Atlas / MCP servers / galaxyxieyu / API Auto Test Framework

API Auto Test FrameworkBLOCK

Name: API Auto Test Framework
Author: galaxyxieyu

mcp/galaxyxieyu/api-auto-test-framework

MCP server by galaxyxieyu · ai coding · api testing · automation · Audited 2026-10-09

⚑ Report / re-scan Source ↗

A YAML-first API testing framework built for AI-assisted API workflows.

Verdict

BLOCK

Grade

Trust score

69 /100

Exposed tools

6 3r · 2w · 1d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

YAML Declarative API Testing Framework, Optimized for AI Coding Assistants

Case study | AgentsGalaxy | GitHub

Quick Start | MCP Integration | YAML Spec | Unit Testing

Why This Framework?

When asking AI to write API tests, you might encounter these issues:

Scenario 1: Repetitive Work

Every time you ask AI to generate tests, you need to re-describe the project structure, authentication method, and assertion style. For 10 API tests, the same fixture and setup code gets generated 10 times.

Scenario 2: Token Black Hole

A simple login API test generates 200 lines of code. You find an assertion is wrong, ask AI to fix it, and it generates another 200 lines. After 3 revisions, you've consumed 2000+ Tokens, and you still end up fixing it manually.

Scenario 3: Debugging Dead Loop

AI-generated tests fail to run. You paste the error message, AI fixes it but still wrong. After 5 rounds of conversation, the problem persists, and you've burned 5000+ Tokens.

This Framework's Solution:

Traditional: Natural Language -> AI Generates Full Code -> Run Error -> Paste Error -> AI Regenerates -> Loop...
This Framework: Natural Language -> AI Generates YAML -> Framework Executes -> Locate Issue -> Fix 1 Line YAML

Read from source at commit c8edc38c8727OBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add api-auto-test --env MCP_AUTH_TOKEN=${MCP_AUTH_TOKEN} -- uvx api-auto-test

claude-desktop

{
  "mcpServers": {
    "api-auto-test": {
      "command": "uvx",
      "args": [
        "api-auto-test"
      ],
      "env": {
        "MCP_AUTH_TOKEN": "${MCP_AUTH_TOKEN}"
      }
    }
  }
}

Exposed tools (6)

3 read · 2 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`delete_testcase`	destructive	deleted_files: list[str] = []
`get_mcp_metrics`	read	request_id = new_request_id()
`get_test_results`	read	获取测试执行历史
`health_check`	read	request_id = new_request_id()
`write_testcase`	write	request_id = new_request_id()
`write_unittest`	write	request_id = new_request_id()

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (4 observation(s))
Network: declared (5 observation(s))
Shell: declared (2 observation(s))
Dependencies: pinned
Secrets in source: none-found

Findings (12)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

atf/core/variable_resolver.py:60

return eval(f"dict({args_str})")

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

atf/core/variable_resolver.py:54

return importlib.import_module(f'atf.utils.{module_name}')

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_testcase

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

atf/core/config_manager.py:22

config_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "../../config.yaml")