Atlas / MCP servers / kznr02 / OpenTester

OpenTesterCAUTION

Name: OpenTester
Author: kznr02

mcp/kznr02/opentester

MCP server by kznr02 · ai · claude · claude code · Audited 2026-10-09

⚑ Report / re-scan Source ↗

AI-Drived end-to-end test platform

Verdict

CAUTION

Grade

Trust score

87 /100

Exposed tools

23 11r · 9w · 3d

Transport

streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

MCP-First Testing Execution Infrastructure

[](https://badge.fury.io/py/opentester) [](https://opensource.org/licenses/MIT) [](https://glama.ai/mcp/servers/kznr02/open-tester)

OpenTester is a testing execution engine designed for AI coding tools (Claude Code, Cursor, OpenCode, etc.). It provides a unified DSL format and MCP interface, enabling Agents to generate, execute, and manage test cases, achieving an automated "code-test-fix" workflow.

[](https://glama.ai/mcp/servers/kznr02/open-tester)

Core Positioning

┌─────────────────────────────────────────┐
│  AI Agent (Claude Code / Cursor / ...)  │
│  ├─ Generate DSL test cases             │
│  ├─ Decide testing strategies           │
│  └─ Analyze failure reasons             │
├─────────────────────────────────────────┤
│  OpenTester (MCP Server)                │
│  ├─ Validate DSL syntax                 │
│  ├─ Execute tests (CLI/Web)             │
│  ├─ Store cases/projects                │
│  └─ Return structured results           │
├─────────────────────────────────────────┤
│  Web UI (Auxiliary Observation Panel)   │
│  ├─ View execution progress             │
│  ├─ Debug cases (create/edit)           │
│  └─ View history reports                │
└─────────────────────────────────────────┘

Design Principles:

Agent Intelligence: Test generation and failure analysis are handled by the Agent
OpenTester Execution: Focuses on DSL validation and test execution
MCP-First: All core features exposed through MCP
Web UI Auxiliary: Visual monitoring and debugging, not required

Installation

Option 1: Install from PyPI (Recommended)

pip

Read from source at commit 8907fd58d6a1OBSERVED · 2026-10-09

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code

claude mcp add opentester-frontend -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "opentester-frontend": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}

Exposed tools (23)

11 read · 9 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`create_project`	write	Create a new test project.
`create_template`	write	Create a new reusable DSL template.
`create_template_from_case`	write	Create a template from an existing test case.
`delete_case`	destructive	Delete a test case.
`delete_project`	destructive	Delete a project.
`delete_template`	destructive	Delete a template.
`get_execution_diagnostics`	read	Get execution diagnostics as structured machine-usable payload.
`get_execution_log`	read	Get detailed execution log via FastAPI.
`get_execution_status`	read	Get execution status and results via FastAPI.
`get_project`	read	Get project details including all test cases.
`get_template`	read	Get template details including variables and DSL content.
`instantiate_template`	read	Instantiate a template into a test case.
`list_paused_executions`	read	List all executions waiting for AI DOM analysis.
`list_projects`	read	List all test projects with basic info.
`list_templates`	read	List all available templates with optional filtering.
`request_dom_analysis`	read	Request DOM analysis for an execution waiting for AI assistance.
`run_case`	write	Execute a single test case via FastAPI to ensure execution is tracked.
`run_project`	write	Execute all test cases in a project via FastAPI to ensure executions are tracked.
`save_case`	write	Save a test case.
`stop_execution`	write	Stop a running execution via FastAPI.
`submit_ai_selector`	write	Submit AI-generated selector to resume execution.
`update_template`	write	Update an existing template.
`validate_dsl`	read	Validate DSL YAML syntax and schema.

Trust audit

CAUTIONgrade B · trust 87/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (6 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (10)

MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319

backend/opentester/mcp/server.py:36

API_BASE_URL = os.environ.get("OPENTESTER_API_URL", "http://127.0.0.1:8000")

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

delete_case, delete_project, delete_template

Why it matters. 3 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862

streamable-http

Why it matters. a network transport with no auth environment variable found

Fix. require a token

LOWInventory / provenance · inv.hidden_file · CWE-1104

.gitmodules

.gitmodules

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose