Bugbrain MCP server

Read from the package source without running it. The installed server may list more.

• bugbrain_connect

  Validate the API key and return the active organization, plan, usage/quota, and the scopes this key holds. Call this first to confirm the connection.

• cancel_runwrite action

  Request cancellation of an in-flight run.

• ci_gate

  One-call CI gate: start a run (exploratory / accessibility / compliance), wait for it to finish, then PASS/FAIL it against thresholds \u2014 severity, max new issues vs the previous run, and a minimum trust score. Returns a clear verdict + reasons for your pipeline. Blocks until the run completes or times out.

• create_test_casewrite action

  Create a curated test case from a plain-English description (e.g. "verify a user can reset their password"). The AI turns it into structured steps.

• create_tunnelwrite action

  Expose a local dev server (http://localhost:PORT) via a secure public tunnel so BugBrain can test it before you deploy. Returns a public URL to pass as targetUrl when starting a run. Requires the local stdio bridge and a tunnel binary (cloudflared by default).

• delete_webhookwrite action

  Remove an outbound webhook subscription by id.

• execute_test_casewrite action

  Run a single curated test case. Returns immediately with an execution id \u2014 poll get_execution_result for the PASS / FAIL / INCONCLUSIVE verdict and confidence.

• execute_test_planwrite action

  Run an entire test plan (its cases, in parallel). Returns immediately with a test-plan-run id \u2014 poll get_test_plan_run for the pass/fail rollup.

• generate_test_caseswrite action

  Run the Synthesizer agent to generate curated test cases from the project\u2019s learned knowledge + recent runs. Returns a job id immediately; poll list_test_cases to see new cases appear.

• get_accessibility_report

  Fetch the aggregated accessibility report: WCAG score, failing rules (with criteria/level), per-page breakdown, and coverage.

• get_ai_quality_summary

  Get aggregated AI quality metrics for a project: average consistency score, hallucination risk trend, top issues by category, and recent run health. Useful for CI dashboards and PR quality gates.

• get_ai_test_results

  Fetch the full results of an AI test run: status, quality metrics (consistency, hallucination risk, toxicity, injection vulnerability), and the per-turn conversation trace.

• get_compliance_report

  Fetch the aggregated compliance report: per-framework score, control-by-control status + evidence counts, manual-only controls, and overall risk level.

• get_execution_failure

  For a FAILED execution: the failing step + reasoning, plus a local Playwright reproduce command and trace/HAR/storage-state URLs so you can reproduce it on your machine.

• get_execution_result

  Fetch a test-case execution: status, verdict (PASS/FAIL/INCONCLUSIVE), confidence, and evidence.

• get_project

  Fetch a single project by id (name, websiteUrl, environment, whether credentials are configured).

• get_run_comparisonwrite action

  Diff a run\u2019s issues against the previous run for the project: new / resolved / still-present.

• get_run_observationwrite action

  Fetch the LLM-as-judge trust report for a run: per-issue validity (real / false-positive / insufficient-evidence), failure root-cause, and an overall run-quality score (1\u20135). Set generate=true to (re)generate it (spends LLM budget). The honest answer to "can I trust this run?".

• get_run_statuswrite action

  Fetch a run\u2019s status, counters, business context, and discovered test plan.

• get_run_tracewrite action

  Fetch the step-by-step agent trajectory (thought / action / observation) for a run.

• get_test_plan_runwrite action

  Fetch a test-plan run rollup: items total/passed/failed/skipped, status, duration.

• get_web_qa_report

  Fetch the consolidated, severity-categorized report for a Web-Test run: status, the swarm config (breadth / agent count), the merged bug report, and the issue count. Poll until status is COMPLETED.

• list_ai_test_cases

  List AI test cases for a project. Optionally filter by kind (e.g. PROMPT_CONSISTENCY, INJECTION_PROBE, HALLUCINATION_SCAN) or status.

• list_ai_test_runs

  List recent AI test runs for a project, optionally filtered by test case. Returns status, key metrics (consistency score, hallucination risk), and timestamps.

• list_api_keys

  List the organization\u2019s API keys (id, name, scopes, created/last-used). Never returns the secret.

• list_environments

  List the environments available for a project and which one it currently targets (production / staging / development).

• list_llm_targets

  List all LLM/AI test targets configured for a project. Each target represents an AI system under test \u2014 a chatbot, voice agent, or LLM endpoint.

• list_project_issues

  List issues for a project, with severity, category, status, page URL, and AI confidence.

• list_projects

  List the projects (web apps under test) in the connected organization.

• list_run_issueswrite action

  List the issues a run found, with severity, category, page URL, AI confidence, and screenshot links.

• list_runs

  List recent runs for a project (or across the org when projectId is omitted).

• list_test_cases

  List curated test cases for a project (or across the org when projectId is omitted).

• list_test_plans

  List test plans (collections of test cases) for a project, or across the org.

• list_webhooks

  List the organization\u2019s outbound webhook subscriptions (url, events, enabled).

• mint_api_keywrite action

  Create a new least-privilege API key. Pass `scopes` to restrict it (empty = full access). The secret is returned ONCE \u2014 store it immediately.

• push_finding_to_tracker

  File a compliance finding (by its signature) into the org\u2019s connected issue tracker (Jira or Linear). Returns the created issue key + URL.

• register_webhook

  Subscribe a public https URL to run events (run.completed / run.failed) for push-driven CI. Returns the signing secret ONCE \u2014 store it to verify the HMAC signature on delivery.

• revoke_api_key

  Permanently revoke an API key by id.

• run_accessibility_auditwrite action

  Run a dedicated WCAG 2.1/2.2-AA accessibility audit (axe-core + agent verification). Returns immediately with a run id \u2014 poll get_run_status, then get_accessibility_report for the score.

• run_ai_testwrite action

  Trigger execution of an AI test case. Returns immediately with a run id \u2014 poll get_ai_test_results for the outcome. Requires the org to have an available AI test quota.

• run_compliance_scanwrite action

  Run a compliance scan (SOC2 / GDPR / ADA / WCAG 2.2 AA / ISO 27001 / EU AI Act) that maps findings to framework controls with evidence. Returns a run id immediately \u2014 poll get_run_status, then get_compliance_report.

• run_duo_testwrite action

  Run a TWO-USER test: two agents drive the app at the same time as different users to surface permission leaks (one user seeing another's data), broken collaboration, and state races. actorA logs in with the project's configured credential; provide actorB's login inline (encrypted at rest). Describe the collaboration scenario to exercise. Returns a runId; poll get_web_qa_report. Metered as one Web-

• run_web_qawrite action

  Point Web-Test at a URL or an existing project and a swarm of QA agents explores and bug-tests the site \u2014 clicking flows, filling forms, probing edge cases \u2014 and files what it finds as issues. Returns a runId immediately; poll get_web_qa_report for the consolidated, severity-categorized bug report. For live progress use get_run_status / list_run_issues / watch_run (a Web-Test run is a no

• set_environment

  Switch the environment a project targets (production / staging / development).

• start_exploratory_runwrite action

  Kick off an AUTONOMOUS exploratory test run: the AI agent explores the site, discovers flows, and finds bugs/accessibility issues nobody scripted. Returns immediately with a run id \u2014 poll get_run_status (or use watch_run) for progress.

• start_regression_runwrite action

  Start a run intended for regression: explores like an exploratory run, then use get_run_comparison to diff issues against the previous run (new / resolved / still-present).

• test_changed_files

  Given the files changed in your diff, pick the most relevant APPROVED test cases (by token overlap vs title/module/tags) and run them. Returns the selection + the queued executions. Set dryRun=true to only see the selection. Poll get_execution_result for each verdict.

• triage_issue

  Fetch one issue\u2019s full detail incl. the AI triage: root-cause hypothesis, impact area, reproduction confidence, an engineering summary, and a suggested fix.

• watch_runwrite action

  Stream a run\u2019s live progress as MCP progress notifications until it finishes, then return the final run state. Use for interactive sessions; prefer start + get_run_status polling for fire-and-forget automation.

• Code scan6 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenanceno repository listed3/15
• Maintainer identityverified namespace with website, no repo4/10

Safety score

58/100

higher than 13% of 48,255 servers

Tools

49

the typical server has 7

Tools that change things

45%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

21

more than 8% of 12,191 servers with a package

Bugbrain: common questions

Is Bugbrain MCP server safe?

With care: it is graded C, so read the findings first (58/100). Read the Bugbrain safety report

How do I install Bugbrain?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Bugbrain need an API key?

Yes. The registry entry asks for BUGBRAIN_API_KEY.

Is Bugbrain maintained?

The latest release is v0.2.0.

What can I use instead of Bugbrain?

Servers from other publishers that do the same job: Keploy MCP server.

How does Bugbrain compare with other MCP servers?

safety score 58/100 (higher than 13% of 48,255 servers); tools 49 (the typical server has 7); tools that change things 45% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.