qaeverest-mcp 1.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 QAEverest
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,236 @@
+# QAEverest MCP Server
+
+Generate AI-powered test cases — and run security & performance checks — from inside your IDE. This [Model Context Protocol](https://modelcontextprotocol.io) server connects AI coding agents — **Claude Code, Cursor, VS Code Copilot, Windsurf**, and any other MCP-compatible client — to the QAEverest public API.
+
+Ask your agent things like:
+
+> *"Generate functional test cases for the login story in `auth/README.md` and save them as a feature file."*
+>
+> *"Generate API tests from this `openapi.yaml`, then scaffold Playwright specs from them."*
+>
+> *"Generate UI automation test cases for the checkout flow."*
+>
+> *"Run a full security scan against https://staging.example.com."*
+>
+> *"Run a 30-second load test on the /search endpoint."*
+>
+> *"How many QAEverest credits do I have left?"*
+
+## Prerequisites
+
+- **Node.js 18+**
+- A **QAEverest API key** (`qae_...`) — issued from **Admin → API Management** or by your account manager.
+
+## Configuration
+
+The server is configured entirely through environment variables:
+
+| Variable | Required | Description |
+|---|---|---|
+| `QAEVEREST_API_KEY` | yes | Your QAEverest API key (`qae_...`) |
+| `QAEVEREST_API_URL` | no | Backend base URL. Defaults to `https://api.qaeverest.ai` |
+
+The server exchanges your API key for a short-lived access token automatically and refreshes it when it expires — you never handle tokens yourself.
+
+## Setup
+
+### Claude Code
+
+```bash
+claude mcp add qaeverest -e QAEVEREST_API_KEY=qae_your_key_here -- npx qaeverest-mcp
+```
+
+Or add to your project's `.mcp.json` (checked in, so the whole team gets it — keep the key in an env var):
+
+```json
+{
+  "mcpServers": {
+    "qaeverest": {
+      "command": "npx",
+      "args": ["qaeverest-mcp"],
+      "env": {
+        "QAEVEREST_API_KEY": "${QAEVEREST_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+### Cursor
+
+Add to `.cursor/mcp.json` (project) or `~/.cursor/mcp.json` (global):
+
+```json
+{
+  "mcpServers": {
+    "qaeverest": {
+      "command": "npx",
+      "args": ["qaeverest-mcp"],
+      "env": {
+        "QAEVEREST_API_KEY": "qae_your_key_here"
+      }
+    }
+  }
+}
+```
+
+### VS Code (GitHub Copilot agent mode)
+
+Add to `.vscode/mcp.json`:
+
+```json
+{
+  "servers": {
+    "qaeverest": {
+      "type": "stdio",
+      "command": "npx",
+      "args": ["qaeverest-mcp"],
+      "env": {
+        "QAEVEREST_API_KEY": "${input:qaeverest-api-key}"
+      }
+    }
+  },
+  "inputs": [
+    {
+      "id": "qaeverest-api-key",
+      "type": "promptString",
+      "description": "QAEverest API key",
+      "password": true
+    }
+  ]
+}
+```
+
+### Windsurf
+
+Add to `~/.codeium/windsurf/mcp_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "qaeverest": {
+      "command": "npx",
+      "args": ["qaeverest-mcp"],
+      "env": {
+        "QAEVEREST_API_KEY": "qae_your_key_here"
+      }
+    }
+  }
+}
+```
+
+### Running from a local checkout (before npm publish)
+
+Replace `"command": "npx", "args": ["qaeverest-mcp"]` with:
+
+```json
+"command": "node",
+"args": ["C:/path/to/CreateMyTestcases/mcp-server/src/index.js"]
+```
+
+(run `npm install` inside `mcp-server/` first).
+
+## Tools
+
+The server exposes these tools. Each generation/scan call is billed to your account at an admin-configured per-service credit cost; whether a tool works depends on which services are **enabled** for your API key (check with `get_usage`). You don't call these directly — describe what you want and the agent picks the tool.
+
+### `generate_testcases` — functional / general (sync)
+
+Generate test cases from a user story or feature description. Returns Gherkin-style scenarios (Given/When/Then) with tags, priorities, and test data. Generation typically takes 1–3 minutes.
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `user_story` | string | yes | The story / requirement / feature description |
+| `test_type` | enum | no | `Functional` (default), `System`, `Performance`, `Security`, `API` |
+| `tc_type` | enum | no | `manual` (default) or `automated` |
+| `domain_name` | string | no | Business domain context, e.g. `Banking` |
+| `module_name` | string | no | Feature area, e.g. `Login` |
+| `additional` | string | no | Extra instructions for the AI |
+
+### `generate_api_tests` — API automation (sync)
+
+Generate automation-ready API test cases from a description **or an OpenAPI/Swagger spec or Postman collection pasted as text** (positive, negative, boundary, auth).
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `spec` | string | yes | API description, **or** an OpenAPI/Swagger spec or Postman collection as text |
+| `tc_type` | enum | no | `manual` or `automated` (default) |
+| `domain_name`, `module_name`, `additional` | string | no | As above |
+
+### `generate_ui_tests` — UI automation (async)
+
+Generate end-to-end UI automation test cases (navigate / click / type / assert steps). Runs as a background job and may take a few minutes. **Generates test cases only — it does not drive a live browser.**
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `story` | string | yes | The UI scenario / user story |
+| `domain_name`, `module_name`, `additional` | string | no | As above |
+
+### `generate_mobile_tests` — mobile automation (async)
+
+Same as `generate_ui_tests`, but for mobile UI automation (gestures, device states, platform-specific behaviours). Generates test cases only — it does not drive a live device.
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `story` | string | yes | The mobile scenario / user story |
+| `domain_name`, `module_name`, `additional` | string | no | As above |
+
+### `security_scan` — security (sync)
+
+Scan a URL for security-header, SSL/TLS, and common-vulnerability issues; returns risk-rated findings.
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `url` | string | yes | Full URL including `http://` or `https://` |
+| `scanType` | enum | no | `headers`, `ssl`, `vulnerability`, or `full` (default) |
+| `method` | enum | no | HTTP method to probe with (default `GET`) |
+| `headers` | object | no | Optional request headers (key/value) |
+
+### `performance_test` — performance (sync)
+
+Run a load / stress / spike / soak test and return latency, throughput, and error-rate metrics. API-tier caps keep a single call bounded (~1 min); heavier runs belong in the in-app Performance module.
+
+| Parameter | Type | Required | Description |
+|---|---|---|---|
+| `url` | string | yes | Full URL including `http://` or `https://` |
+| `testMode` | enum | no | `load` (default), `stress`, `spike`, `soak` |
+| `method` | enum | no | HTTP method (default `GET`) |
+| `headers` | object | no | Optional request headers (key/value) |
+| `body` | string | no | Optional request body (POST/PUT) |
+| `virtualUsers` | number | no | Concurrent virtual users (load/soak); server caps apply |
+| `duration` | number | no | Seconds; server caps apply (load ≤ 60s, soak ≤ 90s) |
+| `rampUp` | number | no | Ramp-up seconds (load mode) |
+
+### `get_usage`
+
+No parameters. Returns credits used/remaining, requests this month, and enabled services for your account.
+
+## How it works
+
+```
+IDE agent (Claude Code / Cursor / Copilot / Windsurf)
+        │  MCP over stdio
+        ▼
+qaeverest-mcp
+        │  POST /api/v1/auth/token        (API key → 8h JWT, cached)
+        │  POST /api/v1/generate-testcases     ─┐
+        │  POST /api/v1/api-tests/generate       │ sync — returns inline
+        │  POST /api/v1/security-scan            │
+        │  POST /api/v1/performance-test        ─┘
+        │  POST /api/v1/ui-tests      → poll GET /api/v1/ui-tests/{jobId}      ─┐ async —
+        │  POST /api/v1/mobile-tests  → poll GET /api/v1/mobile-tests/{jobId}  ─┘ server polls for you
+        │  GET  /api/v1/usage
+        ▼
+QAEverest backend ──► AI engine / scanners ──► results
+```
+
+For the async UI/mobile tools the server submits the job and polls the status URL for you (up to 5 minutes), so from the agent's point of view they behave like any other tool call.
+
+## Troubleshooting
+
+- **"QAEVEREST_API_KEY is not set"** — the env var didn't reach the server; check the `env` block in your MCP config.
+- **"Invalid or revoked API key"** — the key was revoked or regenerated in Admin → API Management; get a fresh one.
+- **"Insufficient credits" (402)** — your plan's credit allowance is exhausted.
+- **"Monthly request limit reached" (429)** — resets at the next billing cycle.
+- **Timeouts** — generation is capped at 5 minutes client-side; very long stories may need trimming.
+- The server logs diagnostics to **stderr** (visible in your IDE's MCP logs, e.g. `claude mcp list` / Cursor's MCP output panel).

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "qaeverest-mcp",
+  "version": "1.1.0",
+  "description": "MCP server for QAEverest — generate AI-powered functional, API, UI & mobile test cases, plus security and performance checks, from inside Claude Code, Cursor, VS Code Copilot, or any MCP-compatible IDE.",
+  "type": "module",
+  "main": "src/index.js",
+  "bin": {
+    "qaeverest-mcp": "src/index.js"
+  },
+  "files": [
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "start": "node src/index.js",
+    "test": "node smoke-test.mjs"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "mcp",
+    "modelcontextprotocol",
+    "qaeverest",
+    "testing",
+    "test-cases",
+    "qa",
+    "ai"
+  ],
+  "license": "MIT",
+  "author": "QAEverest",
+  "homepage": "https://qaeverest.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pooja10404/CreateMyTestcases.git",
+    "directory": "mcp-server"
+  },
+  "bugs": {
+    "url": "https://github.com/pooja10404/CreateMyTestcases/issues"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "zod": "^3.23.8"
+  }
+}

package/src/index.js

@@ -0,0 +1,488 @@
+#!/usr/bin/env node
+/**
+ * QAEverest MCP server.
+ *
+ * Exposes QAEverest's public v1 API as MCP tools over stdio so AI coding
+ * agents (Claude Code, Cursor, VS Code Copilot, Windsurf, ...) can generate
+ * test cases — and run security/performance checks — without leaving the IDE.
+ *
+ * Configuration (environment variables):
+ *   QAEVEREST_API_KEY  (required) — your QAEverest API key (qae_...)
+ *   QAEVEREST_API_URL  (optional) — backend base URL, default https://api.qaeverest.ai
+ *
+ * NOTE: stdout carries the JSON-RPC protocol — all diagnostics go to stderr.
+ */
+
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+
+const API_KEY = process.env.QAEVEREST_API_KEY;
+const BASE_URL = (process.env.QAEVEREST_API_URL || "https://api.qaeverest.ai").replace(/\/+$/, "");
+
+if (!API_KEY) {
+  console.error(
+    "[qaeverest-mcp] QAEVEREST_API_KEY is not set.\n" +
+    "Get an API key from your QAEverest account manager (Admin → API Management),\n" +
+    "then add it to your MCP config, e.g.:\n" +
+    '  claude mcp add qaeverest -e QAEVEREST_API_KEY=qae_xxx -- npx qaeverest-mcp'
+  );
+  process.exit(1);
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+// ── Token management ──────────────────────────────────────────────────────────
+// The public API uses short-lived JWTs (8h) exchanged from the API key.
+// Cache the token and refresh a few minutes before expiry or on a 401.
+
+const TOKEN_TTL_MS = 8 * 60 * 60 * 1000;
+const TOKEN_REFRESH_MARGIN_MS = 5 * 60 * 1000;
+
+let cachedToken = null;
+let tokenExpiresAt = 0;
+
+async function getToken(forceRefresh = false) {
+  if (!forceRefresh && cachedToken && Date.now() < tokenExpiresAt - TOKEN_REFRESH_MARGIN_MS) {
+    return cachedToken;
+  }
+  const res = await fetch(`${BASE_URL}/api/v1/auth/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ apiKey: API_KEY }),
+  });
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.token) {
+    throw new Error(data.error || `Authentication failed (HTTP ${res.status}). Check QAEVEREST_API_KEY.`);
+  }
+  cachedToken = data.token;
+  tokenExpiresAt = Date.now() + TOKEN_TTL_MS;
+  return cachedToken;
+}
+
+async function apiFetch(path, { method = "GET", body, timeoutMs = 5 * 60 * 1000 } = {}, retryOn401 = true) {
+  const token = await getToken();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(`${BASE_URL}${path}`, {
+      method,
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${token}`,
+      },
+      body: body ? JSON.stringify(body) : undefined,
+      signal: controller.signal,
+    });
+    if (res.status === 401 && retryOn401) {
+      await getToken(true);
+      return apiFetch(path, { method, body, timeoutMs }, false);
+    }
+    const data = await res.json().catch(() => ({}));
+    return { status: res.status, ok: res.ok, data };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// ── Result helpers ────────────────────────────────────────────────────────────
+
+const errorResult = (message) => ({
+  content: [{ type: "text", text: `Error: ${message}` }],
+  isError: true,
+});
+
+const textResult = (text) => ({ content: [{ type: "text", text }] });
+
+// Map a non-2xx response from a metered endpoint to a friendly tool error.
+function mapHttpError(status, data) {
+  if (status === 402) return errorResult(`${data.error || "Insufficient credits."} Top up your QAEverest plan to continue.`);
+  if (status === 403) return errorResult(data.error || "This service isn't enabled for your account. Ask your QAEverest admin to enable it.");
+  if (status === 429) return errorResult(data.error || "Monthly request limit reached.");
+  return errorResult(data.error || `QAEverest API returned HTTP ${status}.`);
+}
+
+function creditFooter(result) {
+  const parts = [];
+  if (result.creditsUsed !== undefined) parts.push(`Credits used: ${result.creditsUsed}`);
+  if (result.creditsRemaining !== undefined) parts.push(`Credits remaining: ${result.creditsRemaining}`);
+  return parts.length ? ["---", parts.join(" · ")] : [];
+}
+
+// ── Output formatting ─────────────────────────────────────────────────────────
+
+function formatTestcases(result, heading = "Generated Test Cases") {
+  const list = result.testcases || [];
+  const lines = [`# ${heading} (${result.count ?? list.length})`, ""];
+  for (const tc of list) {
+    const tags = (tc.tags || []).join(" ");
+    lines.push(`## ${tc.id ? `[${tc.id}] ` : ""}${tc.title || "Untitled scenario"}`);
+    const meta = [
+      tc.category && `Category: ${tc.category}`,
+      tc.priority && `Priority: ${tc.priority}`,
+      tags && `Tags: ${tags}`,
+    ].filter(Boolean);
+    if (meta.length) lines.push(`*${meta.join(" · ")}*`);
+    lines.push("");
+    if (tc.steps?.length) {
+      lines.push("```gherkin");
+      for (const step of tc.steps) lines.push(step);
+      lines.push("```");
+    }
+    if (tc.test_data) {
+      lines.push("**Test data:**", "```json", JSON.stringify(tc.test_data, null, 2), "```");
+    }
+    if (tc.examples) {
+      lines.push("**Examples:**", "```json", JSON.stringify(tc.examples, null, 2), "```");
+    }
+    lines.push("");
+  }
+  lines.push(...creditFooter(result));
+  return lines.join("\n");
+}
+
+function formatSecurity(r) {
+  const lines = [`# Security Scan — ${r.url}`, ""];
+  lines.push(`**Scan type:** ${r.scanType} · **Overall risk:** ${String(r.overallRisk || "unknown").toUpperCase()}`);
+  const ic = r.issueCount || {};
+  lines.push(`**Issues:** ${["critical", "high", "medium", "low", "info"].map((k) => `${k} ${ic[k] || 0}`).join(" · ")}`, "");
+
+  const res = r.results || {};
+  const findingLine = (f) => {
+    const label = f.header || f.title || f.name || f.check || "Finding";
+    const detail = f.message || f.description || "";
+    return `- **[${String(f.risk || "info").toUpperCase()}]** ${label}${detail ? ` — ${detail}` : ""}`;
+  };
+  const section = (title, items) => {
+    const flagged = (items || []).filter((f) => f && f.risk && f.risk !== "pass");
+    if (flagged.length) { lines.push(`## ${title}`, ...flagged.map(findingLine), ""); }
+  };
+  section("Security header findings", res.headerFindings);
+  section("Vulnerability findings", res.vulnFindings);
+  if (res.sslResult) {
+    const ssl = res.sslResult;
+    lines.push("## SSL / TLS", `- HTTPS: ${ssl.hasSSL === false ? "not available" : "available"}`);
+    if (Array.isArray(ssl.issues) && ssl.issues.length) ssl.issues.forEach((i) => lines.push(`- ${i}`));
+    lines.push("");
+  }
+  if (res.httpStatusCode != null) lines.push(`HTTP status: ${res.httpStatusCode}`);
+  lines.push(...creditFooter(r));
+  return lines.join("\n");
+}
+
+function formatPerformance(r) {
+  const lines = [`# Performance Test — ${r.url}`, "", `**Mode:** ${r.testMode}`, "", "## Metrics"];
+  const m = r.metrics || {};
+  const rows = [
+    ["Total requests", m.totalRequests],
+    ["Success / failure", `${m.successCount} / ${m.failureCount}`],
+    ["Error rate", `${m.errorRate}%`],
+    ["Avg response", `${m.avgResponseMs} ms`],
+    ["p95 / p99", `${m.p95ResponseMs} / ${m.p99ResponseMs} ms`],
+    ["Min / max", `${m.minResponseMs} / ${m.maxResponseMs} ms`],
+    ["Throughput", `${m.throughput} req/s`],
+  ];
+  for (const [k, v] of rows) if (v !== undefined) lines.push(`- **${k}:** ${v}`);
+  for (const key of ["stressResult", "spikeResult", "soakSegments"]) {
+    if (r[key]) lines.push("", `## ${key}`, "```json", JSON.stringify(r[key], null, 2), "```");
+  }
+  lines.push("", ...creditFooter(r));
+  return lines.join("\n");
+}
+
+// ── Async (job-based) generation: submit, then poll until done ─────────────────
+
+async function pollJob(path, { intervalMs = 4000, timeoutMs = 5 * 60 * 1000 } = {}) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    const { ok, data } = await apiFetch(path, { method: "GET", timeoutMs: 30 * 1000 });
+    if (ok && (data.status === "completed" || data.status === "failed")) return data;
+  }
+  return null;
+}
+
+async function runAsyncGeneration({ submitPath, body, heading }) {
+  try {
+    const submit = await apiFetch(submitPath, { method: "POST", body, timeoutMs: 60 * 1000 });
+    if (!submit.ok) return mapHttpError(submit.status, submit.data);
+
+    const jobId = submit.data.jobId;
+    if (!jobId) return errorResult("Job was accepted but no job id was returned.");
+    const statusPath = submit.data.statusUrl || `${submitPath}/${jobId}`;
+
+    const job = await pollJob(statusPath);
+    if (!job) return errorResult("Generation is still running after 5 minutes. Try again later or simplify the story.");
+    if (job.status === "failed") return errorResult(job.error || "Generation failed.");
+
+    return textResult(formatTestcases({ ...(job.result || {}), creditsUsed: job.creditsUsed }, heading));
+  } catch (err) {
+    if (err.name === "AbortError") return errorResult("Request timed out. Please try again.");
+    return errorResult(err.message);
+  }
+}
+
+// Shared input fields for AI generation tools.
+const genFields = {
+  domain_name: z.string().optional().describe('Business domain for context, e.g. "Banking", "Healthcare", "E-commerce".'),
+  module_name: z.string().optional().describe('Application module / feature area, e.g. "Login", "Checkout".'),
+  additional: z.string().optional().describe("Extra instructions for the AI, e.g. focus areas, tools, or constraints."),
+};
+
+// ── MCP server + tools ────────────────────────────────────────────────────────
+
+const server = new McpServer({ name: "qaeverest", version: "1.1.0" });
+
+// 1. Functional / general test-case generation (sync).
+server.registerTool(
+  "generate_testcases",
+  {
+    title: "Generate Test Cases",
+    description:
+      "Generate AI-powered QA test cases from a user story or feature description using QAEverest. " +
+      "Returns structured test scenarios in Gherkin format (Given/When/Then) covering positive, negative " +
+      "and edge cases. Consumes 1 QAEverest credit per call. Generation can take 1-3 minutes.",
+    inputSchema: {
+      user_story: z
+        .string()
+        .min(10)
+        .describe(
+          "The user story, requirement, or feature description to generate test cases from. " +
+          "More detail produces better coverage (acceptance criteria, validation rules, edge conditions)."
+        ),
+      test_type: z
+        .enum(["Functional", "System", "Performance", "Security", "API"])
+        .default("Functional")
+        .describe("The kind of testing to generate test cases for."),
+      tc_type: z
+        .enum(["manual", "automated"])
+        .default("manual")
+        .describe("Whether test cases are written for manual execution or as automation-ready scenarios."),
+      ...genFields,
+    },
+  },
+  async ({ user_story, test_type, domain_name, module_name, tc_type, additional }) => {
+    try {
+      const { status, ok, data } = await apiFetch("/api/v1/generate-testcases", {
+        method: "POST",
+        body: { story: user_story, test_type, domain_name, module_name, tc_type, additional },
+      });
+      if (!ok) return mapHttpError(status, data);
+      return textResult(formatTestcases(data));
+    } catch (err) {
+      if (err.name === "AbortError") return errorResult("Generation timed out after 5 minutes. Please try again.");
+      return errorResult(err.message);
+    }
+  }
+);
+
+// 2. API test generation (sync) — accepts a story OR an OpenAPI/Postman spec.
+server.registerTool(
+  "generate_api_tests",
+  {
+    title: "Generate API Tests",
+    description:
+      "Generate AI-powered API test cases with QAEverest. Accepts either a plain description of the API " +
+      "to test, OR an OpenAPI/Swagger spec or Postman collection pasted as text. Returns automation-ready " +
+      "API scenarios (positive, negative, boundary, auth). Consumes QAEverest credits (apiAutomation service). " +
+      "Generation can take 1-3 minutes.",
+    inputSchema: {
+      spec: z
+        .string()
+        .min(10)
+        .describe(
+          "Either a description of the API/endpoint to test, OR an OpenAPI/Swagger spec or Postman " +
+          "collection pasted as text."
+        ),
+      tc_type: z
+        .enum(["manual", "automated"])
+        .default("automated")
+        .describe("manual, or automation-ready scenarios (default)."),
+      ...genFields,
+    },
+  },
+  async ({ spec, tc_type, domain_name, module_name, additional }) => {
+    try {
+      const { status, ok, data } = await apiFetch("/api/v1/api-tests/generate", {
+        method: "POST",
+        body: { spec, tc_type, domain_name, module_name, additional },
+      });
+      if (!ok) return mapHttpError(status, data);
+      return textResult(formatTestcases(data, "Generated API Test Cases"));
+    } catch (err) {
+      if (err.name === "AbortError") return errorResult("Generation timed out after 5 minutes. Please try again.");
+      return errorResult(err.message);
+    }
+  }
+);
+
+// 3. UI automation test generation (async job).
+server.registerTool(
+  "generate_ui_tests",
+  {
+    title: "Generate UI Automation Tests",
+    description:
+      "Generate AI-powered end-to-end UI automation test cases (navigate / click / type / assert steps) from a " +
+      "scenario or user story, using QAEverest. This GENERATES the test cases — it does not drive a live browser. " +
+      "Runs as a background job and may take a few minutes. Consumes QAEverest credits (uiAutomation service).",
+    inputSchema: {
+      story: z
+        .string()
+        .min(10)
+        .describe("The UI scenario or user story to generate end-to-end UI automation test cases for."),
+      ...genFields,
+    },
+  },
+  async ({ story, domain_name, module_name, additional }) =>
+    runAsyncGeneration({
+      submitPath: "/api/v1/ui-tests",
+      body: { story, domain_name, module_name, additional },
+      heading: "Generated UI Automation Test Cases",
+    })
+);
+
+// 4. Mobile automation test generation (async job).
+server.registerTool(
+  "generate_mobile_tests",
+  {
+    title: "Generate Mobile Automation Tests",
+    description:
+      "Generate AI-powered mobile UI automation test cases (covering gestures, device states, and platform-specific " +
+      "behaviours) from a scenario or user story, using QAEverest. This GENERATES the test cases — it does not drive a " +
+      "live device. Runs as a background job and may take a few minutes. Consumes QAEverest credits (mobileAutomation service).",
+    inputSchema: {
+      story: z
+        .string()
+        .min(10)
+        .describe("The mobile scenario or user story to generate mobile automation test cases for."),
+      ...genFields,
+    },
+  },
+  async ({ story, domain_name, module_name, additional }) =>
+    runAsyncGeneration({
+      submitPath: "/api/v1/mobile-tests",
+      body: { story, domain_name, module_name, additional },
+      heading: "Generated Mobile Automation Test Cases",
+    })
+);
+
+// 5. Security scan (sync).
+server.registerTool(
+  "security_scan",
+  {
+    title: "Security Scan",
+    description:
+      "Run a QAEverest security scan against a URL: checks security headers, SSL/TLS configuration, and common " +
+      "vulnerabilities, and returns a risk-rated list of findings. Consumes QAEverest credits (securityAutomation service).",
+    inputSchema: {
+      url: z.string().url().describe("The full URL to scan, including http:// or https://."),
+      scanType: z
+        .enum(["headers", "ssl", "vulnerability", "full"])
+        .default("full")
+        .describe("Which checks to run. 'full' runs all of them (default)."),
+      method: z
+        .enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"])
+        .default("GET")
+        .describe("HTTP method to probe the URL with."),
+      headers: z
+        .record(z.string())
+        .optional()
+        .describe("Optional request headers as a key/value object (e.g. an Authorization header)."),
+    },
+  },
+  async ({ url, scanType, method, headers }) => {
+    try {
+      const { status, ok, data } = await apiFetch("/api/v1/security-scan", {
+        method: "POST",
+        body: { url, scanType, method, headers },
+      });
+      if (!ok) return mapHttpError(status, data);
+      return textResult(formatSecurity(data));
+    } catch (err) {
+      if (err.name === "AbortError") return errorResult("Scan timed out. Please try again.");
+      return errorResult(err.message);
+    }
+  }
+);
+
+// 6. Performance test (sync; API-tier caps keep a single call bounded).
+server.registerTool(
+  "performance_test",
+  {
+    title: "Performance Test",
+    description:
+      "Run a QAEverest performance test against a URL (load, stress, spike, or soak) and return latency, throughput, " +
+      "and error-rate metrics. API-tier caps keep a single call bounded (~1 minute); heavier runs belong in the in-app " +
+      "Performance module. Consumes QAEverest credits (performanceAutomation service).",
+    inputSchema: {
+      url: z.string().url().describe("The full URL to test, including http:// or https://."),
+      testMode: z
+        .enum(["load", "stress", "spike", "soak"])
+        .default("load")
+        .describe("The performance profile to run. (stress/spike use sensible server-side defaults.)"),
+      method: z
+        .enum(["GET", "POST", "PUT", "PATCH", "DELETE"])
+        .default("GET")
+        .describe("HTTP method for each request."),
+      headers: z.record(z.string()).optional().describe("Optional request headers as a key/value object."),
+      body: z.string().optional().describe("Optional request body (for POST/PUT)."),
+      virtualUsers: z.number().int().positive().optional().describe("Concurrent virtual users (load/soak). Server caps apply."),
+      duration: z.number().int().positive().optional().describe("Test duration in seconds. Server caps apply (load ≤ 60s, soak ≤ 90s)."),
+      rampUp: z.number().int().nonnegative().optional().describe("Ramp-up time in seconds (load mode)."),
+    },
+  },
+  async ({ url, testMode, method, headers, body, virtualUsers, duration, rampUp }) => {
+    try {
+      const { status, ok, data } = await apiFetch("/api/v1/performance-test", {
+        method: "POST",
+        body: { url, testMode, method, headers, body, virtualUsers, duration, rampUp },
+      });
+      if (!ok) return mapHttpError(status, data);
+      return textResult(formatPerformance(data));
+    } catch (err) {
+      if (err.name === "AbortError") return errorResult("Performance test timed out. Please try again.");
+      return errorResult(err.message);
+    }
+  }
+);
+
+// 7. Usage / credits (read-only).
+server.registerTool(
+  "get_usage",
+  {
+    title: "Get QAEverest Usage",
+    description:
+      "Check your QAEverest API usage: credits remaining, requests this month, and which services are enabled for your account.",
+    inputSchema: {},
+  },
+  async () => {
+    try {
+      const { ok, status, data } = await apiFetch("/api/v1/usage", { timeoutMs: 30 * 1000 });
+      if (!ok) return mapHttpError(status, data);
+
+      const services = Object.entries(data.servicesEnabled || {})
+        .map(([name, enabled]) => `- ${name}: ${enabled ? "enabled" : "disabled"}`)
+        .join("\n");
+
+      const text = [
+        `# QAEverest Usage${data.company ? ` — ${data.company}` : ""}`,
+        "",
+        `Credits: ${data.creditsUsed} used of ${data.creditsLimit} (${data.creditsRemaining} remaining)`,
+        `Requests this month: ${data.requestsThisMonth}${data.requestsLimit ? ` of ${data.requestsLimit}` : ""}`,
+        "",
+        "## Services",
+        services || "(none reported)",
+      ].join("\n");
+
+      return textResult(text);
+    } catch (err) {
+      return errorResult(err.message);
+    }
+  }
+);
+
+// ── Start ─────────────────────────────────────────────────────────────────────
+
+const transport = new StdioServerTransport();
+await server.connect(transport);
+console.error(`[qaeverest-mcp] ready — API: ${BASE_URL}`);