mockloop-mcpBLOCK
Intelligent Model Context Protocol (MCP) server for AI-assisted API development. Generate mock servers from OpenAPI specs with advanced logging, performance analytics, and server discovery. Optimized for AI development workflows with comprehensive testing insights and automated analysis.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
NOTE: We have [fully](https://github.com/MockLoop/mockloop-mcp/commit/2fe4f485b5a13346393a6d5ed0f8b3a4dded7bbb) implemented [SchemaPin](https://schemapin.org) to help combat questionable copies of this project on Github and elsewhere. Be sure validate you are using releases from this repo and can use SchemaPin to validate our tool schemas: https://mockloop.com/.well-known/schemapin.json
[](https://pypi.org/project/mockloop-mcp/) [](https://pypi.org/project/mockloop-mcp/) [](https://pypi.org/project/mockloop-mcp/) [](https://github.com/mockloop/mockloop-mcp/blob/main/LICENSE) [](https://github.com/mockloop/mockloop-mcp/actions) [](https://docs.mockloop.com) [](https://docs.mockloop.com/ai-integration/overview/) [](https://modelcontextprotocol.io/)
The world's first AI-native API testing platform powered by the Model Context Protocol (MCP). MockLoop MCP revolutionizes API testing with comprehensive AI-driven scenario generation, automated test execution, and intelligent analysis capabilities.
🚀 Revolutionary Capabilities: 5 AI Prompts • 15 Scenario Resources • 16 Testing Tools • 10 Context Tools • 4 Core Tools • Complete MCP Integration
📚 Documentation: https://docs.mockloop.com 📦 PyPI Package: https://pypi.org/project/mockloop-mcp/ 🐙 GitHub Repository: https://github.com/mockloop/mockloop-mcp
🌟 What Makes Mock
56ad52e01f96OBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mockloop-mcp --env API_KEY=${API_KEY} --env API_KEY_HEADER=${API_KEY_HEADER} --env API_TOKEN=${API_TOKEN} --env MOCKLOOP_PRIVATE_KEY_CONTENT=${MOCKLOOP_PRIVATE_KEY_CONTENT} -- uvx mockloop-mcp{
"mcpServers": {
"mockloop-mcp": {
"command": "uvx",
"args": [
"mockloop-mcp"
],
"env": {
"API_KEY": "${API_KEY}",
"API_KEY_HEADER": "${API_KEY_HEADER}",
"API_TOKEN": "${API_TOKEN}",
"MOCKLOOP_PRIVATE_KEY_CONTENT": "${MOCKLOOP_PRIVATE_KEY_CONTENT}"
}
}
}
}Exposed tools (30)
17 read · 13 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
analyze_test_results | read | Analyzes test results and provides comprehensive insights. |
compare_test_runs | read | Compares multiple test runs to identify performance changes. |
create_agent_context | write | Creates an agent context for AI agent integration. |
create_context_snapshot | write | Creates a snapshot of a context for rollback capabilities. |
create_test_session | write | Creates a new test session for workflow management. |
create_test_session_context | write | Creates a new test session context for stateful testing workflows. |
create_workflow_context | write | Creates a workflow context for managing complex testing workflows. |
deploy_scenario | write | Deploys scenario to MockLoop server. |
discover_mock_servers | read | Discover running MockLoop servers and generated mock configurations. |
end_test_session | read | Ends a test session and generates final reports. |
execute_test_plan | write | Combines scenario generation and deployment in one operation. |
generate_mock_api | read | Generates a FastAPI mock server from an API specification (e.g., OpenAPI). |
generate_test_report | read | Generates formatted test reports in various formats. |
get_context_data | read | Retrieves data from a specific context. |
get_global_context_data | read | Retrieves data from the global context. |
get_performance_metrics | read | Retrieves and analyzes performance metrics from test results. |
list_active_scenarios | read | Lists all active scenarios across servers. |
list_contexts_by_type | read | Lists all contexts of a specific type. |
manage_mock_data | read | Manage dynamic response data and scenarios for MockLoop servers. |
monitor_test_progress | read | Monitors ongoing test execution and provides real-time updates. |
query_mock_logs | read | Query and analyze request logs from a running MockLoop server. |
restore_context_snapshot | read | Restores a context from a previously created snapshot. |
run_load_test | write | Executes load testing with configurable parameters. |
run_security_test | write | Executes security testing scenarios for vulnerability assessment. |
run_test_iteration | write | Executes a single test iteration with monitoring. |
schedule_test_suite | write | Schedules automated test suite execution. |
switch_scenario | read | Switches active scenario on a server. |
update_context_data | write | Updates data in a specific context. |
update_global_context_data | write | Updates data in the global context. |
validate_scenario_config | read | Validates scenario configuration before deployment. |
Trust audit
BLOCKgrade D · trust 63/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (21)
- MOCKLOOP_PRIVATE_KEY_CONTENT="-----BEGIN PRIVATE KEY-----..."
__import__(package)
- DATABASE_URL=postgresql://postgres:password@postgres:5432/mockloop
- DATABASE_URL=postgresql://postgres:password@postgres:5432/mockloop
.coveragerc
.pre-commit-config.yaml
.secrets.baseline
.nojekyll
INFO: Uvicorn running on http://0.0.0.0:8000 (Press CTRL+C to quit)
server_url="http://192.0.2.1:9999", # RFC 5737 test address
decoded = base64.b64decode(signature)
signature_bytes = base64.b64decode(signature)
signature_bytes = base64.b64decode(signature_b64)
signature_bytes = base64.b64decode(signature_b64)
fastapi, uvicorn, Jinja2, PyYAML, requests, aiohttp, mcp, schemapin
Be sure validate you are using releases from this repo and can use SchemaPin to validate our tool schemas
backstory="""You are a senior research analyst with expertise in
cat > .env << EOF
1. Open System Properties → Advanced → Environment Variables
Add to your shell profile (`~/.bashrc`, `~/.zshrc`, etc.):
curl -LsSf https://astral.sh/uv/install.sh | sh
Gates applied: critical_finding, no_behavioural_pass.
56ad52e01f96full audit observations/trust-audit/mcp-server/mockloop__mockloop-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 56ad52e01f96 | BLOCK | D | 63 | first audit |
Questions
What is the mockloop-mcp MCP server?
Intelligent Model Context Protocol (MCP) server for AI-assisted API development. Generate mock servers from OpenAPI specs with advanced logging, performance analytics, and server discovery. Optimized for AI development workflows with comprehensive testing insights and automated analysis.
What tools does mockloop-mcp expose?
30 in total: 17 read-only, 13 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is mockloop-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (63/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does mockloop-mcp need?
It reads API_KEY, API_KEY_HEADER, API_TOKEN, MOCKLOOP_PRIVATE_KEY_CONTENT and MOCKLOOP_PRIVATE_KEY_PATH from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does mockloop-mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as mockloop-mcp.
How current is this page?
The grade is for one exact copy of the source (56ad52e01f96), read on 2026-10-10. The repository is watched and re-audited when it changes.