Atlas / MCP servers / denys-ispaniuk / mcp-testrail

mcp-testrailSAFE

Name: mcp-testrail
Author: denys-ispaniuk

mcp/denys-ispaniuk/testrail-mcp

MCP server by denys-ispaniuk · Audited 2026-10-12

⚑ Report / re-scan Source ↗

TestRail MCP Server for team integration with Cursor

Verdict

SAFE

Grade

Trust score

89 /100

Exposed tools

35 17r · 16w · 2d

Transport

stdio

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

A complete Model Context Protocol (MCP) server for TestRail integration with full API support. Allows AI assistants like Cursor to interact with TestRail test management system.

✨ Features

📁 Projects

Get all projects or specific project details

📦 Test Suites

Get, create, and update test suites

📂 Sections

Get, create, update, and delete sections

📝 Test Cases

Full CRUD operations (Create, Read, Update, Delete)
Get case types and custom fields
Support for all custom fields and templates

🏃 Test Runs

Create, update, and close test runs
Get run details and lists

🧪 Tests

Get tests from runs
Detailed test information

✅ Results

Add single or bulk test results
Get results for tests, cases, and runs
Track test execution history

📋 Test Plans

Get test plans and plan details

🎯 Milestones

Get milestones for projects

Installation

npm install -g mcp-testrail

Or use directly with npx (no installation needed):

npx -y mcp-testrail

Quick Setup with Cursor

Step 1: Get Your TestRail API Key

Log in to your TestRail instance
Click on your profile (top right)
Go to Settings → API Keys
Click Add Key and give it a name
Copy the generated API key

Step 2: Configure Cursor

Open Cursor Settings (Ctrl/Cmd + ,)
Search for "MCP" or go to Features → Model Context Protocol
Click Edit Config or open the config file
Add the following configuration (also available in cursor-config.example.json):

{
"mcpServers": {
"testrail": {
"command": "npx",
"args": ["-y", "mcp-testrail"],
"env": {
"TESTRAIL_URL": "https://your-company.testrail.io",
"TESTRAIL_USERNAME": "[email protected]",
"TESTRAIL_API_KEY": "your-api-key-here"
}
}
}
}

Replace the following values:
https://your-company.testrail.io - with your TestRail URL

Read from source at commit 6e682c64288dOBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-testrail --env TESTRAIL_API_KEY=${TESTRAIL_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "mcp-testrail": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "TESTRAIL_API_KEY": "${TESTRAIL_API_KEY}"
      }
    }
  }
}

Exposed tools (35)

17 read · 16 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add_case`	write	Create a new test case
`add_result`	write	Add a test result
`add_result_for_case`	write	Add a test result for a specific case in a run
`add_results_for_cases`	write	Add multiple test results for cases in a run
`add_run`	write	Create a new test run
`add_section`	write	Create a new section
`add_suite`	write	Create a new test suite
`close_run`	write	Close a test run
`delete_case`	destructive	Delete a test case
`delete_section`	destructive	Delete a section
`get_case`	read	Get a specific test case by ID
`get_case_fields`	read	Get all available test case fields
`get_case_types`	read	Get all available test case types
`get_cases`	read	Get test cases for a project/suite
`get_milestone`	read	Get a specific milestone by ID
`get_milestones`	read	Get milestones for a project
`get_plan`	read	Get a specific test plan by ID
`get_plans`	read	Get test plans for a project
`get_project`	read	Get a specific project by ID
`get_projects`	read	Get all TestRail projects
`get_results`	read	Get results for a test
`get_results_for_case`	write	Get results for a test case in a run
`get_results_for_run`	write	Get results for a test run
`get_run`	write	Get a specific test run by ID
`get_runs`	read	Get test runs for a project
`get_section`	read	Get a specific section by ID
`get_sections`	read	Get all sections for a project/suite
`get_suite`	read	Get a specific test suite by ID
`get_suites`	read	Get all test suites for a project
`get_test`	read	Get a specific test by ID
`get_tests`	write	Get tests for a test run
`update_case`	write	Update an existing test case
`update_run`	write	Update an existing test run
`update_section`	write	Update an existing section
`update_suite`	write	Update an existing test suite

Trust audit

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	PASS
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (1 observation(s))
Network: none-observed
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (2)

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_case, delete_section

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWSupply chain · supply.unpinned · CWE-829, CWE-1357

package.json

@modelcontextprotocol/sdk, axios, dotenv, @types/node, tsx, typescript

Why it matters. 6 dependency range(s) float

Fix. pin exact versions or ship a lockfile

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 6e682c64288dfull audit observations/trust-audit/mcp-server/denys-ispaniuk__testrail-mcp.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-10-12	`6e682c64288d`	SAFE	B	89	first audit

Questions

What is the mcp-testrail MCP server?

TestRail MCP Server for team integration with Cursor

What tools does mcp-testrail expose?

35 in total: 17 read-only, 16 that write, and 2 that can delete or overwrite (delete_case, delete_section). Every one is listed on this page with its risk.

Is mcp-testrail safe to connect to an agent?

The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does mcp-testrail need?

It reads TESTRAIL_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does mcp-testrail run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as mcp-testrail at 2.0.2.

How current is this page?

The grade is for one exact copy of the source (6e682c64288d), read on 2026-10-12. The repository is watched and re-audited when it changes.

Source	denys-ispaniuk/testrail-mcp
npm	`mcp-testrail@2.0.2`
Transports	stdio
Credentials it reads	`TESTRAIL_API_KEY`
License	MIT
Activity	pushed 359d ago