testlink-mcp

An AI-friendly, safety-first Model Context Protocol server for TestLink 1.9.20. It exposes normalized discovery and analysis tools, bounded cursor pagination, structured output, and preview-before-apply writes over stdio.

This repository is a clean implementation based on TestLink's public XML-RPC interface and the public MCP SDK. It has no dependency on a private TestLink package or private source tree.

Highlights

• Starts without credentials so MCP clients can discover all tools, resources, and prompts.
• Explicit deterministic demo mode for evaluation and onboarding.
• structuredContent, outputSchema, tool annotations, cursor pagination, and stable error codes.
• Attachment metadata only; attachment content and base64 payloads are removed.
• Writes disabled by default. There is no delete tool.
• Every apply requires confirm: true, an unexpired single-use 10-minute preview, and an unchanged server snapshot.
• Side-effect calls are never automatically retried; apply attempts are written to a redacted operation ledger.
• Runtime guard blocks unsupported/EOL odd Node releases and security patch levels below the declared floor.

Safe write demo

The demo uses synthetic data only. It shows the required safety boundary: Preview a proposed change, inspect the bounded diff, then call apply with the exact preview ID and confirm: true. No write happens during preview. The editable source frames are in docs/assets/testlink-safety.

Requirements

• Node.js ^22.23.2 || ^24.18.1 || ^26.5.1
• TestLink 1.9.20 with its XML-RPC API enabled

The development and container baseline is Node 24.19.0 LTS. CI also runs Node 22.23.2 and 26.7.0.

Quick start

nvm use
npm ci
npm run build
TESTLINK_DEMO_MODE=true node dist/cli.js

Future npm invocation after publication:

npx -y testlink-mcp@1.0.8

MCP client configuration:

{
  "mcpServers": {
    "testlink": {
      "command": "npx",
      "args": ["-y", "testlink-mcp@1.0.8"],
      "env": {
        "TESTLINK_URL": "https://testlink.example.com/testlink",
        "TESTLINK_DEV_KEY": "your-testlink-dev-key"
      }
    }
  }
}

Do not put real credentials in tracked files. Copy .env.example to an ignored .env, or inject environment variables from your MCP client/secret manager.

Tools

... View full README on GitHub