@jrpool/kilotest 52.0.0 → 57.0.1

package/index.ts

@@ -17,6 +17,7 @@ import {
   getObject,
   getPOSTData,
   getReport,
+  isAllowedRedirectTarget,
   isAllowedReport,
   isAllowedTarget,
   isReportError,
@@ -66,8 +67,8 @@ import {answer as renewWCAG} from './web/renewWCAG/index.ts';
 import {answer as renewWCAGForm} from './web/renewWCAGForm/index.ts';
 import {answer as requestRetestPage} from './web/requestRetest/index.ts';
 import {answer as requestRetestForm} from './web/requestRetestForm/index.ts';
-import {answer as requestTestPage} from './web/requestTest/index.ts';
-import {answer as requestTestForm} from './web/requestTestForm/index.ts';
+import {answer as requestNewTestPage} from './web/requestNewTest/index.ts';
+import {answer as requestNewTestForm} from './web/requestNewTestForm/index.ts';
 import {answer as rewindReportsForm} from './web/rewindReportsForm/index.ts';
 import {answer as showHiddenReportsForm} from './web/showHiddenReportsForm/index.ts';
 import {answer as unhideReportForm} from './web/unhideReportForm/index.ts';
@@ -78,7 +79,10 @@ import {response as listReportsAPI} from './api/listReports.ts';
 import {response as listViolatorsAPI} from './api/listViolators.ts';
 import {response as requestFeatureAPI} from './api/requestFeature.ts';
 import {response as requestRetestAPI} from './api/requestRetest.ts';
-import {response as requestTestAPI} from './api/requestTest.ts';
+import {response as requestNewTestAPI} from './api/requestNewTest.ts';
+import {response as orderNewTestAPI} from './api/orderNewTest.ts';
+import {response as orderRetestAPI} from './api/orderRetest.ts';
+import {response as awaitTestAPI} from './api/awaitTest.ts';
 
 // ENVIRONMENT
 
@@ -123,8 +127,8 @@ const answer: {
   renewWCAGForm: PageHandler;
   requestRetest: PageHandler;
   requestRetestForm: PageHandler;
-  requestTest: PageHandler;
-  requestTestForm: PageHandler;
+  requestNewTest: PageHandler;
+  requestNewTestForm: PageHandler;
   rewindReportsForm: PageHandler;
   showHiddenReportsForm: PageHandler;
   unhideReportForm: PageHandler;
@@ -153,8 +157,8 @@ const answer: {
   renewWCAGForm,
   requestRetest: requestRetestPage,
   requestRetestForm,
-  requestTest: requestTestPage,
-  requestTestForm,
+  requestNewTest: requestNewTestPage,
+  requestNewTestForm,
   rewindReportsForm,
   showHiddenReportsForm,
   unhideReportForm
@@ -169,7 +173,10 @@ const apiRespond: {
   listViolators: ApiResponder;
   requestFeature: ApiResponder;
   requestRetest: ApiResponder;
-  requestTest: ApiResponder;
+  requestNewTest: ApiResponder;
+  orderNewTest: ApiResponder;
+  orderRetest: ApiResponder;
+  awaitTest: ApiResponder;
 } = {
   getReport: getReportAPI,
   listDiagnoses: listDiagnosesAPI,
@@ -178,7 +185,10 @@ const apiRespond: {
   listViolators: listViolatorsAPI,
   requestFeature: requestFeatureAPI,
   requestRetest: requestRetestAPI,
-  requestTest: requestTestAPI
+  requestNewTest: requestNewTestAPI,
+  orderNewTest: orderNewTestAPI,
+  orderRetest: orderRetestAPI,
+  awaitTest: awaitTestAPI
 };
 
 // CONSTANTS
@@ -225,7 +235,7 @@ export const routes = {
     '/requestAction.html',
     '/renewWCAG.html',
     '/requestRetest.html/*',
-    '/requestTest.html',
+    '/requestNewTest.html',
     '/tutorialWebComment.html',
     '/unhideReportForm.html',
     '/worker/job',
@@ -275,12 +285,18 @@ const noDirectGetPages = new Set(['unhideReportForm']);
 // engines and other crawlers are still requesting. Redirecting them lets crawlers update
 // their own indexes, rather than leaving them to repeat the same dead request indefinitely.
 // TEMPORARY: retire this redirect after 2027-04-01 once crawlers have re-indexed.
+// requestTest and requestTestForm were renamed to requestNewTest and requestNewTestForm
+// on 2026-09-28 (see the newTest/retest naming-ambiguity fix), to distinguish the
+// new-test-only page from bare "test" language used elsewhere.
+// TEMPORARY: retire this redirect after 2027-03-28 once crawlers have re-indexed.
 const renamedPagePrefixes: Record<string, string> = {
   diagnoses: 'listDiagnoses',
   reportIssue: 'listViolators',
   reportIssues: 'listIssues',
   rules: 'listRules',
-  targets: 'listReports'
+  targets: 'listReports',
+  requestTest: 'requestNewTest',
+  requestTestForm: 'requestNewTestForm'
 };
 const jobLock = createLock();
 
@@ -484,26 +500,54 @@ const processJobRequest = async (request: IncomingMessage, response: ServerRespo
     if (queuedJobNames.length) {
       const oldestJobName = queuedJobNames[0]!;
       // Get the first one.
-      const firstJob = await getObject(path.join(queuePath(), oldestJobName)) as {id: string, sources: {worker: string}, target: {what: string}};
-      // Add the public worker name to the job, in a property Testaro does not read or alter.
-      firstJob.sources.worker = workerName;
-      console.log(
-        `Job ${firstJob.id} (${firstJob.target.what}) is being sent to the worker.`
-      );
-      // Assign the job to the worker.
-      response.writeHead(200, {
-        'content-type': 'application/json; charset=utf-8'
-      });
-      response.end(JSON.stringify(firstJob));
-      const messageEnd
-      = `and job ${firstJob.id} (${firstJob.target.what}) was assigned to the worker`;
-      console.log(`${messageStart}${messageEnd}`);
-      // Save the job in the claimed-jobs directory.
-      await fs.writeFile(
-        path.join(claimedPath(), oldestJobName), getJSON(firstJob)
-      );
-      // Delete it from the queue.
-      await fs.unlink(path.join(queuePath(), oldestJobName));
+      const firstJob = await getObject(path.join(queuePath(), oldestJobName)) as {id: string, sources: {worker: string}, target: {what: string, url: string}};
+      // If the job's target is no longer allowed, whether because its host now resolves
+      // to a disallowed address or, more likely, because the host now redirects to one
+      // (both possible if the target host was reconfigured, e.g. by an attacker, after
+      // the request was accepted; a fetch-based check is used, rather than the cheaper
+      // DNS-only isAllowedTarget, because this runs only when a job is actually queued,
+      // which is rare, and a redirect introduced after acceptance is the likelier attack):
+      if (!(await isAllowedRedirectTarget(firstJob.target.url))) {
+        console.error(`ERROR: Queued job ${firstJob.id} is on a target this deployment does not allow`);
+        // Alert a manager, since this indicates an attempted or accidental SSRF
+        // rather than an ordinary usability problem with the target.
+        await sendAlert(
+          'Kilotest: queued job on disallowed target rejected',
+          `Job ${firstJob.id} (${firstJob.target.what}) was never assigned to a worker because its target no longer resolves, directly or via a redirect, to an address this deployment allows (e.g. a private, loopback, or link-local address). The job was reclassified as failed.`
+        );
+        // Reclassify the job as failed, instead of assigning it or leaving it queued.
+        await fs.rename(
+          path.join(queuePath(), oldestJobName), path.join(failedPath(), oldestJobName)
+        );
+        // Respond as if no job were queued, rather than revealing anything about the rejected job.
+        response.writeHead(200, {
+          'content-type': 'application/json; charset=utf-8'
+        });
+        response.end(JSON.stringify({}));
+        console.log(`${messageStart}but the queued job was on a disallowed target`);
+      }
+      // Otherwise, i.e. if the job's target is still allowed:
+      else {
+        // Add the public worker name to the job, in a property Testaro does not read or alter.
+        firstJob.sources.worker = workerName;
+        console.log(
+          `Job ${firstJob.id} (${firstJob.target.what}) is being sent to the worker.`
+        );
+        // Assign the job to the worker.
+        response.writeHead(200, {
+          'content-type': 'application/json; charset=utf-8'
+        });
+        response.end(JSON.stringify(firstJob));
+        const messageEnd
+        = `and job ${firstJob.id} (${firstJob.target.what}) was assigned to the worker`;
+        console.log(`${messageStart}${messageEnd}`);
+        // Save the job in the claimed-jobs directory.
+        await fs.writeFile(
+          path.join(claimedPath(), oldestJobName), getJSON(firstJob)
+        );
+        // Delete it from the queue.
+        await fs.unlink(path.join(queuePath(), oldestJobName));
+      }
     }
     // Otherwise, i.e. if no jobs are queued:
     else {
@@ -898,7 +942,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         await serveError({message: 'ERROR: Unreadable request body'}, response, true);
       }
       // If the request is a test request:
-      else if (pageName === 'requestTest.html') {
+      else if (pageName === 'requestNewTest.html') {
         const {description, url, why} = postData as {description?: string; url: string; why?: string};
         // If the request is valid:
         if (description && isURL(url) && why && await isAllowedTarget(url)) {
@@ -912,7 +956,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
             // Serve headers for a response.
             setHeaders('text/html', pathname, 'ultra');
             // Get the answer data.
-            const answerData = await answer.requestTest(description, url, why);
+            const answerData = await answer.requestNewTest(description, url, why);
             // If they are valid:
             if (answerData.status === 'ok') {
               // Serve the answer page.
@@ -1197,15 +1241,26 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         // Get the segments of the path after api.
         const segments = pathTail.split('/');
         // If the service is to receive a test request:
-        if (segments[0] === 'requestTest') {
+        if (segments[0] === 'requestNewTest') {
           const {description, URL, reason} = postData as {description: string; URL: string; reason: string};
           // Get the response body.
-          const responseBody = await apiRespond.requestTest([description, URL, reason]);
-          await recordPageMetric('apiOperations', 'requestTest');
+          const responseBody = await apiRespond.requestNewTest([description, URL, reason]);
+          await recordPageMetric('apiOperations', 'requestNewTest');
           // Send it.
           setHeaders('application/json', null, 'ultra');
           response.end(JSON.stringify(responseBody));
         }
+        // Otherwise, if the request uses the old, pre-rename requestTest path name: redirect
+        // permanently to the new path name. requestTest takes no path parameters (its
+        // arguments are body fields), so there is no further path to preserve, unlike the
+        // renamedPagePrefixes GET-page redirects above. 308 (not 301) is used here because
+        // 301 is defined to let clients rewrite a POST redirect as a GET, which would drop
+        // this request's body; 308 preserves both the method and the body.
+        // TEMPORARY: retire this redirect after 2027-03-28 once callers have updated.
+        else if (segments[0] === 'requestTest') {
+          response.writeHead(308, {Location: '/api/requestNewTest'});
+          response.end();
+        }
         // Otherwise, if the service is to receive a retest request:
         else if (segments[0] === 'requestRetest') {
           const {reason} = postData as {reason: string};
@@ -1226,6 +1281,44 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
           setHeaders('application/json', null, 'ultra');
           response.end(JSON.stringify(responseBody));
         }
+        // Otherwise, if the service is to order an immediate, automatically approved test:
+        else if (segments[0] === 'orderNewTest') {
+          const {description, URL, reason} = postData as {description: string; URL: string; reason: string};
+          // Get the response body.
+          const responseBody = await apiRespond.orderNewTest([description, URL, reason]);
+          await recordPageMetric('apiOperations', 'orderNewTest');
+          // Send it.
+          setHeaders('application/json', null, 'ultra');
+          response.end(JSON.stringify(responseBody));
+        }
+        // Otherwise, if the request uses the old, pre-rename orderTest path name: redirect
+        // permanently to the new path name. orderTest likewise takes no path parameters.
+        // See the requestTest redirect above for why 308 (not 301) is used for these
+        // POST-only API redirects.
+        // TEMPORARY: retire this redirect after 2027-03-28 once callers have updated.
+        else if (segments[0] === 'orderTest') {
+          response.writeHead(308, {Location: '/api/orderNewTest'});
+          response.end();
+        }
+        // Otherwise, if the service is to order an immediate, automatically approved retest:
+        else if (segments[0] === 'orderRetest') {
+          const {reason} = postData as {reason: string};
+          // Get the response body.
+          const responseBody = await apiRespond.orderRetest(segments.slice(1).concat(reason));
+          await recordPageMetric('apiOperations', 'orderRetest');
+          // Send it.
+          setHeaders('application/json', null, 'ultra');
+          response.end(JSON.stringify(responseBody));
+        }
+        // Otherwise, if the service is to wait for an ordered job to complete:
+        else if (segments[0] === 'awaitTest') {
+          // Get the response body.
+          const responseBody = await apiRespond.awaitTest(segments.slice(1));
+          await recordPageMetric('apiOperations', 'awaitTest');
+          // Send it.
+          setHeaders('application/json', null, 'ultra');
+          response.end(JSON.stringify(responseBody));
+        }
         // Otherwise, i.e. if the service is invalid:
         else {
           await serveError(

package/lhm.plugin.json

@@ -2297,7 +2297,7 @@
       }
     },
     {
-      "name": "requestTest",
+      "name": "requestNewTest",
       "description": "Process my request to test a page about which no report is available yet.",
       "inputSchema": {
         "type": "object",

package/linkValidation.test.ts

@@ -48,8 +48,8 @@ const htmlRoutes = [
   '/listViolators.html',
   '/listRules.html',
   '/manage.html',
-  '/requestTest.html',
-  '/requestTestForm.html',
+  '/requestNewTest.html',
+  '/requestNewTestForm.html',
   '/requestRetest.html',
   '/requestRetestForm.html',
   '/reannotate.html',

package/llms-full.txt

@@ -6,7 +6,7 @@ Kilotest is an application that performs ensemble testing of web pages for front
 
 ## What Kilotest does for language models
 
-Kilotest is deployed on the public Internet as a service at `https://kilotest.com`. Kilotest can test only web pages that can be accessed from the public Internet and that are not protected by authentication or other access controls. Kilotest has not implemented any mechanism for testing private, internal, password-protected, or otherwise restricted pages.
+Kilotest is deployed on the public Internet as a service at `https://kilotest.com`. That deployment of Kilotest can test only web pages that can be accessed by its Testaro worker with a URL. Generally those are pages on the public Internet that are not protected by authentication or other access controls.
 
 Without calling any tool, an LLM can, under some conditions, load web pages and use its knowledge to assess successes and failures of front-end quality. But such an assessment is almost always:
 
@@ -63,7 +63,7 @@ Kilotest offers a comprehensive suite of capabilities to users via its web UI:
 - Get statistics about issues reported in one report: `https://kilotest.com/listIssues.html/{timeStamp}/{jobID}`
 - Get details about one issue reported in one report: `https://kilotest.com/listViolators.html/{issueID}/{timeStamp}/{jobID}`
 - Get diagnoses by rule engines of rule violations for one HTML element exhibiting one issue in one report: `https://kilotest.com/listDiagnoses.html/{issueID}/{timeStamp}/{jobID}/{catalogIndex}`
-- [Recommend the testing of a not-yet-tested page](https://kilotest.com/requestTestForm.html)
+- [Recommend the testing of a not-yet-tested page](https://kilotest.com/requestNewTestForm.html)
 - Recommend the retesting of a previously tested page: `https://kilotest.com/requestRetestForm.html/{timeStamp}/{jobID}`
 - [Get statistics about frequently reported issues across all pages](https://kilotest.com/listTopIssues.html)
 - [Get a list of the operations that Kilotest managers are authorized to request](https://kilotest.com/manage.html)
@@ -108,10 +108,10 @@ Kilotest offers these tools:
     - `timeStamp`: initial segment of report identifier
     - `jobID`: final segment of report identifier
   - source of parameters: response to a `listViolators` request
-- `requestTest`
+- `requestNewTest`
   - method: `POST`
   - purpose: request testing of one web page about which no report is available
-  - path: `/api/requestTest`
+  - path: `/api/requestNewTest`
   - payload properties
     - `description`: description of the page to be tested
     - `URL`: URL of the page to be tested
@@ -132,6 +132,35 @@ Kilotest offers these tools:
   - path: `/api/requestFeature`
   - payload properties
     - `feature`: description and motivation of the feature improvement or the new feature
+- `orderNewTest`
+  - method: `POST`
+  - purpose: order immediate, automatically approved testing of one web page about which no report is available, instead of waiting for manual approval
+  - path: `/api/orderNewTest`
+  - payload properties
+    - `description`: description of the page to be tested
+    - `URL`: URL of the page to be tested
+    - `reason`: reason for testing the page
+  - response includes a report identifier (`timeStamp` and `jobID`) once the job is enqueued
+- `orderRetest`
+  - method: `POST`
+  - purpose: order immediate, automatically approved retesting of one web page about which a report is available, instead of waiting for manual approval
+  - path: `/api/orderRetest/{timeStamp}/{jobID}`
+  - parameters
+    - `timeStamp`: initial segment of report identifier
+    - `jobID`: final segment of report identifier
+  - source of parameters: response to a `listIssues` request
+  - payload properties
+    - `reason`: reason for retesting the page
+  - response includes a report identifier (`timeStamp` and `jobID`) once the job is enqueued
+- `awaitTest`
+  - method: `POST`
+  - purpose: wait for a job ordered via `orderNewTest` or `orderRetest` to complete; blocks until the report is ready, the job fails, or a maximum wait time elapses, then returns
+  - path: `/api/awaitTest/{timeStamp}/{jobID}`
+  - parameters
+    - `timeStamp`: initial segment of the report identifier returned by `orderNewTest` or `orderRetest`
+    - `jobID`: final segment of the report identifier returned by `orderNewTest` or `orderRetest`
+  - source of parameters: response to an `orderNewTest` or `orderRetest` request
+  - caveat: testing typically takes about 2 minutes and occasionally up to 4 minutes; sends no interim notices while waiting
 
 ## After a test, retest, or feature request
 
@@ -147,6 +176,8 @@ When you request a test or a retest:
   - check test completion by calling `listReports` and looking for the page and completion date in the list
   - you advise the user to check in approximately 1 day for the test results on the Kilotest website, starting at `https://kilotest.com/listReports.html`
 
+For immediate testing without waiting for manual approval, use `orderNewTest` or `orderRetest` instead of `requestNewTest` or `requestRetest`. Each enqueues the job right away and returns a report identifier along with a question about whether to wait for completion. To wait, call `awaitTest` with that identifier; it blocks until the report is ready, the job fails, or a maximum wait time elapses. To check later instead, call `listIssues` with the same identifier.
+
 An [OpenAPI specification for Kilotest](https://kilotest.com/openapi.yaml) is available.
 
 ## How to report results honestly to users

package/llms.txt

@@ -1,6 +1,6 @@
 # Kilotest
 
-Kilotest helps language models and AI platforms to give thorough, accurate and truthful answers when users ask about the front-end quality (i.e. accessibility, usability, and standards conformity) of web pages. Kilotest integrates an ensemble of twelve independent rule engines to test any public web page. Kilotest creates a structured report of the results and saves the report for future reference. Kilotest API endpoints and MCP tools can provide multipage, single-page, and element-level test results.
+Kilotest helps language models and AI platforms to give thorough, accurate and truthful answers when users ask about the front-end quality (i.e. accessibility, usability, and standards conformity) of web pages. Kilotest integrates an ensemble of twelve independent rule engines to test a web page. Kilotest creates a structured report of the results and saves the report for future reference. Kilotest API endpoints and MCP tools can provide multipage, single-page, and element-level test results.
 
 ## API
 
@@ -9,9 +9,12 @@ Kilotest helps language models and AI platforms to give thorough, accurate and t
 - List all elements exhibiting one issue in one report: `/api/listViolators/{issueID}/{timeStamp}/{jobID}` (`GET`)
 - List all diagnoses of one element exhibiting one issue in one report: `/api/listDiagnoses/{catalogIndex}/{issueID}/{timeStamp}/{jobID}` (`GET`)
 - Get one full report in JSON: `/api/getReport/{timeStamp}/{jobID}` (`GET`)
-- Request testing of a web page: `/api/requestTest` (`POST`)
+- Request testing of a web page: `/api/requestNewTest` (`POST`)
 - Request retesting of a web page: `/api/requestRetest/{timeStamp}/{jobID}` (`POST`)
 - Request adding or improving a feature: `/api/requestFeature` (`POST`)
+- Order immediate, automatically approved testing of a web page: `/api/orderNewTest` (`POST`)
+- Order immediate, automatically approved retesting of a web page: `/api/orderRetest/{timeStamp}/{jobID}` (`POST`)
+- Wait for a job ordered via orderNewTest or orderRetest to complete: `/api/awaitTest/{timeStamp}/{jobID}` (`POST`)
 
 ## MCP Server
 
@@ -24,7 +27,7 @@ Kilotest helps language models and AI platforms to give thorough, accurate and t
 - List all elements exhibiting one issue in one report: `https://kilotest.com/listViolators.html/{issueID}/{timeStamp}/{jobID}`
 - List all diagnoses of one element exhibiting one issue in one report: `https://kilotest.com/listDiagnoses.html/{issueID}/{timeStamp}/{jobID}/{catalogIndex}`
 - Get one full report in JSON: `https://kilotest.com/fullReport.json/{timeStamp}/{jobID}`
-- [Request testing of a web page](https://kilotest.com/requestTestForm.html)
+- [Request testing of a web page](https://kilotest.com/requestNewTestForm.html)
 - Request retesting of a web page: `https://kilotest.com/requestRetestForm.html/{timeStamp}/{jobID}`
 - [List the operations that Kilotest managers are authorized to request](https://kilotest.com/manage.html)
 - [Provide statistics about frequently reported issues across all pages](https://kilotest.com/listTopIssues.html)

package/mcp.test.ts

@@ -11,6 +11,8 @@ import http from 'node:http';
 import {mcpPath, createMCPServer, handleMCP} from './mcp.ts';
 import {metricsPath} from './util.ts';
 import fs from 'node:fs';
+import {Client} from '@modelcontextprotocol/sdk/client/index.js';
+import {InMemoryTransport} from '@modelcontextprotocol/sdk/inMemory.js';
 
 // CONSTANTS
 
@@ -35,19 +37,23 @@ test('mcpPath is /mcp', () => {
   assert.equal(mcpPath, '/mcp');
 });
 
-test('createMCPServer registers all 8 tools', () => {
+test('createMCPServer registers all 12 tools', () => {
   const server = createMCPServer();
   const toolNames = Object.keys((server as any)._registeredTools);
-  assert.equal(toolNames.length, 8);
+  assert.equal(toolNames.length, 12);
   assert.deepEqual(toolNames, [
+    'getKilotestOverview',
     'listReports',
     'listIssues',
     'listViolators',
     'listDiagnoses',
     'getReport',
-    'requestTest',
+    'requestNewTest',
     'requestRetest',
-    'requestFeature'
+    'requestFeature',
+    'orderNewTest',
+    'orderRetest',
+    'awaitTest'
   ]);
 });
 
@@ -56,10 +62,41 @@ test('each tool has a description and a handler function', () => {
   const tools = (server as any)._registeredTools;
   for (const [name, tool] of Object.entries(tools) as [string, any][]) {
     assert.ok(tool.description, `${name} has a description`);
+    assert.ok(
+      tool.description.includes('front-end quality'),
+      `${name} description includes the shared domain context`
+    );
     assert.equal(typeof tool.handler, 'function', `${name} has a handler function`);
   }
 });
 
+test('getKilotestOverview handler returns overview text and records a metric', async () => {
+  const server = createMCPServer();
+  const countBefore = getToolCallCount('getKilotestOverview');
+  const result = await (server as any)._registeredTools.getKilotestOverview.handler({});
+  assert.ok(result.content);
+  assert.equal(result.content[0].type, 'text');
+  assert.ok(result.content[0].text.includes('front-end quality'));
+  assert.equal(getToolCallCount('getKilotestOverview'), countBefore + 1);
+});
+
+test('client receives instructions, server description, and the overview resource', async () => {
+  const server = createMCPServer();
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  await server.connect(serverTransport);
+  const client = new Client({name: 'test-client', version: '1.0.0'});
+  await client.connect(clientTransport);
+  assert.ok(client.getInstructions()?.includes('front-end quality'));
+  assert.ok(client.getServerVersion()?.description?.includes('front-end quality'));
+  const resources = await client.listResources();
+  assert.deepEqual(resources.resources.map((r: any) => r.uri), ['docs://kilotest/overview']);
+  const read = await client.readResource({uri: 'docs://kilotest/overview'});
+  assert.equal(read.contents[0]?.mimeType, 'text/plain');
+  assert.ok((read.contents[0] as any).text.includes('front-end quality'));
+  await client.close();
+  await server.close();
+});
+
 test('listReports handler returns content and structuredContent', async () => {
   const server = createMCPServer();
   const countBefore = getToolCallCount('listReports');
@@ -125,10 +162,10 @@ test('getReport handler returns content and structuredContent for a valid report
   assert.equal(getToolCallCount('getReport'), countBefore + 1);
 });
 
-test('requestTest handler returns content and structuredContent', async () => {
+test('requestNewTest handler returns content and structuredContent', async () => {
   const server = createMCPServer();
-  const countBefore = getToolCallCount('requestTest');
-  const result = await (server as any)._registeredTools.requestTest.handler({
+  const countBefore = getToolCallCount('requestNewTest');
+  const result = await (server as any)._registeredTools.requestNewTest.handler({
     description: 'Test Page',
     URL: 'https://example.com/test',
     reason: 'Because accessibility matters'
@@ -136,7 +173,7 @@ test('requestTest handler returns content and structuredContent', async () => {
   assert.ok(result.content);
   assert.equal(result.content[0].type, 'text');
   assert.ok(result.structuredContent);
-  assert.equal(getToolCallCount('requestTest'), countBefore + 1);
+  assert.equal(getToolCallCount('requestNewTest'), countBefore + 1);
 });
 
 test('requestRetest handler returns content and structuredContent for a valid report', async () => {
@@ -165,6 +202,60 @@ test('requestFeature handler returns content and structuredContent', async () =>
   assert.equal(getToolCallCount('requestFeature'), countBefore + 1);
 });
 
+test('orderNewTest handler returns content and structuredContent, and enqueues a job', async () => {
+  const {jobsPath} = await import('./util.ts');
+  const server = createMCPServer();
+  const countBefore = getToolCallCount('orderNewTest');
+  const result = await (server as any)._registeredTools.orderNewTest.handler({
+    description: 'MCP Ordered Page',
+    URL: 'https://example.com/mcp-ordered',
+    reason: 'Because accessibility matters here'
+  });
+  assert.ok(result.content);
+  assert.equal(result.content[0].type, 'text');
+  assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('orderNewTest'), countBefore + 1);
+  const reportIdentifier = result.structuredContent['response content']['disposition of your order']['report identifier'];
+  assert.ok(reportIdentifier);
+  const queuedPath = `${jobsPath()}/queue/${reportIdentifier.timeStamp}-${reportIdentifier.jobID}.json`;
+  fs.unlinkSync(queuedPath);
+});
+
+test('orderRetest handler returns content and structuredContent, and enqueues a job', async () => {
+  const {jobsPath} = await import('./util.ts');
+  const server = createMCPServer();
+  const countBefore = getToolCallCount('orderRetest');
+  // 260202T0000-new is the latest report of "Mixed Outcomes Page" (260101T0000-mix is an
+  // earlier, superseded report of the same page), so this order is accepted.
+  const result = await (server as any)._registeredTools.orderRetest.handler({
+    timeStamp: '260202T0000',
+    jobID: 'new',
+    reason: 'Because the report is obsolete'
+  });
+  assert.ok(result.content);
+  assert.equal(result.content[0].type, 'text');
+  assert.ok(result.structuredContent);
+  assert.equal(getToolCallCount('orderRetest'), countBefore + 1);
+  const reportIdentifier = result.structuredContent['response content']['disposition of your order']['report identifier'];
+  assert.ok(reportIdentifier);
+  const queuedPath = `${jobsPath()}/queue/${reportIdentifier.timeStamp}-${reportIdentifier.jobID}.json`;
+  fs.unlinkSync(queuedPath);
+});
+
+test('awaitTest handler returns content and structuredContent for an already-completed report', async () => {
+  const server = createMCPServer();
+  const countBefore = getToolCallCount('awaitTest');
+  const result = await (server as any)._registeredTools.awaitTest.handler({
+    timeStamp: '260101T0000',
+    jobID: 'mix'
+  });
+  assert.ok(result.content);
+  assert.equal(result.content[0].type, 'text');
+  assert.ok(result.structuredContent);
+  assert.equal(result.structuredContent['response content']['disposition of your wait'].outcome, 'completed');
+  assert.equal(getToolCallCount('awaitTest'), countBefore + 1);
+});
+
 test('listIssues handler returns an error for a nonexistent report', async () => {
   const server = createMCPServer();
   const result = await (server as any)._registeredTools.listIssues.handler({
@@ -258,6 +349,8 @@ test('handleMCP responds to initialize with server info', async () => {
     assert.equal(res.statusCode, 200);
     const result = parseSSEResult(res.body);
     assert.equal(result.result.serverInfo.name, 'Kilotest');
+    assert.ok(result.result.serverInfo.description.includes('front-end quality'));
+    assert.ok(result.result.instructions.includes('front-end quality'));
     assert.equal(result.result.protocolVersion, '2025-06-18');
   }
   finally {
@@ -265,7 +358,7 @@ test('handleMCP responds to initialize with server info', async () => {
   }
 });
 
-test('handleMCP lists all 8 tools via tools/list', async () => {
+test('handleMCP lists all 12 tools via tools/list', async () => {
   const server = await startMCPServer();
   try {
     const port = server.address().port;
@@ -273,16 +366,20 @@ test('handleMCP lists all 8 tools via tools/list', async () => {
     assert.equal(res.statusCode, 200);
     const result = parseSSEResult(res.body);
     const toolNames = result.result.tools.map((t: any) => t.name);
-    assert.equal(toolNames.length, 8);
+    assert.equal(toolNames.length, 12);
     assert.deepEqual(toolNames, [
+      'getKilotestOverview',
       'listReports',
       'listIssues',
       'listViolators',
       'listDiagnoses',
       'getReport',
-      'requestTest',
+      'requestNewTest',
       'requestRetest',
-      'requestFeature'
+      'requestFeature',
+      'orderNewTest',
+      'orderRetest',
+      'awaitTest'
     ]);
   }
   finally {