed in an `attachments` field; uploading alone attaches nothing. This is the only tool that sends multipart/form-data, which is why qase_api cannot send files. Cost: one API call per request, dominated by size.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| file | string | – | Deprecated: use file_base64 or file_path. Accepts an absolute path or base64 content. |
| file_base64 | string | – | Single-file form. File content, base64 encoded. Use this unless the server runs on the same machine as the file. |
| file_path | string | – | Single-file form. Absolute path on the machine running THIS server; a remote server cannot see it — send file_base64 instead. |
| filename | string | – | Original filename with extension. Required for the single-file form. |
| files | array | – | Several files in one request, each entry with its own filename plus file_base64 or file_path. One round trip, hashes returned in the same order. Limits and sizing are in qase_tool_help. |
No output schema declared.
No examples provided.
qase_case_bulk_create Bulk create test cases ~134
Create up to 100 test cases in one request — the batch form of qase_case_upsert, and the right tool whenever more than one case is being written. Same fields and enum handling as qase_case_upsert; creates only, update through qase_case_upsert with `id`. Cost: one API call regardless of batch size — ten cases measured 1.2s against 5.6s as ten separate calls.
| Name | Type | Req | Description |
|---|---|---|---|
| cases | array | yes | Test cases to create, 1 to 100 per call |
| code | string | yes | Project code, e.g. DEMO |
No output schema declared.
No examples provided.
qase_case_delete Delete test case ~96
Delete a test case by project code and ID. Its execution history goes with it and this cannot be undone; consider marking it deprecated through qase_case_upsert instead. No bulk delete — one call each, each asking the user for confirmation. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_case_upsert Create or update test case ~494
Create or update a single test case: with `id` it updates, without it creates. Enum fields accept a label such as "high" or the project's numeric ID. Writing more than one case? Use qase_case_bulk_create — one request instead of one per case. If the project has "Test case review" enabled, writes may need a review — run qase_discover_tools with "review". Cost: one API call, about 0.6s to create, 0.4s to update.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Hashes from qase_attachment_upload |
| automation | string | – | Automation: 0=Manual, 1=To be automated, 2=Automated (label or ID) |
| behavior | string | – | Behavior label or numeric ID |
| code | string | yes | Project code, e.g. DEMO |
| custom_field | object | – | Custom fields by ID, e.g. { "12": "value" } |
| description | string | – | Free-form description of what the case covers |
| id | integer | – | Case ID — if provided, updates the case; if omitted, creates a new one |
| is_flaky | string | – | Is flaky: 0=No, 1=Yes; a boolean works too. |
| layer | string | – | Layer label or numeric ID |
| milestone_id | integer | – | ID of the milestone the case belongs to |
| postconditions | string | – | State to restore or verify after the steps run |
| preconditions | string | – | State the system must be in before the steps run |
| priority | string | – | Priority label or numeric ID (0=not set, 1=high, 2=medium, 3=low) |
| severity | string | – | Severity label or numeric ID |
| status | string | – | Status label or numeric ID |
| steps | array | – | Ordered test steps; omit for a case without steps |
| steps_type | string | – | Step style: "classic" action/expected, or "gherkin" scenario text |
| suite_id | integer | – | ID of the suite that holds the case |
| tags | array | – | Tag names, e.g. ["smoke", "billing"] |
| title | string | yes | Test case title |
| type | string | – | Type label or numeric ID |
No output schema declared.
No examples provided.
qase_ci_report Report CI results ~201
Report a whole finished CI run in one call: creates the run, records every result, completes it. Use qase_result_record instead when the run already exists and results arrive in stages. Each result needs a numeric `case_id` and a status; batches over 200 are split for you, up to 2000. Cost: three API operations behind one call, about 0.7s for a small run.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| complete | boolean | – | Complete the run after recording results (default: true) |
| environment_id | integer | – | ID of the environment the build ran against |
| is_autotest | boolean | – | Mark as automated run (default: true) |
| results | array | yes | Test results to record, 1 to 2000 per call |
| title | string | yes | Run title (e.g., "CI Build #1234") |
No output schema declared.
No examples provided.
qase_custom_field_delete Delete custom field ~93
Delete a custom field by ID. Reach is workspace-wide: it disappears from every project, with the values entered for it, and this cannot be undone. To remove it from one project only, edit `projects_codes` with qase_custom_field_upsert. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_custom_field_upsert Create or update custom field ~319
Create or update a custom field. On create, `entity` (case, run, defect) and `type` are required and fixed forever — the update endpoint cannot change them. Fields are workspace-wide; scope with `projects_codes` or is_enabled_for_all_projects. Read existing fields with qase_project_context or qase_get. Cost: one call to create, two to update, 0.5-0.9s.
| Name | Type | Req | Description |
|---|---|---|---|
| default_value | string | – | Value a new entity gets when none is entered |
| entity | string | – | What the field is attached to. Required when creating; cannot be changed later |
| id | integer | – | Custom field ID — if provided, updates; if omitted, creates |
| is_enabled_for_all_projects | boolean | – | Apply to every project in the workspace, instead of only those in projects_codes |
| is_filterable | boolean | – | Whether the field can be used as a filter |
| is_required | boolean | – | Whether a value must be given on create |
| is_visible | boolean | – | Whether the field is shown on the entity |
| placeholder | string | – | Hint shown in the empty field |
| projects_codes | array | – | Projects the field applies to. Ignored when is_enabled_for_all_projects is true |
| title | string | yes | Field title |
| type | string | – | Field type. Required when creating; cannot be changed later |
| value | array | – | Option titles — required for selectbox, radio and multiselect |
No output schema declared.
No examples provided.
qase_defect_delete Delete defect ~102
Delete a defect by project code and ID; its links to results go with it and this cannot be undone. Usually resolving it through qase_defect_upsert with `id` is the right move, so the record survives. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_defect_upsert Create or update defect ~254
Create or update a defect: with `id` it updates, without it creates, and then `title`, `actual_result` and `severity` are required. Severity and status are labels ("blocker", "open"…), mapped for you. For a defect born from a specific test failure use qase_triage_defect; search with qql_search before filing a duplicate. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| actual_result | string | – | What actually happened — required when creating a defect |
| attachments | array | – | Hashes from qase_attachment_upload |
| code | string | yes | Project code, e.g. DEMO |
| custom_field | object | – | Custom fields by ID, e.g. { "12": "value" } |
| id | integer | – | Defect ID — if provided, updates; if omitted, creates |
| severity | string | – | How bad the defect is — required when creating a defect |
| status | string | – | Set to "resolved" to resolve the defect |
| tags | array | – | Tag names, e.g. ["regression", "payments"] |
| title | string | yes | Defect title |
No output schema declared.
No examples provided.
qase_discover_tools Discover more tools ~133
Search the tool catalogue by what you are trying to do — "delete", "milestone", "review", "custom field" — and get back the matching tools with their descriptions. Every tool is already listed and callable; use this when you do not know which one fits, rather than re-reading the whole list. Cost: no API call, matching happens in memory, about 3ms.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Filter by tool category |
| query | string | – | Search query to find tools by name or description. Examples: "delete", "milestone", "attachment", "suite" |
No output schema declared.
No examples provided.
qase_environment_delete Delete environment ~86
Delete an environment by project code and ID. Runs that referenced it lose the attribution, so filtering history by that environment stops working; this cannot be undone. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_environment_upsert Create or update environment ~142
Create or update an environment — a named target such as staging or production that runs are attributed to. With `id` it updates, without it creates. Existing environments come back from qase_project_context. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| description | string | – | Free-form description of the environment |
| host | string | – | Environment host/URL |
| id | integer | – | Environment ID — if provided, updates; if omitted, creates |
| slug | string | – | URL-friendly identifier |
| title | string | yes | Environment title |
No output schema declared.
No examples provided.
qase_external_issue_link Link external issue ~163
Link or unlink test cases and runs to issues in Jira Cloud or Jira Server — the only trackers supported. A case may link several issues; a run holds one, and a new link replaces it. Read links back with qase_get. Cost: one API call for the whole set of links, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | yes | attach creates the link, detach removes it (for runs, clears the single link) |
| code | string | yes | Project code, e.g. DEMO |
| entity | string | yes | Entity to link — test case or test run |
| links | array | yes | Entities to link, processed in a single API request |
| type | string | yes | Issue tracker integration configured for the project |
No output schema declared.
No examples provided.
qase_get Get record ~231
Fetch one known record by type and ID — case, suite, run, result, plan, defect, milestone, environment, shared_step, review, custom_field and more. Use it only when you already have the ID and want that one record; for several, anything filtered, or a loop over IDs, use qql_search — one search returns the whole page. Cost: one API call, 0.3-0.5s; ten in sequence measured 5.3s against 1.2s for one qql_search.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | – | Project code (required for most entities) |
| entity | string | yes | Entity type to fetch |
| fields | array | – | Optional field projection — only return these top-level fields. Pass ["*"] for all fields. |
| id | – | yes | Entity ID (number) or hash (string) |
| include | string | – | Comma-separated list of related entities to include in the response. Cases and runs already request their external issue links by default ("external_issues" / "external_issue"); pass this only to ove… |
No output schema declared.
No examples provided.
qase_milestone_delete Delete milestone ~90
Delete a milestone by project code and ID. Runs and cases keep existing but lose the association, so release reporting built on it stops working; this cannot be undone. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_milestone_upsert Create or update milestone ~153
Create or update a milestone — a dated marker, typically a release, that runs and cases are grouped under. With `id` it updates, without it creates. Existing milestones come back from qase_project_context. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| description | string | – | Free-form description of the milestone |
| due_date | number | – | Due date as Unix timestamp |
| id | integer | – | Milestone ID — if provided, updates; if omitted, creates |
| status | string | – | active (default) or completed |
| title | string | yes | Milestone title |
No output schema declared.
No examples provided.
qase_plan_delete Delete test plan ~105
Delete a test plan by project code and ID. Only the plan goes — its cases and the runs made from it stay — but anything launching it by ID breaks; this cannot be undone. To change its cases use qase_plan_upsert instead. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_plan_upsert Create or update test plan ~148
Create or update a test plan — a named, reusable set of case IDs such as a smoke or regression pack. With `id` it updates, without it creates. qase_regression_run turns a plan into a run in one call. Cost: one API call, about 0.5s, growing with the number of cases.
| Name | Type | Req | Description |
|---|---|---|---|
| cases | array | – | Case IDs to include |
| code | string | yes | Project code, e.g. DEMO |
| description | string | – | Free-form description of the plan |
| id | integer | – | Plan ID — if provided, updates; if omitted, creates |
| title | string | yes | Test plan title |
No output schema declared.
No examples provided.
qase_project_context Project context ~167
Seed everything about a project in one call: details, the full suite tree, milestones, environments, custom fields and users — make it first when starting on a project. Each collection returns its first 100; check `coverage` and pass `full: true` to page. For one record by ID qase_get is cheaper; for filtered questions use qql_search. Cost: six API calls behind one, 0.5-1.3s cold, cached 5 minutes.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| full | boolean | – | Page through every collection instead of the first 100 of each (default: false). Use it when `coverage` reports one truncated; see qase_tool_help for what it costs. |
No output schema declared.
No examples provided.
qase_project_create Create project ~171
Create a project. The code must be unique in the workspace, and there is no update endpoint afterwards — title, code and access cannot be changed through the API, so choose them deliberately. Read an existing project with qase_project_context. Cost: one API call, about 1.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| access | string | – | Who can access the project: everyone, a team group, or nobody but the owner |
| code | string | yes | Project code — unique per workspace, 2 to 10 characters of uppercase letters, digits or underscores |
| description | string | – | Free-form description of the project |
| group | string | – | Team group hash — required when access is "group" |
| settings | object | – | Additional project settings |
| title | string | yes | Project title |
No output schema declared.
No examples provided.
qase_project_delete Delete project ~103
Delete an entire project by code — every case, suite, run, result, defect and milestone in it, with no trash to recover from; this cannot be undone. The most destructive call in the API; confirm the code with qase_project_context first. Asks the user for confirmation and does not proceed without it. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
No output schema declared.
No examples provided.
qase_regression_run Build regression run ~198
Build and start a test run from a suite, a plan, or an explicit list of case IDs, in one step — it resolves the cases itself. It opens a run, it does not close one: for a finished pipeline use qase_ci_report; to assemble a run by hand use qase_run_upsert. Cost: two API calls behind one, about 1s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| description | string | – | What this regression run covers |
| environment_id | integer | – | ID of the environment the run executes against |
| include_cases | array | – | Explicit case IDs to include |
| milestone_id | integer | – | ID of the milestone the run belongs to |
| plan_id | integer | – | Create run from an existing test plan |
| suite_ids | array | – | Include cases from these suites |
| title | string | yes | Run title |
No output schema declared.
No examples provided.
qase_result_delete Delete test result ~112
Delete one result from a run, by run ID and result hash. The case and the rest of the run are untouched; pass rates shift and this cannot be undone. To discard a whole run use qase_run_delete. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| hash | string | yes | Result hash to delete |
| run_id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_result_record Record test results ~147
Record up to 200 results into an existing run — status, duration, comment, stacktrace, attachments — in one call, not one per test. Status is a label only: passed, failed, blocked, skipped, invalid. If the run does not exist yet and the job is finished, qase_ci_report creates, records and completes in one call. Cost: one API call for the whole list, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| results | array | yes | Results to record, 1 to 200 per call |
| run_id | integer | yes | Run ID to record results into |
No output schema declared.
No examples provided.
qase_review_bulk_create Bulk create case reviews ~147
Open several test case reviews in one request — the batch form of qase_review_create, for proposing more than one change. Same fields as qase_review_create; `case_id` for an edit review, omitted for a create review. The API has no endpoints for approving, merging or declining — those are UI-only; read status with qase_review_list. Cost: one API call regardless of batch size.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| reviews | array | yes | Reviews to open. Validated as a whole: if any item is invalid, NOTHING is created. Once valid, each item is processed individually and reported separately. |
No output schema declared.
No examples provided.
qase_review_create Create case review ~571
Open a test case review — the pull-request flow for cases. Pass `case_id` to propose changes to an existing case (send only the fields that change), or omit it to propose a new one. Several at once? Use qase_review_bulk_create. The API has no endpoints for approving, merging or declining — those are UI-only; read status with qase_review_list. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Hashes from qase_attachment_upload |
| automation | string | – | Automation: 0=Manual, 1=To be automated, 2=Automated (label or ID) |
| behavior | string | – | Behavior label or numeric ID |
| case_id | integer | – | Test case to propose changes to. With it, an "edit" review is created and only the fields being changed need to be sent. Without it, a "create" review is opened for a brand-new case draft and `title`… |
| code | string | yes | Project code, e.g. DEMO |
| custom_field | object | – | Custom fields by ID, e.g. { "12": "value" } |
| description | string | – | Free-form description of what the case covers |
| is_flaky | string | – | Is flaky: 0=No, 1=Yes; a boolean works too. |
| layer | string | – | Layer label or numeric ID |
| milestone_id | integer | – | ID of the milestone the case belongs to |
| postconditions | string | – | State to restore or verify after the steps run |
| preconditions | string | – | State the system must be in before the steps run |
| priority | string | – | Priority label or numeric ID (0=not set, 1=high, 2=medium, 3=low) |
| reviewers | array | – | Reviewers: AUTHOR UUIDs (see qase_get { entity: "author" }) or emails, which resolve to them. Not user IDs. The token owner authors the review and cannot review their own review. Omit to assign them… |
| severity | string | – | Severity label or numeric ID |
| status | string | – | Status label or numeric ID |
| steps | array | – | Ordered test steps; omit for a case without steps |
| steps_type | string | – | Step style: "classic" action/expected, or "gherkin" scenario text |
| suite_id | integer | – | ID of the suite that holds the case |
| tags | array | – | Tag names, e.g. ["smoke", "billing"] |
| title | string | – | Test case title |
| type | string | – | Type label or numeric ID |
No output schema declared.
No examples provided.
qase_review_delete Delete case review ~95
Delete a review by ID. This removes the proposal entirely — it does not decline it, and declining is UI-only — and merged reviews cannot be deleted; the referenced case is untouched. Cannot be undone; asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Review ID |
No output schema declared.
No examples provided.
qase_review_list List case reviews ~222
List a project's reviews with their current state — the only way to learn what happened to a review you opened, since the API has no endpoints for approving or merging — those are UI-only. Filter by status to see what is still open. For one review by ID, qase_get is cheaper. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| author_uuid | string | – | Only reviews opened by this author UUID |
| case_id | integer | – | Only reviews of this test case |
| code | string | yes | Project code, e.g. DEMO |
| limit | integer | – | Default 25, max 100 |
| offset | integer | – | Skip this many reviews, for paging |
| reviewer_uuid | string | – | Only reviews this author UUID is a reviewer on |
| search | string | – | Substring match on the review title |
| status | string | – | Only reviews in this state |
| type | string | – | "create" proposes a new case, "edit" proposes changes to an existing one |
No output schema declared.
No examples provided.
qase_review_update Update case review ~490
Update an open review: the proposed case fields, the reviewers, or both, by review ID. IMPORTANT: changing the proposal RESETS every approval already given; updating only `reviewers` keeps them. The API has no endpoints for approving, merging or declining — those are UI-only; read status with qase_review_list. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| attachments | array | – | Hashes from qase_attachment_upload |
| automation | string | – | Automation: 0=Manual, 1=To be automated, 2=Automated (label or ID) |
| behavior | string | – | Behavior label or numeric ID |
| code | string | yes | Project code, e.g. DEMO |
| custom_field | object | – | Custom fields by ID, e.g. { "12": "value" } |
| description | string | – | Free-form description of what the case covers |
| id | integer | yes | Review ID |
| is_flaky | string | – | Is flaky: 0=No, 1=Yes; a boolean works too. |
| layer | string | – | Layer label or numeric ID |
| milestone_id | integer | – | ID of the milestone the case belongs to |
| postconditions | string | – | State to restore or verify after the steps run |
| preconditions | string | – | State the system must be in before the steps run |
| priority | string | – | Priority label or numeric ID (0=not set, 1=high, 2=medium, 3=low) |
| reviewers | array | – | Replaces the current reviewer list; an empty array removes everyone. Omit to leave it unchanged. Author UUIDs or emails. Changing ONLY reviewers keeps existing approvals. |
| severity | string | – | Severity label or numeric ID |
| status | string | – | Status label or numeric ID |
| steps | array | – | Ordered test steps; omit for a case without steps |
| steps_type | string | – | Step style: "classic" action/expected, or "gherkin" scenario text |
| suite_id | integer | – | ID of the suite that holds the case |
| tags | array | – | Tag names, e.g. ["smoke", "billing"] |
| title | string | – | Test case title |
| type | string | – | Type label or numeric ID |
No output schema declared.
No examples provided.
qase_run_complete Complete test run ~98
Mark a test run complete so it reports as finished. It is a reporting state, not a lock — results recorded afterwards still land and change its counts. If all results are in hand at once, qase_ci_report does this as its final step. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_run_delete Delete test run ~103
Delete a test run by project code and ID, together with every result in it; this cannot be undone. Rarely what you want: to stop accepting results use qase_run_complete, to fix one result use qase_result_delete. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_run_upsert Create or update test run ~307
Create or update a test run — the container results are recorded into, so open it before qase_result_record. Scope it to a milestone, environment, plan or case list. To build one from a suite or plan use qase_regression_run; for a finished CI job use qase_ci_report, which opens, records and closes in one call. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| cases | array | – | Case IDs to include |
| code | string | yes | Project code, e.g. DEMO |
| custom_field | object | – | Custom fields by ID, e.g. { "12": "value" } |
| description | string | – | What this run covers |
| end_time | string | – | RFC3339 end time |
| environment_id | integer | – | ID of the environment the run executes against |
| id | integer | – | Run ID — if provided, this is an update (note: Qase API has limited run update support) |
| is_autotest | boolean | – | True when the run is produced by automation rather than a person |
| milestone_id | integer | – | ID of the milestone the run belongs to |
| plan_id | integer | – | Test plan to base run on |
| start_time | string | – | RFC3339 start time |
| tags | array | – | Tag names, e.g. ["nightly", "smoke"] |
| title | string | yes | Run title |
No output schema declared.
No examples provided.
qase_shared_step_delete Delete shared step ~106
Delete a shared step by project code and hash. Every case referencing it loses those steps, so the reach is far wider than one record; check references first. Cannot be undone; to change content use qase_shared_step_upsert instead. Asks the user for confirmation first. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| hash | string | yes | Shared step hash identifier |
No output schema declared.
No examples provided.
qase_shared_step_upsert Create or update shared step ~139
Create or update a shared step — a block of steps written once and reused across cases. With `hash` it updates, without it creates; shared steps are identified by hash, which qase_case_upsert takes in a step's `shared` field. Updating changes every referencing case. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| hash | string | – | Shared step hash — if provided, updates; if omitted, creates |
| steps | array | – | Array of step definitions |
| title | string | yes | Shared step title |
No output schema declared.
No examples provided.
qase_suite_delete Delete suite ~148
Delete a test suite by project code and ID. WARNING: the cases inside, and any child suites, are deleted with it along with their history, and `delete_cases` currently has no effect. Read the tree from qase_project_context and move what matters first. Asks the user for confirmation. Cost: one API call, about 0.4s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| delete_cases | boolean | – | Has no effect today: the server sends a field this endpoint does not accept, so the cases are deleted either way. Kept so existing callers do not break. |
| id | integer | yes | Entity ID |
No output schema declared.
No examples provided.
qase_suite_upsert Create or update suite ~171
Create or update a test suite — the folder cases live in. With `id` it updates, without it creates; nest with `parent_id`. The existing tree comes back from qase_project_context, so read it rather than guess parent IDs. Cost: one API call, about 0.5s.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | Project code, e.g. DEMO |
| description | string | – | What this suite groups — shown under the suite title in the tree |
| id | integer | – | Suite ID — if provided, updates; if omitted, creates |
| parent_id | integer | – | Parent suite ID for nesting |
| preconditions | string | – | Setup every case in this suite assumes, inherited by its child suites |
| title | string | yes | Suite title |
No output schema declared.
No examples provided.
qase_tool_help Tool documentation ~125
Read the full documentation of one tool before calling it for the first time in a session. Every description in the tool list is deliberately short — what the tool is for and what it costs — and the details that prevent a wrong first call live here: argument semantics, limits, what cannot be undone, and which tool to use instead. Pass the tool name exactly as listed. Cost: no API call, static text, about 1ms. Cheaper than one rejected call.
| Name | Type | Req | Description |
|---|---|---|---|
| tool | string | yes | The tool name, exactly as it appears in the tool list |
No output schema declared.
No examples provided.
qase_triage_defect Triage failure into defect ~216
Create a defect from a test failure with the context written into it; `title`, `actual_result` and `severity` are required. The API has no way to attach runs or results to a defect — reference them in actual_result. For a defect unrelated to a failure use qase_defect_upsert. Cost: one API call, about 0.5s; file one defect per distinct cause.
| Name | Type | Req | Description |
|---|---|---|---|
| actual_result | string | yes | Observed behavior. Required by the API |
| attachments | array | – | Hashes from qase_attachment_upload |
| code | string | yes | Project code, e.g. DEMO |
| custom_field | object | – | Custom fields by ID, e.g. { "12": "value" } |
| description | string | – | Extra context beyond the observed behavior |
| severity | string | yes | Required by the API |
| tags | array | – | Tag names, e.g. ["regression", "payments"] |
| title | string | yes | Defect title |
No output schema declared.
No examples provided.
qql_help QQL syntax help ~272
Read the QQL reference before writing a query. Pass a `topic`: overview, syntax, entities, operators, functions, examples, aggregation or enumValues. Field names differ per entity and from the write tools, and a query naming an unknown attribute is rejected — read `entities` first. Cost: no API call, about 2ms; cheaper than one rejected qql_search.
| Name | Type | Req | Description |
|---|---|---|---|
| topic | string | yes | Which section to return (required — one section per call): - overview: what QQL is, overall query structure, subscription requirement - syntax: structure, ordering, custom fields, case-sensitivity, b… |
No output schema declared.
No examples provided.
qql_search Search with QQL ~245
Search any entity with Qase Query Language — filtering, cross-project, sorting, aggregation — and the right way to fetch many records at once instead of looping over qase_get. Call qql_help first for syntax, fields and enum values. Use qase_get when you already know the one ID you want. Cost: one API call, 0.5-0.9s per page; ten records here cost 1.2s against 5.3s as ten qase_get calls.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of results to return (default: 10, max: 100) |
| offset | integer | – | Number of results to skip for pagination |
| query | string | yes | QQL query expression. Examples: - entity = "case" and project = "DEMO" and status = "Actual" - entity = "defect" and severity = "blocker" and status = "open" - entity = "result" and status = "failed"… |
No output schema declared.
No examples provided.
How do I install the Qase Test Management MCP server?
Qase Test Management runs locally as an npm package, launched with npx -y @qase/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @qase/mcp-server
claude mcp add io-qase-mcp-server -- npx -y @qase/mcp-server
What is the Qase Test Management MCP server?
Qase Test Management is an MCP server listed in the public MCP registry as io.qase/mcp-server. Official MCP server for Qase, manage test cases, runs, suites, defects via AI tools. This page covers its npm package (@qase/mcp-server).
Is the Qase Test Management MCP server safe to use?
Qase Test Management scores 90 out of 100 on VerifyMCP. We recorded 2 known advisories against it as of 5 November 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Qase Test Management MCP server expose?
Qase Test Management exposes 42 tools: qase_api, qase_attachment_delete, qase_attachment_upload, qase_case_bulk_create, qase_case_delete, and 37 more. Their descriptions and schemas cost roughly 7,822 tokens of context every time the server is loaded.
Is the Qase Test Management MCP server still maintained?
Qase Test Management is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Qase Test Management MCP server under?
Qase Test Management declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.