Back to MCP Trust Indexm8ven
54
/ 100
1 month ago
glama

qa-ai-mcp-server-gits

MCP server for end-to-end QA automation: generates test scenarios, discovers Playwright locators, creates TypeScript test code, executes tests, and creates GitHub issues for failures.

→ gits5213/qa-ai-mcp-server-gits· listed on glama
Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
⚠️
Known vulnerabilities in dependencies: 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
✅
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
✅
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
🔐
You'll be asked for 3 credentials: GITHUB_TOKEN, JIRA_API_TOKEN, JIRA_PROJECT_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies4 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.12.1GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.12.1GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.12.1GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highplaywright@1.51.1GHSA-7mvr-c777-76hp

Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
configALLOW_PRODUCTION_URLS— No true to allow production-like URLs
configAZURE_DEVOPS_AREA_PATH— No Optional area path
configAZURE_DEVOPS_DEFAULT_TAGS— automated-test;qa
configAZURE_DEVOPS_ITERATION_PATH— No Optional iteration path
configAZURE_DEVOPS_ORG— ADO bugs Organization name
configAZURE_DEVOPS_PAT— ADO bugs Personal access token (Work Items write)
configAZURE_DEVOPS_PROJECT— ADO bugs Project name
configBUG_PROVIDER— "": "github",
configGITHUB_DEFAULT_LABELS— No Comma-separated labels (default: bug,automated-test,qa)
configGITHUB_OWNER— "": "your-org",
configGITHUB_REPO— "": "your-automation-repo",
🔐 secretGITHUB_TOKEN— "": "ghp_your_token"
🔐 secretJIRA_API_TOKEN— Jira bugs Jira API token
configJIRA_BASE_URL— Jira bugs e.g. https://your-domain.atlassian.net
configJIRA_DEFAULT_LABELS— automated-test,qa
configJIRA_EMAIL— Jira bugs Atlassian account email
configJIRA_ISSUE_TYPE— No Default: Bug
🔐 secretJIRA_PROJECT_KEY— Jira bugs e.g. QA
configLOG_LEVEL— "": "info",
configPLAYWRIGHT_HEADLESS
configPLAYWRIGHT_JSON_OUTPUT_NAME
configPLAYWRIGHT_SKIP_BROWSER_DOWNLOAD— No 1 to skip Chromium install on npm install
configPLAYWRIGHT_TIMEOUT_MS
configPROJECT_ROOT
configQA_MCP_PROJECT_ROOT— "": "${workspaceFolder}",
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/gits5213-qa-ai-mcp-server-gits-uqjwqa)](https://m8ven.ai/mcp/gits5213-qa-ai-mcp-server-gits-uqjwqa)
commit: 893ecb5ec43acd069aba7828fb78b5438cb9ed81
code hash: f7c3330781fe2d5844d16a645c896019291365a216d3ec28c7bc71ca5f2caf8f
verified: 6/13/2026, 9:33:44 AM
view raw JSON →