mcp-api-test 0.2.0__tar.gz → 0.2.1__tar.gz

{mcp_api_test-0.2.0/src/mcp_api_test.egg-info → mcp_api_test-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-api-test
-Version: 0.2.0
+Version: 0.2.1
 Summary: MCP server for testing REST API with built-in assertions
 Author: Ryan Febriansyah
 License-Expression: MIT
@@ -15,6 +15,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -40,7 +41,7 @@ Unlike traditional testing frameworks, `mcp-api-test` exposes API testing as a *
 
 It complements (rather than replaces) tools like pytest, Postman, and Playwright.
 
-> **Breaking changes in v0.2.0.** The server now runs on `mcp` 2.x, and the package layout moved from flat top-level modules to a proper `mcp_api_test` package. If you import internals directly, you may update to `from mcp_api_test.server import ...`. MCP client configuration (OpenCode, Claude Desktop, Claude Code) is unaffected. See the [changelog](docs/changelog.md) for details.
+> **Breaking changes in v0.2.0.** The server now runs on `mcp` 2.x, and the package layout moved from flat top-level modules to a proper `mcp_api_test` package. If you import internals directly, you may update to `from mcp_api_test.server import ...`. MCP client configuration (OpenCode, Claude Desktop, Claude Code) is unaffected. See the [changelog](https://ryaneatfood.gitlab.io/mcp-api-testing/changelog/) for details.
 
 ## Use cases
 
@@ -105,10 +106,10 @@ The agent invokes `run_test_api`, validates against the expected contract, and r
 
 Full documentation is hosted on this [page](https://ryaneatfood.gitlab.io/mcp-api-testing/), and another way to navigate the docs:
 
-- **[Getting Started](docs/getting-started/installation.md)**: installation and client setup
-- **[Usage](docs/usage/request-modes.md)**: cURL mode, structured mode, assertions, response format
-- **[Guides](docs/guides/troubleshooting.md)**: troubleshooting, development, configuration
-- **[Reference](docs/reference/tool-parameters.md)**: full parameter reference
+- **[Getting Started](https://ryaneatfood.gitlab.io/mcp-api-testing/getting-started/installation/)**: installation and client setup
+- **[Usage](https://ryaneatfood.gitlab.io/mcp-api-testing/usage/request-modes/)**: cURL mode, structured mode, assertions, response format
+- **[Guides](https://ryaneatfood.gitlab.io/mcp-api-testing/guides/troubleshooting/)**: troubleshooting, development, configuration
+- **[Reference](https://ryaneatfood.gitlab.io/mcp-api-testing/reference/tool-parameters/)**: full parameter reference
 
 ## License
 

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/README.md

@@ -8,7 +8,7 @@ Unlike traditional testing frameworks, `mcp-api-test` exposes API testing as a *
 
 It complements (rather than replaces) tools like pytest, Postman, and Playwright.
 
-> **Breaking changes in v0.2.0.** The server now runs on `mcp` 2.x, and the package layout moved from flat top-level modules to a proper `mcp_api_test` package. If you import internals directly, you may update to `from mcp_api_test.server import ...`. MCP client configuration (OpenCode, Claude Desktop, Claude Code) is unaffected. See the [changelog](docs/changelog.md) for details.
+> **Breaking changes in v0.2.0.** The server now runs on `mcp` 2.x, and the package layout moved from flat top-level modules to a proper `mcp_api_test` package. If you import internals directly, you may update to `from mcp_api_test.server import ...`. MCP client configuration (OpenCode, Claude Desktop, Claude Code) is unaffected. See the [changelog](https://ryaneatfood.gitlab.io/mcp-api-testing/changelog/) for details.
 
 ## Use cases
 
@@ -73,10 +73,10 @@ The agent invokes `run_test_api`, validates against the expected contract, and r
 
 Full documentation is hosted on this [page](https://ryaneatfood.gitlab.io/mcp-api-testing/), and another way to navigate the docs:
 
-- **[Getting Started](docs/getting-started/installation.md)**: installation and client setup
-- **[Usage](docs/usage/request-modes.md)**: cURL mode, structured mode, assertions, response format
-- **[Guides](docs/guides/troubleshooting.md)**: troubleshooting, development, configuration
-- **[Reference](docs/reference/tool-parameters.md)**: full parameter reference
+- **[Getting Started](https://ryaneatfood.gitlab.io/mcp-api-testing/getting-started/installation/)**: installation and client setup
+- **[Usage](https://ryaneatfood.gitlab.io/mcp-api-testing/usage/request-modes/)**: cURL mode, structured mode, assertions, response format
+- **[Guides](https://ryaneatfood.gitlab.io/mcp-api-testing/guides/troubleshooting/)**: troubleshooting, development, configuration
+- **[Reference](https://ryaneatfood.gitlab.io/mcp-api-testing/reference/tool-parameters/)**: full parameter reference
 
 ## License
 

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "mcp-api-test"
-version = "0.2.0"
+version = "0.2.1"
 description = "MCP server for testing REST API with built-in assertions"
 readme = "README.md"
 license = "MIT"
@@ -28,6 +28,7 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
     "Topic :: Software Development :: Quality Assurance",
     "Topic :: Software Development :: Testing",
+    "Typing :: Typed",
 ]
 
 [project.scripts]

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/src/mcp_api_test/__init__.py

@@ -1,3 +1,3 @@
 """Lightweight MCP for REST API testing for Claude Desktop and OpenCode"""
 
-__version__ = "0.2.0"
+__version__ = "0.2.1"

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/src/mcp_api_test/flags.py

@@ -12,7 +12,7 @@ CURL_VALUE_FLAGS: dict[str, str] = {
     "--data-raw": "data",  # browser DevTools "Copy as cURL" uses this
     "--data-binary": "data",  # common in API clients
     "--data-urlencode": "data",  # URL-encoded payloads
-    "-u": "user",
+    "-u": "user",  # basic auth, applied via httpx.BasicAuth
     "--user": "user",
     "--url": "url_flag",  # explicit --url form
     "-A": "user_agent",
@@ -53,9 +53,4 @@ CURL_BOOLEAN_FLAGS: set[str] = {
 
 # flags that we recognize but want to surface with a warning for,
 # emit a logger.warning with a human-readable explanation
-CURL_WARN_FLAGS: dict[str, str] = {
-    "-k": "--insecure is not supported: TLS verification will still be enforced",
-    "--insecure": "--insecure is not supported: TLS verification will still be enforced",
-    "-u": "-u/--user (basic auth) is not supported: add an Authorization header explicitly",
-    "--user": "-u/--user (basic auth) is not supported: add an Authorization header explicitly",
-}
+CURL_WARN_FLAGS: dict[str, str] = {}

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/src/mcp_api_test/server.py

@@ -4,7 +4,7 @@ import time
 import httpx
 from dotenv import load_dotenv
 from urllib.parse import urlparse
-from typing import Optional, Dict, Any, List
+from typing import Optional, Dict, Any, List, Union
 from mcp.server.mcpserver import MCPServer
 from .logger import get_logger
 from .models import APITestResult, AssertionResult
@@ -12,6 +12,7 @@ from .utils import (
     render_console_template_result,
     render_error_result,
     build_fullpath_url,
+    redact_curl,
     get_nested_fields,
 )
 from .flags import CURL_BOOLEAN_FLAGS, CURL_VALUE_FLAGS, CURL_WARN_FLAGS
@@ -49,12 +50,16 @@ def parse_curl_command(command: str) -> Dict[str, Any]:
     """
 
     tokens = shlex.split(command)
-
     method = "GET"  # initial HTTP methods
     headers = {}
-    payload = None
+    explicit_method = False
+    data_parts: List[str] = []
+    use_get = False  # -G: send -d data as query string
+    head = False  # -I: HEAD request
+    follow_redirects = False
+    verify_tls = True
+    auth: Optional[tuple[str, str]] = None
     url = None
-
     index = 0
 
     # skip if the leading was 'curl' token
@@ -84,6 +89,7 @@ def parse_curl_command(command: str) -> Dict[str, Any]:
 
             if role == "method":
                 method = value
+                explicit_method = True
             elif role == "header":
                 if ":" in value:
                     key, header_value = value.split(":", 1)
@@ -91,14 +97,10 @@ def parse_curl_command(command: str) -> Dict[str, Any]:
                 else:
                     logger.error(message=f"[curl parser] skipping malformed header")
             elif role == "data":
-                raw_data = value
-                try:
-                    payload = json.loads(raw_data)
-                except json.JSONDecodeError:
-                    logger.error(
-                        f"[curl parser] payload for '{token}' is not valid JSON"
-                    )
-                    payload = raw_data
+                data_parts.append(value)
+            elif role == "user":
+                username, _, password = value.partition(":")
+                auth = (username, password)
             elif role == "url_flag":
                 url = value
             elif role == "user_agent":
@@ -112,6 +114,14 @@ def parse_curl_command(command: str) -> Dict[str, Any]:
         if token in CURL_BOOLEAN_FLAGS:
             if token in CURL_WARN_FLAGS:
                 logger.warning(message=f"[curl parser] {CURL_WARN_FLAGS[token]}")
+            if token in ("-L", "--location"):
+                follow_redirects = True
+            elif token in ("-k", "--insecure"):
+                verify_tls = False
+            elif token in ("-G", "--get"):
+                use_get = True
+            elif token in ("-I", "--head"):
+                head = True
             index += 1
             continue
 
@@ -133,6 +143,23 @@ def parse_curl_command(command: str) -> Dict[str, Any]:
     if not url:
         raise ValueError("URL must be provided in curl command")
 
+    # multiple -d flags are joined with '&' just like curl does, a single
+    # body is kept as JSON when it parses and as a raw string otherwise
+    payload: Any = None
+    if data_parts and not use_get:
+        raw_data = "&".join(data_parts)
+        try:
+            payload = json.loads(raw_data)
+        except json.JSONDecodeError:
+            logger.error("[curl parser] payload is not valid JSON, sending as raw")
+            payload = raw_data
+
+    # curl defaults to POST when a body is present and no -X was given
+    if head and not explicit_method:
+        method = "HEAD"
+    elif payload is not None and not explicit_method:
+        method = "POST"
+
     parsed = urlparse(url=url)
     base_url = f"{parsed.scheme}://{parsed.netloc}"
     endpoint = parsed.path or "/"
@@ -140,12 +167,18 @@ def parse_curl_command(command: str) -> Dict[str, Any]:
     if parsed.query:
         endpoint += "?" + parsed.query
 
+    if use_get and data_parts:
+        endpoint += ("&" if parsed.query else "?") + "&".join(data_parts)
+
     return {
         "method": method.upper(),
         "base_url": base_url,
         "endpoint": endpoint,
         "headers": headers,
         "request_payload": payload,
+        "follow_redirects": follow_redirects,
+        "verify_tls": verify_tls,
+        "auth": auth,
     }
 
 
@@ -157,7 +190,7 @@ async def run_test_api(
     endpoint: Optional[str] = None,
     method: str = "GET",
     headers: Optional[Dict[str, str]] = None,
-    payload: Optional[Dict[str, Any]] = None,
+    payload: Optional[Union[Dict[str, Any], List[Any]]] = None,
     required_status_code: Optional[int] = None,
     required_status_code_range: Optional[str] = None,
     required_response_fields: Optional[List[str]] = None,
@@ -173,27 +206,49 @@ async def run_test_api(
     `Please test this API based on this cURL, ensure status
     code is 2xx, and response contains 'id'`
     """
-    logger.info(message=f"Testing API: {api_name} with cURL: {curl_command}")
-    if curl_command:
-        parsed = parse_curl_command(command=curl_command)
+    logger.info(
+        message=f"Testing API: {api_name} with cURL: {redact_curl(curl_command) if curl_command else None}"
+    )
+    follow_redirects = False
+    verify_tls = True
+    auth: Optional[tuple[str, str]] = None
+    status_range = (0, 0)
 
+    try:
+        if required_status_code_range is not None:
+            status_range = parse_status_code_range(required_status_code_range)
+        if curl_command:
+            parsed = parse_curl_command(command=curl_command)
+        elif not base_url or not endpoint:
+            raise ValueError(
+                "`base_url` and `endpoint` are required unless cURL command is used"
+            )
+    except ValueError as e:
+        logger.error(message=f"Invalid input for API: {api_name}, error: {e}")
+        return render_error_result(
+            api_name=api_name,
+            method=method.upper(),
+            url=base_url or "",
+            error=f"ValueError: {e}",
+        )
+
+    if curl_command:
         method = parsed["method"]
         base_url = parsed["base_url"]
         endpoint = parsed["endpoint"]
         headers = parsed["headers"]
         payload = parsed["request_payload"]
+        follow_redirects = parsed["follow_redirects"]
+        verify_tls = parsed["verify_tls"]
+        auth = parsed["auth"]
 
-    if not base_url:
-        raise ValueError("`base_url` is required unless cURL command is used")
-
-    if not endpoint:
-        raise ValueError("`endpoint` is required unless cURL command is used")
+    assert base_url and endpoint  # validated above
 
     full_path_url = build_fullpath_url(base_url=base_url, endpoint=endpoint)
     method = method.upper()
 
     content: Optional[str] = None
-    json_payload: Optional[Dict[str, Any]] = None
+    json_payload: Optional[Union[Dict[str, Any], List[Any]]] = None
     if payload is not None:
         # cURL parser may produce a raw string for non-JSON -d payloads
         # (example: form-encoded data). Use content= to send as-is rather
@@ -205,13 +260,16 @@ async def run_test_api(
 
     start_time = time.perf_counter()
     try:
-        async with httpx.AsyncClient(timeout=30) as client:
+        async with httpx.AsyncClient(
+            timeout=30, follow_redirects=follow_redirects, verify=verify_tls
+        ) as client:
             response = await client.request(
                 method=method,
                 url=full_path_url,
                 headers=headers,
                 content=content,
                 json=json_payload,
+                auth=auth,
             )
             end_time = time.perf_counter()
             response_time_ms = (end_time - start_time) * 1000
@@ -246,7 +304,7 @@ async def run_test_api(
 
     if required_status_code_range is not None:
         # low refers to 1xx - 2xx and high refers to 3xx - 5xx
-        low, high = parse_status_code_range(required_status_code_range)
+        low, high = status_range
         passed = low <= response.status_code <= high
         assertions.append(
             {

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/src/mcp_api_test/utils.py

@@ -1,8 +1,27 @@
 """Utility functions for MCP API testing"""
 
+import json
+import re
 from typing import Any
 from .models import APITestResult
 
+MAX_BODY_CHARS = 2000
+
+_SENSITIVE_HEADER = re.compile(
+    r"(?i)((?:proxy-)?authorization|cookie|set-cookie|x-api-key|x-auth-token)"
+    r"(\s*:\s*)[^'\"]*"
+)
+_USER_FLAG = re.compile(r"(?i)(\s(?:-u|--user)[\s=])(?:'[^']*'|\"[^\"]*\"|\S+)")
+
+
+def redact_curl(command: str) -> str:
+    """
+    Mask credentials (auth headers, cookies, -u user:pass) in a cURL command
+    so it is safe to write to the log file
+    """
+    command = _SENSITIVE_HEADER.sub(r"\1\2***", command)
+    return _USER_FLAG.sub(r"\1***", command)
+
 
 def render_console_template_result(result: APITestResult) -> str:
     """
@@ -24,7 +43,7 @@ def render_console_template_result(result: APITestResult) -> str:
     lines.append(f"Method          : {result.method}")
     lines.append(f"URL             : {result.url}")
     lines.append(f"Status Code     : {result.status_code}")
-    lines.append(f"Response Time   : {result.response_time_ms} ms")
+    lines.append(f"Response Time   : {result.response_time_ms:.2f} ms")
     lines.append(f"Overall Result  : {'Passed' if result.passed else 'Failed'}")
 
     lines.append("")
@@ -34,7 +53,12 @@ def render_console_template_result(result: APITestResult) -> str:
     if result.assertions:
         for assertion in result.assertions:
             symbol = "✓" if assertion.passed else "x"
-            lines.append(f"{symbol} {assertion.assertion}")
+            line = f"{symbol} {assertion.assertion}"
+            if assertion.expected is not None or assertion.actual is not None:
+                line += (
+                    f" (expected: {assertion.expected!r}, actual: {assertion.actual!r})"
+                )
+            lines.append(line)
 
         lines.append("")
         lines.append("Summary")
@@ -45,6 +69,19 @@ def render_console_template_result(result: APITestResult) -> str:
     else:
         lines.append("  (no assertions provided)")
 
+    lines.append("")
+    lines.append("Response Body")
+    lines.append(divider)
+    body = (
+        result.response_body
+        if isinstance(result.response_body, str)
+        else json.dumps(result.response_body)
+    )
+    if len(body) > MAX_BODY_CHARS:
+        omitted = len(body) - MAX_BODY_CHARS
+        body = body[:MAX_BODY_CHARS] + f"... [truncated {omitted} chars]"
+    lines.append(body)
+
     return "\n".join(lines)
 
 

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1/src/mcp_api_test.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-api-test
-Version: 0.2.0
+Version: 0.2.1
 Summary: MCP server for testing REST API with built-in assertions
 Author: Ryan Febriansyah
 License-Expression: MIT
@@ -15,6 +15,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: Software Development :: Quality Assurance
 Classifier: Topic :: Software Development :: Testing
+Classifier: Typing :: Typed
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
@@ -40,7 +41,7 @@ Unlike traditional testing frameworks, `mcp-api-test` exposes API testing as a *
 
 It complements (rather than replaces) tools like pytest, Postman, and Playwright.
 
-> **Breaking changes in v0.2.0.** The server now runs on `mcp` 2.x, and the package layout moved from flat top-level modules to a proper `mcp_api_test` package. If you import internals directly, you may update to `from mcp_api_test.server import ...`. MCP client configuration (OpenCode, Claude Desktop, Claude Code) is unaffected. See the [changelog](docs/changelog.md) for details.
+> **Breaking changes in v0.2.0.** The server now runs on `mcp` 2.x, and the package layout moved from flat top-level modules to a proper `mcp_api_test` package. If you import internals directly, you may update to `from mcp_api_test.server import ...`. MCP client configuration (OpenCode, Claude Desktop, Claude Code) is unaffected. See the [changelog](https://ryaneatfood.gitlab.io/mcp-api-testing/changelog/) for details.
 
 ## Use cases
 
@@ -105,10 +106,10 @@ The agent invokes `run_test_api`, validates against the expected contract, and r
 
 Full documentation is hosted on this [page](https://ryaneatfood.gitlab.io/mcp-api-testing/), and another way to navigate the docs:
 
-- **[Getting Started](docs/getting-started/installation.md)**: installation and client setup
-- **[Usage](docs/usage/request-modes.md)**: cURL mode, structured mode, assertions, response format
-- **[Guides](docs/guides/troubleshooting.md)**: troubleshooting, development, configuration
-- **[Reference](docs/reference/tool-parameters.md)**: full parameter reference
+- **[Getting Started](https://ryaneatfood.gitlab.io/mcp-api-testing/getting-started/installation/)**: installation and client setup
+- **[Usage](https://ryaneatfood.gitlab.io/mcp-api-testing/usage/request-modes/)**: cURL mode, structured mode, assertions, response format
+- **[Guides](https://ryaneatfood.gitlab.io/mcp-api-testing/guides/troubleshooting/)**: troubleshooting, development, configuration
+- **[Reference](https://ryaneatfood.gitlab.io/mcp-api-testing/reference/tool-parameters/)**: full parameter reference
 
 ## License
 

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/src/mcp_api_test.egg-info/SOURCES.txt

@@ -21,4 +21,5 @@ tests/test_mcp_server_compat.py
 tests/test_packaging.py
 tests/test_parse_curl_command.py
 tests/test_parse_status_code.py
+tests/test_run_test_api_behavior.py
 tests/test_utils.py

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/tests/test_packaging.py

@@ -47,3 +47,12 @@ def test_version_matches_pyproject():
     import mcp_api_test
 
     assert mcp_api_test.__version__ == _project_version()
+
+
+def test_release_tooling_is_not_packaged():
+    # smoke script and skill live in the repo only, never in the wheel/sdist
+    packages = _pyproject()["tool"]["setuptools"]["packages"]
+    assert packages == ["mcp_api_test"]
+    manifest = (PROJECT_ROOT / "MANIFEST.in").read_text()
+    assert "scripts" not in manifest and ".claude" not in manifest
+    assert not (PACKAGE_DIR / "smoke.py").exists()

{mcp_api_test-0.2.0 → mcp_api_test-0.2.1}/tests/test_parse_curl_command.py

@@ -2,6 +2,7 @@
 
 import logging
 import pytest
+from mcp_api_test import server
 from mcp_api_test.server import parse_curl_command
 
 
@@ -43,8 +44,10 @@ def test_warn_flag_value_does_not_raise():
     assert result["endpoint"] == "/v1/users"
 
 
-def test_boolean_warn_flag_logs_warning_not_info(caplog):
-    # regression: -k must be emitted at WARNING level, not INFO
+def test_boolean_warn_flag_logs_warning_not_info(caplog, monkeypatch):
+    # regression: warn flags must be emitted at WARNING level, not INFO.
+    # -k is honoured since v0.2.1, so register a warn entry for it here.
+    monkeypatch.setitem(server.CURL_WARN_FLAGS, "-k", "insecure is not supported")
     with caplog.at_level(logging.WARNING):
         parse_curl_command(command="curl -k https://api.example.com/v1/users")
 
@@ -67,3 +70,56 @@ def test_non_json_payload_kept_as_raw_string():
         command="curl -d 'not json' https://api.example.com/v1/users"
     )
     assert result["request_payload"] == "not json"
+
+
+# v0.2.1: cURL semantics
+
+
+def test_data_without_method_defaults_to_post():
+    result = parse_curl_command("curl -d '{\"a\":1}' https://api.example.com/v1/users")
+    assert result["method"] == "POST"
+    assert result["request_payload"] == {"a": 1}
+
+
+def test_explicit_method_wins_over_data_default():
+    result = parse_curl_command("curl -X PUT -d '{}' https://api.example.com/v1/users")
+    assert result["method"] == "PUT"
+
+
+def test_get_flag_moves_data_to_query_string():
+    result = parse_curl_command(
+        "curl -G -d 'q=cat' -d 'page=2' https://api.example.com/search"
+    )
+    assert result["method"] == "GET"
+    assert result["request_payload"] is None
+    assert result["endpoint"] == "/search?q=cat&page=2"
+
+
+def test_get_flag_appends_to_existing_query():
+    result = parse_curl_command("curl -G -d 'b=2' 'https://api.example.com/s?a=1'")
+    assert result["endpoint"] == "/s?a=1&b=2"
+
+
+def test_head_flag_sets_head_method():
+    result = parse_curl_command("curl -I https://api.example.com/health")
+    assert result["method"] == "HEAD"
+
+
+def test_multiple_data_flags_are_joined():
+    result = parse_curl_command("curl -d a=1 -d b=2 https://api.example.com/form")
+    assert result["request_payload"] == "a=1&b=2"
+    assert result["method"] == "POST"
+
+
+def test_location_insecure_and_user_are_captured():
+    result = parse_curl_command("curl -L -k -u me:s3cret https://api.example.com/")
+    assert result["follow_redirects"] is True
+    assert result["verify_tls"] is False
+    assert result["auth"] == ("me", "s3cret")
+
+
+def test_defaults_for_transport_options():
+    result = parse_curl_command("curl https://api.example.com/")
+    assert result["follow_redirects"] is False
+    assert result["verify_tls"] is True
+    assert result["auth"] is None

mcp_api_test-0.2.1/tests/test_run_test_api_behavior.py

@@ -0,0 +1,266 @@
+"""Behaviour tests for run_test_api and its helpers: result rendering, log
+redaction, structured error results, cURL transport options and payload types"""
+
+import json
+import logging
+import pytest
+import respx
+import httpx
+from mcp_api_test import server
+from mcp_api_test.models import APITestResult, AssertionResult
+from mcp_api_test.server import run_test_api
+from mcp_api_test.utils import (
+    MAX_BODY_CHARS,
+    redact_curl,
+    render_console_template_result,
+)
+
+
+def _result(**overrides):
+    base = dict(
+        api_name="t",
+        passed=False,
+        method="GET",
+        url="https://api.example.com/",
+        status_code=500,
+        response_time_ms=123.456789,
+        assertions=[
+            AssertionResult("status_code", False, expected=200, actual=500),
+        ],
+        response_body={"error": "boom"},
+    )
+    base.update(overrides)
+    return APITestResult(**base)
+
+
+# rendering
+
+
+def test_render_shows_expected_and_actual():
+    out = render_console_template_result(_result())
+    assert "x status_code (expected: 200, actual: 500)" in out
+
+
+def test_render_shows_response_body():
+    out = render_console_template_result(_result())
+    assert "Response Body" in out
+    assert '{"error": "boom"}' in out
+
+
+def test_render_rounds_response_time():
+    out = render_console_template_result(_result())
+    assert "123.46 ms" in out
+    assert "123.456789" not in out
+
+
+def test_render_truncates_large_body():
+    big = "x" * (MAX_BODY_CHARS + 50)
+    out = render_console_template_result(_result(response_body=big))
+    assert "[truncated 50 chars]" in out
+    assert big not in out
+
+
+def test_render_plain_text_body_not_json_quoted():
+    out = render_console_template_result(_result(response_body="plain text"))
+    assert "\nplain text" in out
+
+
+# redaction
+
+
+@pytest.mark.parametrize(
+    "command,secret",
+    [
+        ("curl -H 'Authorization: Bearer abc123' https://x.io", "abc123"),
+        ('curl -H "authorization: Basic zzz" https://x.io', "zzz"),
+        ("curl -H 'Cookie: sid=topsecret' https://x.io", "topsecret"),
+        ("curl -H 'X-API-Key: k-999' https://x.io", "k-999"),
+        ("curl -u admin:hunter2 https://x.io", "hunter2"),
+        ("curl --user 'admin:hunter2' https://x.io", "hunter2"),
+    ],
+)
+def test_redact_curl_masks_secrets(command, secret):
+    redacted = redact_curl(command)
+    assert secret not in redacted
+    assert "***" in redacted
+    assert "https://x.io" in redacted
+
+
+def test_redact_curl_keeps_harmless_headers():
+    cmd = "curl -H 'Accept: application/json' https://x.io"
+    assert redact_curl(cmd) == cmd
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_bearer_token_not_written_to_log(caplog):
+    respx.get("https://api.example.com/me").mock(return_value=httpx.Response(200))
+    with caplog.at_level(logging.INFO):
+        await run_test_api(
+            api_name="leak-check",
+            curl_command="curl -H 'Authorization: Bearer SUPERSECRET' https://api.example.com/me",
+        )
+    assert "SUPERSECRET" not in caplog.text
+
+
+# error handling: bad input returns a structured result instead of raising
+
+
+@pytest.mark.asyncio
+async def test_bad_status_range_returns_error_result():
+    out = await run_test_api(
+        api_name="bad-range",
+        base_url="https://api.example.com",
+        endpoint="/",
+        required_status_code_range="abc",
+    )
+    assert "Overall Result  : Failed" in out
+    assert "ValueError" in out
+
+
+@pytest.mark.asyncio
+async def test_bad_curl_returns_error_result():
+    out = await run_test_api(
+        api_name="bad-curl", curl_command="curl --bogus https://x.io"
+    )
+    assert "Overall Result  : Failed" in out
+    assert "Unsupported cURL option" in out
+
+
+@pytest.mark.asyncio
+async def test_missing_url_returns_error_result():
+    out = await run_test_api(api_name="no-url")
+    assert "Overall Result  : Failed" in out
+    assert "required" in out
+
+
+# end-to-end cURL semantics
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_curl_data_without_method_sends_post():
+    route = respx.post("https://api.example.com/v1/users").mock(
+        return_value=httpx.Response(201, json={"id": 1})
+    )
+    out = await run_test_api(
+        api_name="create",
+        curl_command='curl -d \'{"name":"x"}\' https://api.example.com/v1/users',
+        required_status_code=201,
+    )
+    assert route.called
+    assert "Overall Result  : Passed" in out
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_curl_user_sends_basic_auth():
+    route = respx.get("https://api.example.com/me").mock(
+        return_value=httpx.Response(200)
+    )
+    await run_test_api(
+        api_name="basic", curl_command="curl -u me:pw https://api.example.com/me"
+    )
+    assert route.calls.last.request.headers["authorization"].startswith("Basic ")
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_curl_location_follows_redirects():
+    respx.get("https://api.example.com/old").mock(
+        return_value=httpx.Response(
+            302, headers={"location": "https://api.example.com/new"}
+        )
+    )
+    respx.get("https://api.example.com/new").mock(return_value=httpx.Response(200))
+    out = await run_test_api(
+        api_name="redir",
+        curl_command="curl -L https://api.example.com/old",
+        required_status_code=200,
+    )
+    assert "Overall Result  : Passed" in out
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_without_location_redirect_not_followed():
+    respx.get("https://api.example.com/old").mock(
+        return_value=httpx.Response(
+            302, headers={"location": "https://api.example.com/new"}
+        )
+    )
+    out = await run_test_api(
+        api_name="no-redir",
+        curl_command="curl https://api.example.com/old",
+        required_status_code=302,
+    )
+    assert "Overall Result  : Passed" in out
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_curl_head_flag_sends_head():
+    route = respx.head("https://api.example.com/health").mock(
+        return_value=httpx.Response(200)
+    )
+    await run_test_api(
+        api_name="head", curl_command="curl -I https://api.example.com/health"
+    )
+    assert route.called
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_curl_get_flag_sends_data_as_query():
+    route = respx.get("https://api.example.com/search").mock(
+        return_value=httpx.Response(200)
+    )
+    await run_test_api(
+        api_name="q", curl_command="curl -G -d q=cat https://api.example.com/search"
+    )
+    assert route.calls.last.request.url.query == b"q=cat"
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_curl_insecure_disables_tls_verification(monkeypatch):
+    seen = {}
+    real = httpx.AsyncClient
+
+    def spy(*args, **kwargs):
+        seen.update(kwargs)
+        return real(*args, **kwargs)
+
+    monkeypatch.setattr(server.httpx, "AsyncClient", spy)
+    respx.get("https://api.example.com/").mock(return_value=httpx.Response(200))
+    await run_test_api(api_name="k", curl_command="curl -k https://api.example.com/")
+    assert seen["verify"] is False
+
+
+# structured mode: JSON array payloads
+
+
+@pytest.mark.asyncio
+@respx.mock
+async def test_list_payload_is_sent_as_json_array():
+    route = respx.post("https://api.example.com/bulk").mock(
+        return_value=httpx.Response(200)
+    )
+    await run_test_api(
+        api_name="bulk",
+        base_url="https://api.example.com",
+        endpoint="/bulk",
+        method="POST",
+        payload=[{"id": 1}, {"id": 2}],
+        required_status_code=200,
+    )
+    assert json.loads(route.calls.last.request.content) == [{"id": 1}, {"id": 2}]
+
+
+def test_run_test_api_schema_accepts_array_payload():
+    import asyncio
+
+    tools = asyncio.run(server.mcp.list_tools())
+    tool = next(t for t in tools if t.name == "run_test_api")
+    payload_schema = tool.input_schema["properties"]["payload"]
+    assert "array" in str(payload_schema)