@browserstack/mcp-server 1.2.33-beta.2 → 1.2.34-beta.1

package/dist/lib/elicit-credentials.d.ts

@@ -0,0 +1,21 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export interface CredentialField {
+    key: string;
+    title: string;
+    description: string;
+}
+/**
+ * Collects credential values for a tool WITHOUT routing them through the model.
+ *
+ * When the connected client advertises MCP elicitation support, any requested
+ * field the caller did not already supply is requested directly from the user
+ * via the client — the value flows user -> client -> server and never appears in
+ * the LLM's tool-call arguments, context, or logs.
+ *
+ * When the client does not support elicitation, or the user declines/cancels, or
+ * the request errors, the values are returned exactly as provided. This keeps the
+ * existing argument-based flow working unchanged (backward compatible), and makes
+ * the helper safe to ship to transports that cannot elicit (it degrades to the
+ * arg path rather than failing).
+ */
+export declare function elicitCredentialsIfSupported(server: McpServer, provided: Record<string, string | undefined>, fields: CredentialField[], message: string): Promise<Record<string, string | undefined>>;

package/dist/lib/elicit-credentials.js

@@ -0,0 +1,66 @@
+import logger from "../logger.js";
+/**
+ * Collects credential values for a tool WITHOUT routing them through the model.
+ *
+ * When the connected client advertises MCP elicitation support, any requested
+ * field the caller did not already supply is requested directly from the user
+ * via the client — the value flows user -> client -> server and never appears in
+ * the LLM's tool-call arguments, context, or logs.
+ *
+ * When the client does not support elicitation, or the user declines/cancels, or
+ * the request errors, the values are returned exactly as provided. This keeps the
+ * existing argument-based flow working unchanged (backward compatible), and makes
+ * the helper safe to ship to transports that cannot elicit (it degrades to the
+ * arg path rather than failing).
+ */
+export async function elicitCredentialsIfSupported(server, provided, fields, message) {
+    const missing = fields.filter((field) => !provided[field.key]);
+    if (missing.length === 0) {
+        return provided;
+    }
+    // Only attempt elicitation when the client explicitly supports it; otherwise
+    // fall back to the caller-provided values (existing behavior).
+    const capabilities = server.server.getClientCapabilities();
+    if (!capabilities?.elicitation) {
+        return provided;
+    }
+    const properties = {};
+    for (const field of missing) {
+        properties[field.key] = {
+            type: "string",
+            title: field.title,
+            description: field.description,
+        };
+    }
+    let result;
+    try {
+        result = await server.server.elicitInput({
+            mode: "form",
+            message,
+            requestedSchema: {
+                type: "object",
+                properties,
+                required: missing.map((field) => field.key),
+            },
+        });
+    }
+    catch {
+        // A client that advertised elicitation but failed to handle it must not
+        // break the tool — fall back to whatever was provided. The error is not
+        // logged: a client validation error can echo the submitted form values
+        // (including the password), which must never reach the logs.
+        logger.warn("Elicitation request failed; falling back to provided values.");
+        return provided;
+    }
+    if (result.action !== "accept" || !result.content) {
+        return provided;
+    }
+    const merged = { ...provided };
+    for (const field of missing) {
+        const value = result.content[field.key];
+        if (typeof value === "string" && value.length > 0) {
+            merged[field.key] = value;
+        }
+    }
+    return merged;
+}

package/dist/tools/accessibility.js

@@ -6,6 +6,7 @@ import { trackMCP } from "../lib/instrumentation.js";
 import { parseAccessibilityReportFromCSV } from "./accessiblity-utils/report-parser.js";
 import { queryAccessibilityRAG } from "./accessiblity-utils/accessibility-rag.js";
 import { getBrowserStackAuth } from "../lib/get-auth.js";
+import { elicitCredentialsIfSupported } from "../lib/elicit-credentials.js";
 import logger from "../logger.js";
 function setupAuth(config) {
     const authString = getBrowserStackAuth(config);
@@ -235,8 +236,14 @@ export default function addAccessibilityTools(server, config) {
             .enum(["form", "basic"])
             .describe("Authentication type: 'form' for form-based auth, 'basic' for HTTP basic auth"),
         url: z.string().describe("URL of the authentication page"),
-        username: z.string().describe("Username for authentication"),
-        password: z.string().describe("Password for authentication"),
+        username: z
+            .string()
+            .optional()
+            .describe("Site username; omit to have it requested from the user."),
+        password: z
+            .string()
+            .optional()
+            .describe("Site password; omit to have it requested from the user."),
         usernameSelector: z
             .string()
             .optional()
@@ -250,7 +257,33 @@ export default function addAccessibilityTools(server, config) {
             .optional()
             .describe("CSS selector for submit button (required for form auth)"),
     }, async (args) => {
-        return await executeCreateAuthConfig(args, server, config);
+        try {
+            const creds = await elicitCredentialsIfSupported(server, { username: args.username, password: args.password }, [
+                {
+                    key: "username",
+                    title: "Site username",
+                    description: `Username for the login being configured ("${args.name}")`,
+                },
+                {
+                    key: "password",
+                    title: "Site password",
+                    description: `Password for the login being configured ("${args.name}")`,
+                },
+            ], `Enter the login credentials for accessibility auth config "${args.name}".`);
+            if (!creds.username || !creds.password) {
+                const error = new Error("Username and password are required to create an auth config. Provide them when prompted, or pass them as arguments.");
+                trackMCP("createAccessibilityAuthConfig", server.server.getClientVersion(), error, config);
+                return createErrorResponse(error.message);
+            }
+            return await executeCreateAuthConfig({
+                ...args,
+                username: creds.username,
+                password: creds.password,
+            }, server, config);
+        }
+        catch (error) {
+            return handleMCPError("createAccessibilityAuthConfig", server, config, error);
+        }
     });
     tools.getAccessibilityAuthConfig = server.tool("getAccessibilityAuthConfig", "Retrieve an existing authentication configuration by ID.", {
         configId: z.number().describe("ID of the auth configuration to retrieve"),

package/dist/tools/testmanagement-utils/create-lca-steps.d.ts

@@ -8,6 +8,7 @@ export declare const CreateLCAStepsSchema: z.ZodObject<{
     project_identifier: z.ZodString;
     test_case_identifier: z.ZodString;
     base_url: z.ZodString;
+    requires_authentication: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
     credentials: z.ZodOptional<z.ZodObject<{
         username: z.ZodString;
         password: z.ZodString;

package/dist/tools/testmanagement-utils/create-lca-steps.js

@@ -15,13 +15,18 @@ export const CreateLCAStepsSchema = z.object({
         .string()
         .describe("Identifier of the test case (e.g., 'TC-12345')"),
     base_url: z.string().describe("Base URL for the test (e.g., 'google.com')"),
+    requires_authentication: z
+        .boolean()
+        .optional()
+        .default(false)
+        .describe("Set true if the test case requires login."),
     credentials: z
         .object({
         username: z.string().describe("Username for authentication"),
         password: z.string().describe("Password for authentication"),
     })
         .optional()
-        .describe("Optional credentials for authentication. Extract from the test case details if provided in it. This is required for the test cases which require authentication."),
+        .describe("Login credentials; omit to have them requested from the user."),
     local_enabled: z
         .boolean()
         .optional()

package/dist/tools/testmanagement.js

@@ -18,6 +18,7 @@ import { listTestPlans, ListTestPlansSchema, } from "./testmanagement-utils/list
 import { getTestPlan, GetTestPlanSchema, } from "./testmanagement-utils/get-testplan.js";
 import { listSubTestPlans, ListSubTestPlansSchema, } from "./testmanagement-utils/list-sub-testplans.js";
 import { getSubTestPlan, GetSubTestPlanSchema, } from "./testmanagement-utils/get-sub-testplan.js";
+import { elicitCredentialsIfSupported } from "../lib/elicit-credentials.js";
 //TODO: Moving the traceMCP and catch block to the parent(server) function
 /**
  * Wrapper to call createProjectOrFolder util.
@@ -284,7 +285,46 @@ export async function createTestCasesFromFileTool(args, context, config, server)
 export async function createLCAStepsTool(args, context, config, server) {
     try {
         trackMCP("createLCASteps", server.server.getClientVersion(), undefined, config);
-        return await createLCASteps(args, context, config);
+        let effectiveArgs = args;
+        if (args.requires_authentication &&
+            (!args.credentials?.username || !args.credentials?.password)) {
+            const creds = await elicitCredentialsIfSupported(server, {
+                username: args.credentials?.username,
+                password: args.credentials?.password,
+            }, [
+                {
+                    key: "username",
+                    title: "Login username",
+                    description: `Username for test case ${args.test_case_identifier}`,
+                },
+                {
+                    key: "password",
+                    title: "Login password",
+                    description: `Password for test case ${args.test_case_identifier}`,
+                },
+            ], `Enter the login credentials for test case ${args.test_case_identifier}.`);
+            if (creds.username && creds.password) {
+                effectiveArgs = {
+                    ...args,
+                    credentials: { username: creds.username, password: creds.password },
+                };
+            }
+            else {
+                // requires_authentication was requested but no credentials could be
+                // obtained (client can't elicit, or the user declined). Fail clearly
+                // rather than creating a login test case with no credentials.
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: `Authentication is required for test case ${args.test_case_identifier}, but no credentials were provided. Provide them when prompted, or pass them as arguments.`,
+                        },
+                    ],
+                    isError: true,
+                };
+            }
+        }
+        return await createLCASteps(effectiveArgs, context, config);
     }
     catch (err) {
         trackMCP("createLCASteps", server.server.getClientVersion(), err, config);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browserstack/mcp-server",
-  "version": "1.2.33-beta.2",
+  "version": "1.2.34-beta.1",
   "description": "BrowserStack's Official MCP Server",
   "mcpName": "io.github.browserstack/mcp-server",
   "main": "dist/index.js",