MCP.Market

QualityMax QA MCP server

by Quality-Max·io.github.Quality-Max/qmax-mcp·v0.9.2·4 stars
No reviews yet

Final release; the checks moved to 9lives (9l mcp). Local QA MCP: scan, inspect, repro, run tests.

A94/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A94/100

full report

Adoption
Growing

4 stars106 downloads/wk

Reviews

Write one

Nobody has reviewed QualityMax QA MCP yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

QualityMax QA MCP tools (4, 1 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • generate_playwright_repro

    Generate a minimal Playwright test from a scan finding, URL, or plain-English goal and write it below the approved workspace directory .qmax-mcp/repros. outputPath must be relative; existing files require overwrite:true after review. No outbound network request is made by generation.

  • inspect_page

    Read page structure through outbound browser network requests and return headings, forms, buttons, links, inputs, role/name selectors, and data-testid candidates. storageStatePath may name a workspace-relative Playwright storage-state file for authenticated pages; its credentials are loaded into the throwaway browser context and never returned. Because returned page content may be private, authent

  • run_playwright_testwrite action
  • scan_url

Public scan report

scanner v0.1.10 · 2026-10-30 · same rubric, same numbers if you re-run it

no findings
  • Code scan45 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 4 days ago15/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10
Overall 94/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How QualityMax QA MCP compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
94/100
higher than 97% of 915 Security servers
Tools
4
the typical Security server has 6
Tools that change things
25%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
4
more than 85% of 587 Security servers
Downloads a week
106
more than 62% of 249 Security servers with a package

What its tools let an agent do: 2 read · 1 create · 1 run or deploy

Release history: 3 versions in the registry since 2026-08-28, latest 2026-10-13, typically one every 45 days.

Install QualityMax QA MCP in Claude Code, Cursor or VS Code

Runs npx -y @qualitymax/qmax-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add qmax-mcp -- npx -y @qualitymax/qmax-mcp
Add to Cursor

What the publisher says

From the QualityMax QA MCP repository's README, as published. We do not edit it. Read it on GitHub

QualityMax QA MCP

Give a coding agent independent QA evidence before it declares a web change done: scan the page, inspect the UI, generate a focused Playwright repro, then review the execution result.

npx -y @qualitymax/qmax-mcp

The four local tools require no QualityMax account, API key, or hosted service.

Documentation · Hosted MCP setup · Local demo

This package provides four standalone local tools. Hosted workspace access is a separate authenticated connection; use the hosted MCP setup when you need platform projects and workflows.

Start with a useful result

Ask an MCP-enabled agent to scan the URL it changed, or run the local CLI:

npx -y @qualitymax/qmax-mcp scan https://example.com --format markdown

The report includes a graded summary, findings, concrete reproduction steps, and suggested fixes. One command exercises all four tools against a checked-in, dependency-free fixture — see the reproducible demo.

What one scan measures

All nine checks run off a single page load. Pass checks to run a subset.

Names must match exactly. An unrecognised name is rejected with the supported list rather than skipped, so a typo cannot quietly turn a check off and still return a score.

scanurl also returns a metrics block with the measured vitals and the page-weight breakdown, including the slowest requests. Two limits are stated in that block rather than hidden: INP is not measured**, because it needs real user interaction, and vitals come from one cold load on the scanning machine, not from field data. Set weightBudget to scan against your own performance budget.

What the report looks like

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

QualityMax QA MCP: common questions

Is QualityMax QA MCP server safe?
Yes, by our scan: it is graded A (94/100). Read the QualityMax QA MCP safety report
How do I install QualityMax QA MCP?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does QualityMax QA MCP need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is QualityMax QA MCP maintained?
The last commit was 10 days ago (2026-10-26). The latest release is v0.9.2.
What can I use instead of QualityMax QA MCP?
Servers from other publishers that do the same job: Canary MCP server, crosscheck MCP server and Safeinstall MCP server. Compare all QualityMax QA MCP alternatives.
How does QualityMax QA MCP compare with other Security MCP servers?
safety score 94/100 (higher than 97% of 915 Security servers); tools 4 (the typical Security server has 6); tools that change things 25% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to QualityMax QA MCP

Same job from other publishers: the closest match first, then the best rated.

All QualityMax QA MCP alternatives →
  • Canary
    Mindstone-internal release-pipeline test connector; not for use. Single ping tool; no auth.
    A
  • crosscheck
    Checks for AI agents over x402: review drafts, accept-check handoffs, scan skills before install.
    A
  • Safeinstall
    Local-first supply-chain security gate for npm/pnpm/bun: typosquat, release age, provenance checks
    A
  • Jikida
    Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
    A
  • PyMemoryEditor
    Read, write and scan process memory, Cheat Engine style, on Windows, Linux and macOS.
    A