# QualityMax QA MCP (npm · @qualitymax/qmax-mcp)

Local QA MCP: scan URLs, inspect pages, generate Playwright repros, and run tests.

- Trust score: 47/100 (low)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-22

## Components

- npm · `@qualitymax/qmax-mcp`: 47/100 (this document), [markdown](https://verifymcp.io/servers/quality-max-qmax-mcp/qualitymax-qmax-mcp.md), [page](https://verifymcp.io/servers/quality-max-qmax-mcp/qualitymax-qmax-mcp)

## Channel facts

- Registry: `npm`
- Package: `@qualitymax/qmax-mcp`
- Version: `0.4.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-22.

- **Supply Chain Security**: 13/100
  - Malware scan not yet available for this package.
  - Known CVEs could not be checked: the version this server declares is not published in its registry.
  - No install/post-install scripts declared.
  - Dependency health could not be checked: the version this server declares is not published in its registry.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to Quality-Max/qmax-mcp).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 56/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 1154 tokens (~288/item across 4 items; 4 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 67/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 0% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add quality-max-qmax-mcp -- npx -y @qualitymax/qmax-mcp
```

### Codex

```bash
codex mcp add quality-max-qmax-mcp -- npx -y @qualitymax/qmax-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "quality-max-qmax-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@qualitymax/qmax-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add quality-max-qmax-mcp --command npx --arg -y --arg @qualitymax/qmax-mcp
```

### Hermes

```yaml
mcp_servers:
  quality-max-qmax-mcp:
    command: "npx"
    args: ["-y", "@qualitymax/qmax-mcp"]
```

### Other

```json
{
  "mcpServers": {
    "quality-max-qmax-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@qualitymax/qmax-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-22 (score 47)

First indexed and scored.

## MCP tools (4)

### `scan_url` (~144 tokens)

Scan URL

Inspect a URL with outbound browser and HTTP network requests for console errors, links, accessibility, Core Web Vitals, SEO, security headers, cookie and tracker privacy, mixed content, and page weight. This may write a local screenshot artifact when screenshot:true. Set format:"markdown" for a shareable graded report. allowPrivateNetwork:true is limited to deliberate loopback development targets.

Input parameters:

- `allowPrivateNetwork` (boolean)
- `checks` (array)
- `format` (string)
- `maxLinks` (integer)
- `screenshot` (boolean)
- `url` (string, required)
- `viewport` (object)
- `weightBudget` (object)

### `inspect_page` (~100 tokens)

Inspect Page

Read page structure through outbound browser network requests and return headings, forms, buttons, links, inputs, role/name selectors, and data-testid candidates. Does not intentionally modify the target or local filesystem. allowPrivateNetwork:true is limited to deliberate loopback development targets.

Input parameters:

- `allowPrivateNetwork` (boolean)
- `includeAccessibilityTree` (boolean)
- `includeForms` (boolean)
- `url` (string, required)
- `viewport` (object)

### `generate_playwright_repro` (~111 tokens)

Generate Playwright Repro

Generate a minimal Playwright test from a scan finding, URL, or plain-English goal and write it below the approved workspace directory .qmax-mcp/repros. outputPath must be relative; existing files require overwrite:true after review. No outbound network request is made by generation.

Input parameters:

- `finding` (object)
- `goal` (string)
- `outputPath` (string)
- `overwrite` (boolean)
- `testName` (string)
- `url` (string, required)

### `run_playwright_test` (~128 tokens)

Run Playwright Test

Execute supplied local Playwright code or a local test file. This is a code-execution and artifact-writing boundary: qmax-mcp first requires an MCP human-approval elicitation bound to the exact test digest. The runner may make outbound network requests requested by the test.

Input parameters:

- `allowedEnv` (object)
- `baseUrl` (string)
- `browser` (string)
- `code` (string)
- `headed` (boolean)
- `testPath` (string)
- `timeoutMs` (integer)
- `wallClockTimeoutMs` (integer)

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/quality-max-qmax-mcp/qualitymax-qmax-mcp#diagnostics

## Score history

- 2026-08-22: 47

## Links

- npm package: https://www.npmjs.com/package/@qualitymax/qmax-mcp
- Socket report: https://socket.dev/npm/package/@qualitymax/qmax-mcp
- Repository: https://github.com/Quality-Max/qmax-mcp
- Website: https://qualitymax.io/
- Changelog RSS feed: https://verifymcp.io/servers/quality-max-qmax-mcp/qualitymax-qmax-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/quality-max-qmax-mcp/qualitymax-qmax-mcp.json
- HTML version of this page: https://verifymcp.io/servers/quality-max-qmax-mcp/qualitymax-qmax-mcp