@qase/mcp-server
io.qase/mcp-server · version 3.0.6 · 11,871 weekly npm downloads · audited 2026-11-05
Notes
Findings
No hidden-instruction or invisible-character findings in any tool, prompt, or resource description.
Claude Connectors Directory readiness
- ✅ Every tool has a title 42 of 42 tools
- ❌ Every tool declares readOnlyHint or destructiveHint Missing on 13 of 42: qase_attachment_delete, qase_case_delete, qase_custom_field_delete, qase_defect_delete and 9 more
- ✅ Tool names are 64 characters or fewer All within limit
- ❌ Descriptions avoid instructions about model behavior or other tools 37 of 42 descriptions reference other tools or tell the model what it must do: qase_api, qase_attachment_delete, qase_attachment_upload, qase_case_bulk_create and 33 more
- ✅ No hidden instructions or invisible characters in tool metadata None found
Checks the directory's published tool requirements that are visible from tools/list. Passing them does not guarantee acceptance.
What this server's tools can do
- Has delete or destructive operations:
qase_attachment_delete,qase_case_delete,qase_custom_field_delete,qase_defect_delete,qase_environment_delete,qase_milestone_delete,qase_plan_delete,qase_project_delete,qase_result_delete,qase_review_delete,qase_run_delete,qase_shared_step_delete,qase_suite_delete
Not a vulnerability by itself. It tells you what an injected prompt could ask this server to do, so you can decide which tools need approval.
Supply chain
- Install scripts: none
- npm provenance: yes
- Source repository linked: yes
- License: MIT
- Direct dependencies: 13
Tools (42)
| Name | Title | Hint | Description |
|---|---|---|---|
qase_api | Call Qase API | none | Call any Qase REST endpoint directly, for the few things no dedicated tool covers: method, a /v1/… path on the configured host, optional body or query. Prefer a dedicated tool where one exists — they normalize enums and … |
qase_attachment_delete | Delete attachment | none | Delete an attachment by its hash (from qase_attachment_upload). Anything referencing it keeps the reference but the file is gone; this cannot be undone. Asks the user for confirmation first. Cost: one API call, about 0.4… |
qase_attachment_upload | Upload attachment | none | Upload files and get back the hashes other tools reference them by. Pass `file_base64` plus `filename` for one file, or `files` for several in one request; `file_path` only works when the server runs on the same machine … |
qase_case_bulk_create | Bulk create test cases | none | Create up to 100 test cases in one request — the batch form of qase_case_upsert, and the right tool whenever more than one case is being written. Same fields and enum handling as qase_case_upsert; creates only, update th… |
qase_case_delete | Delete test case | none | Delete a test case by project code and ID. Its execution history goes with it and this cannot be undone; consider marking it deprecated through qase_case_upsert instead. No bulk delete — one call each, each asking the us… |
qase_case_upsert | Create or update test case | none | Create or update a single test case: with `id` it updates, without it creates. Enum fields accept a label such as "high" or the project's numeric ID. Writing more than one case? Use qase_case_bulk_create — one request in… |
qase_ci_report | Report CI results | none | Report a whole finished CI run in one call: creates the run, records every result, completes it. Use qase_result_record instead when the run already exists and results arrive in stages. Each result needs a numeric `case_… |
qase_custom_field_delete | Delete custom field | none | Delete a custom field by ID. Reach is workspace-wide: it disappears from every project, with the values entered for it, and this cannot be undone. To remove it from one project only, edit `projects_codes` with qase_custo… |
qase_custom_field_upsert | Create or update custom field | none | Create or update a custom field. On create, `entity` (case, run, defect) and `type` are required and fixed forever — the update endpoint cannot change them. Fields are workspace-wide; scope with `projects_codes` or is_en… |
qase_defect_delete | Delete defect | none | Delete a defect by project code and ID; its links to results go with it and this cannot be undone. Usually resolving it through qase_defect_upsert with `id` is the right move, so the record survives. Asks the user for co… |
qase_defect_upsert | Create or update defect | none | Create or update a defect: with `id` it updates, without it creates, and then `title`, `actual_result` and `severity` are required. Severity and status are labels ("blocker", "open"…), mapped for you. For a defect born f… |
qase_discover_tools | Discover more tools | read-only | Search the tool catalogue by what you are trying to do — "delete", "milestone", "review", "custom field" — and get back the matching tools with their descriptions. Every tool is already listed and callable; use this when… |
qase_environment_delete | Delete environment | none | Delete an environment by project code and ID. Runs that referenced it lose the attribution, so filtering history by that environment stops working; this cannot be undone. Asks the user for confirmation first. Cost: one A… |
qase_environment_upsert | Create or update environment | none | Create or update an environment — a named target such as staging or production that runs are attributed to. With `id` it updates, without it creates. Existing environments come back from qase_project_context. Cost: one A… |
qase_external_issue_link | Link external issue | none | Link or unlink test cases and runs to issues in Jira Cloud or Jira Server — the only trackers supported. A case may link several issues; a run holds one, and a new link replaces it. Read links back with qase_get. Cost: o… |
qase_get | Get record | read-only | Fetch one known record by type and ID — case, suite, run, result, plan, defect, milestone, environment, shared_step, review, custom_field and more. Use it only when you already have the ID and want that one record; for s… |
qase_milestone_delete | Delete milestone | none | Delete a milestone by project code and ID. Runs and cases keep existing but lose the association, so release reporting built on it stops working; this cannot be undone. Asks the user for confirmation first. Cost: one API… |
qase_milestone_upsert | Create or update milestone | none | Create or update a milestone — a dated marker, typically a release, that runs and cases are grouped under. With `id` it updates, without it creates. Existing milestones come back from qase_project_context. Cost: one API … |
qase_plan_delete | Delete test plan | none | Delete a test plan by project code and ID. Only the plan goes — its cases and the runs made from it stay — but anything launching it by ID breaks; this cannot be undone. To change its cases use qase_plan_upsert instead. … |
qase_plan_upsert | Create or update test plan | none | Create or update a test plan — a named, reusable set of case IDs such as a smoke or regression pack. With `id` it updates, without it creates. qase_regression_run turns a plan into a run in one call. Cost: one API call, … |
qase_project_context | Project context | read-only | Seed everything about a project in one call: details, the full suite tree, milestones, environments, custom fields and users — make it first when starting on a project. Each collection returns its first 100; check `cover… |
qase_project_create | Create project | none | Create a project. The code must be unique in the workspace, and there is no update endpoint afterwards — title, code and access cannot be changed through the API, so choose them deliberately. Read an existing project wit… |
qase_project_delete | Delete project | none | Delete an entire project by code — every case, suite, run, result, defect and milestone in it, with no trash to recover from; this cannot be undone. The most destructive call in the API; confirm the code with qase_projec… |
qase_regression_run | Build regression run | none | Build and start a test run from a suite, a plan, or an explicit list of case IDs, in one step — it resolves the cases itself. It opens a run, it does not close one: for a finished pipeline use qase_ci_report; to assemble… |
qase_result_delete | Delete test result | none | Delete one result from a run, by run ID and result hash. The case and the rest of the run are untouched; pass rates shift and this cannot be undone. To discard a whole run use qase_run_delete. Asks the user for confirmat… |
qase_result_record | Record test results | none | Record up to 200 results into an existing run — status, duration, comment, stacktrace, attachments — in one call, not one per test. Status is a label only: passed, failed, blocked, skipped, invalid. If the run does not e… |
qase_review_bulk_create | Bulk create case reviews | none | Open several test case reviews in one request — the batch form of qase_review_create, for proposing more than one change. Same fields as qase_review_create; `case_id` for an edit review, omitted for a create review. The … |
qase_review_create | Create case review | none | Open a test case review — the pull-request flow for cases. Pass `case_id` to propose changes to an existing case (send only the fields that change), or omit it to propose a new one. Several at once? Use qase_review_bulk_… |
qase_review_delete | Delete case review | none | Delete a review by ID. This removes the proposal entirely — it does not decline it, and declining is UI-only — and merged reviews cannot be deleted; the referenced case is untouched. Cannot be undone; asks the user for c… |
qase_review_list | List case reviews | read-only | List a project's reviews with their current state — the only way to learn what happened to a review you opened, since the API has no endpoints for approving or merging — those are UI-only. Filter by status to see what is… |
qase_review_update | Update case review | none | Update an open review: the proposed case fields, the reviewers, or both, by review ID. IMPORTANT: changing the proposal RESETS every approval already given; updating only `reviewers` keeps them. The API has no endpoints … |
qase_run_complete | Complete test run | none | Mark a test run complete so it reports as finished. It is a reporting state, not a lock — results recorded afterwards still land and change its counts. If all results are in hand at once, qase_ci_report does this as its … |
qase_run_delete | Delete test run | none | Delete a test run by project code and ID, together with every result in it; this cannot be undone. Rarely what you want: to stop accepting results use qase_run_complete, to fix one result use qase_result_delete. Asks the… |
qase_run_upsert | Create or update test run | none | Create or update a test run — the container results are recorded into, so open it before qase_result_record. Scope it to a milestone, environment, plan or case list. To build one from a suite or plan use qase_regression_… |
qase_shared_step_delete | Delete shared step | none | Delete a shared step by project code and hash. Every case referencing it loses those steps, so the reach is far wider than one record; check references first. Cannot be undone; to change content use qase_shared_step_upse… |
qase_shared_step_upsert | Create or update shared step | none | Create or update a shared step — a block of steps written once and reused across cases. With `hash` it updates, without it creates; shared steps are identified by hash, which qase_case_upsert takes in a step's `shared` f… |
qase_suite_delete | Delete suite | none | Delete a test suite by project code and ID. WARNING: the cases inside, and any child suites, are deleted with it along with their history, and `delete_cases` currently has no effect. Read the tree from qase_project_conte… |
qase_suite_upsert | Create or update suite | none | Create or update a test suite — the folder cases live in. With `id` it updates, without it creates; nest with `parent_id`. The existing tree comes back from qase_project_context, so read it rather than guess parent IDs. … |
qase_tool_help | Tool documentation | read-only | Read the full documentation of one tool before calling it for the first time in a session. Every description in the tool list is deliberately short — what the tool is for and what it costs — and the details that prevent … |
qase_triage_defect | Triage failure into defect | none | Create a defect from a test failure with the context written into it; `title`, `actual_result` and `severity` are required. The API has no way to attach runs or results to a defect — reference them in actual_result. For … |
qql_help | QQL syntax help | read-only | Read the QQL reference before writing a query. Pass a `topic`: overview, syntax, entities, operators, functions, examples, aggregation or enumValues. Field names differ per entity and from the write tools, and a query na… |
qql_search | Search with QQL | read-only | Search any entity with Qase Query Language — filtering, cross-project, sorting, aggregation — and the right way to fetch many records at once instead of looping over qase_get. Call qql_help first for syntax, fields and e… |
Check your own setup
npx mcpvetter scan --liveBadge
Add this to a README:
[](https://mcpvetter.com/servers/qase-mcp-server)Publish this server?
Get the MCPVetter verified badge, a re-audit within 24 hours of every npm release, and an email whenever tools, findings, or Claude directory readiness change. $29 per server per month. You prove ownership first, free.