@browserstack/mcp-server 1.4.0-beta.3 → 1.4.0

package/dist/tools/review-agent.js

@@ -1,3 +1,4 @@
+import { wrapUntrusted } from "../lib/untrusted-content.js";
 import { getBrowserStackAuth } from "../lib/get-auth.js";
 import { getPercyBuildCount } from "./review-agent-utils/build-counts.js";
 import { getChangedPercySnapshotIds } from "./review-agent-utils/percy-snapshots.js";
@@ -50,7 +51,7 @@ export async function fetchPercyChanges(args, config) {
     return {
         content: allDiffs.map((diff) => ({
             type: "text",
-            text: `${diff.name} → ${diff.title}: ${diff.description ?? ""}`,
+            text: wrapUntrusted("Percy AI visual-diff description", `${diff.name} → ${diff.title}: ${diff.description ?? ""}`),
         })),
     };
 }

package/dist/tools/sdk-utils/common/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const IMPORTANT_SETUP_WARNING = "IMPORTANT: DO NOT SKIP ANY STEP. All the setup steps described below MUST be executed regardless of any existing configuration or setup. This ensures proper BrowserStack SDK setup.";
+export declare const IMPORTANT_SETUP_WARNING: string;
 export declare const SETUP_PERCY_DESCRIPTION = "Set up or expand Percy visual testing configuration with comprehensive coverage for existing projects that might have Percy integrated. This supports both Percy Web Standalone and Percy Automate. Example prompts: Expand percy coverage for this project {project_name}";
 export declare const LIST_TEST_FILES_DESCRIPTION = "Lists all test files for a given set of directories.";
 export declare const PERCY_SNAPSHOT_COMMANDS_DESCRIPTION = "Adds Percy snapshot commands to the specified test files.";

package/dist/tools/sdk-utils/common/constants.js

@@ -1,4 +1,5 @@
-export const IMPORTANT_SETUP_WARNING = "IMPORTANT: DO NOT SKIP ANY STEP. All the setup steps described below MUST be executed regardless of any existing configuration or setup. This ensures proper BrowserStack SDK setup.";
+export const IMPORTANT_SETUP_WARNING = "IMPORTANT: DO NOT SKIP ANY STEP. All the setup steps described below MUST be executed regardless of any existing configuration or setup. This ensures proper BrowserStack SDK setup. " +
+    "If you cannot run commands or edit files in the user's project (e.g. a chat-only client), present every step below to the user in full — including each shell command, the package.json changes, and the complete browserstack.yml contents — instead of summarizing them.";
 export const SETUP_PERCY_DESCRIPTION = "Set up or expand Percy visual testing configuration with comprehensive coverage for existing projects that might have Percy integrated. This supports both Percy Web Standalone and Percy Automate. Example prompts: Expand percy coverage for this project {project_name}";
 export const LIST_TEST_FILES_DESCRIPTION = "Lists all test files for a given set of directories.";
 export const PERCY_SNAPSHOT_COMMANDS_DESCRIPTION = "Adds Percy snapshot commands to the specified test files.";

package/dist/tools/selfheal.js

@@ -506,7 +506,7 @@ export default function addSelfHealTools(server, config) {
         sessions: sessionsFieldSchema.describe("Sessions to plan edits for. See tool description for accepted shapes."),
     }, {
         title: "Prepare Self-Healing Plan",
-        readOnlyHint: true,
+        readOnlyHint: false,
         openWorldHint: false,
         destructiveHint: false,
         idempotentHint: true,

package/dist/tools/testmanagement-utils/testcase-from-file.js

@@ -1,3 +1,4 @@
+import { wrapUntrusted } from "../../lib/untrusted-content.js";
 import { fetchFormFields, triggerTestCaseGeneration, pollScenariosTestDetails, bulkCreateTestCases, } from "./TCG-utils/api.js";
 import { buildDefaultFieldMaps, findBooleanFieldId, } from "./TCG-utils/helpers.js";
 import { signedUrlMap } from "../../lib/inmemory-store.js";
@@ -37,7 +38,7 @@ export async function createTestCasesFromFile(args, context, config) {
         content: [
             {
                 type: "text",
-                text: resultString,
+                text: wrapUntrusted("AI-generated test cases from the uploaded document", resultString),
             },
             {
                 type: "text",

package/dist/tools/testmanagement-utils/upload-file.js

@@ -19,16 +19,30 @@ export const UploadFileSchema = z.object({
         .describe("ID of the project where the file should be uploaded. Do not assume it, always ask user for it."),
     file_path: z
         .string()
-        .describe("Full path to the file that should be uploaded"),
+        .describe("Full path to the file that should be uploaded. Must be inside the " +
+        "directory configured via the MCP_UPLOAD_BASE_DIR environment variable."),
 });
 /**
  * Uploads a file to BrowserStack Test Management and returns the signed URL.
  */
 export async function uploadFile(args, config) {
     const { project_identifier, file_path } = args;
+    if (!appConfig.UPLOAD_BASE_DIR) {
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: "File upload is disabled. Set the MCP_UPLOAD_BASE_DIR environment " +
+                        "variable to a directory that contains the files you want to upload, " +
+                        "then restart the MCP server. Uploads are restricted to that directory.",
+                },
+            ],
+            isError: true,
+        };
+    }
     try {
         // Canonicalize path and enforce upload safety rules (extension, size,
-        // hidden-directory traversal, optional base-dir containment).
+        // hidden-directory traversal, base-dir containment).
         const safePath = validateUploadPath(file_path, {
             allowedExtensions: TEST_MANAGEMENT_ATTACHMENT_EXTENSIONS,
             maxSizeBytes: MAX_ATTACHMENT_UPLOAD_BYTES,

package/dist/tools/tool-handoff.d.ts

@@ -52,7 +52,11 @@ export declare const NEEDS_TEST_PLAN_ID: string;
 export declare const PLAN_WRITES_VIA_AGENT: string;
 /** A build id comes from either build-lookup tool. */
 export declare const NEEDS_BUILD_ID: string;
-/** Session ids are not listable by any tool here. */
+/**
+ * Session ids ARE listable now — PR #395 added `listSessions`, which merged into main while
+ * this branch was open. This used to send the model to askBrowserStackAI for want of a tool;
+ * pointing at the agent when a real tool exists is exactly what the header above forbids.
+ */
 export declare const NEEDS_SESSION_ID: string;
 /** A completed scan's ids come from startAccessibilityScan, or from the agent. */
 export declare const NEEDS_A11Y_SCAN_ID: string;

package/dist/tools/tool-handoff.js

@@ -60,10 +60,13 @@ export const PLAN_WRITES_VIA_AGENT = " Creating a test plan or sub-plan, and lin
     "want. It asks you to confirm before changing anything.";
 /** A build id comes from either build-lookup tool. */
 export const NEEDS_BUILD_ID = needsIdFrom("a BrowserStack build id", "getBuildId or listBuildId");
-/** Session ids are not listable by any tool here. */
-export const NEEDS_SESSION_ID = " Requires a session id, which no tool here lists. If you only know the build, call " +
-    "getBuildId or listBuildId; if you have neither, call askBrowserStackAI with product " +
-    '"tra" and describe the run you mean.';
+/**
+ * Session ids ARE listable now — PR #395 added `listSessions`, which merged into main while
+ * this branch was open. This used to send the model to askBrowserStackAI for want of a tool;
+ * pointing at the agent when a real tool exists is exactly what the header above forbids.
+ */
+export const NEEDS_SESSION_ID = " Requires a session id. listSessions lists them for a build; if you do not have the " +
+    "build either, getBuildId or listBuildId resolves one from a project and build name.";
 /** A completed scan's ids come from startAccessibilityScan, or from the agent. */
 export const NEEDS_A11Y_SCAN_ID = " Requires the ids of a completed scan, which are returned by startAccessibilityScan. " +
     "No tool here lists past scans, so if you do not have the ids, start a new scan rather " +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@browserstack/mcp-server",
-  "version": "1.4.0-beta.3",
+  "version": "1.4.0",
   "description": "BrowserStack's Official MCP Server",
   "mcpName": "io.github.browserstack/mcp-server",
   "main": "dist/index.js",