/ 100

15 days ago

glama

Healix

End-to-end AI test generation and QA automation server that orchestrates auto-detection, browser exploration, test generation, execution, and dashboard analysis directly from your IDE.

→ krishsharma1008/TestBot_MCP · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

2 flows detected: HEALIX_API_KEY, OPENAI_API_KEY. We can’t prove the destination matches the brand the credential belongs to.

🔐

You'll be asked for 12 credentials: BROWSER_USE_API_KEY, EXPO_SKIP_MANIFEST_VALIDATION_TOKEN, HEALIX_API_KEY, HEALIX_BROWSER_USE_API_KEY, HEALIX_PROJECT_KEY, JIRA_API_TOKEN, JIRA_PROJECT_KEY, OPENAI_API_KEY, STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, SUPABASE_SERVICE_ROLE_KEY, HEALIX_LOGIN_PASSWORD

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configBROWSER

🔐 secretBROWSER_USE_API_KEY

configBROWSER_USE_PYTHON

configDATABASE_URL— PostgreSQL connection string (Supabase pooler URI for production).

configEXPO_NO_BROWSER

configEXPO_NO_DEPENDENCY_VALIDATION

configEXPO_NO_INTERACTIVE

configEXPO_NO_TELEMETRY

🔐 secretEXPO_SKIP_MANIFEST_VALIDATION_TOKEN

🔐 secretHEALIX_API_KEY— Users only need a . All AI calls are proxied server-side through the webapp — no OpenAI key needed on user machines.

configHEALIX_AUTO_APPLY_TEST_PATCHES

configHEALIX_AUTO_OPEN_BROWSER

configHEALIX_BROWSER_HEADLESS

🔐 secretHEALIX_BROWSER_USE_API_KEY

configHEALIX_BROWSER_USE_MODEL

configHEALIX_BROWSER_USE_PYTHON

configHEALIX_CALIBRATION_MODEL

configHEALIX_DASHBOARD_URL— No Webapp base URL. Used for all API calls and dashboard deep-links. Production Vercel URL

configHEALIX_DISABLE_STEP_CALIBRATION

configHEALIX_GEN_ASYNC— true routes /api/generate-tests through Inngest background jobs. Default: false.

configHEALIX_HEADLESS

configHEALIX_LOCAL_PHASE_TIMEOUT_MS

configHEALIX_LOG_REDACTION

configHEALIX_LOG_REDACTION_LEVEL

configHEALIX_MAX_ARTIFACT_BYTES

configHEALIX_MCP_TELEMETRY

configHEALIX_MCP_TELEMETRY_QUEUE_SIZE

configHEALIX_MCP_TELEMETRY_TIMEOUT_MS

configHEALIX_MODEL_LADDERS

configHEALIX_OPENAI_TIMEOUT_MS

configHEALIX_PLAYWRIGHT_ACTION_TIMEOUT_MS

configHEALIX_PLAYWRIGHT_CRASH_RETRIES

configHEALIX_PLAYWRIGHT_EXPECT_TIMEOUT_MS

configHEALIX_PLAYWRIGHT_NAVIGATION_TIMEOUT_MS

configHEALIX_PLAYWRIGHT_RETRIES

configHEALIX_PLAYWRIGHT_TEST_TIMEOUT_MS

🔐 secretHEALIX_PROJECT_KEY

configHEALIX_RUN_LOG_DIR

configHEALIX_SERVER_HEALTHCHECK_INTERVAL_MS

configHEALIX_SERVER_START_TIMEOUT_MS

configHEALIX_SKIP_CALIBRATION

configHEALIX_WEBAPP_AGENT_TIMEOUT_MS

configHEALIX_WEBAPP_TIMEOUT_MS

configHEALIX_WEBAPP_URL

🔐 secretJIRA_API_TOKEN

configJIRA_BASE_URL

🔐 secretJIRA_PROJECT_KEY

configNEXT_PUBLIC_APP_URL

configNEXT_PUBLIC_SUPABASE_URL— Supabase project URL.

🔐 secretOPENAI_API_KEY— OpenAI API key. Used only by webapp API routes — never by the MCP.

configPLAYWRIGHT_BROWSERS_PATH

configPLAYWRIGHT_JSON_OUTPUT_FILE

configPLAYWRIGHT_MCP_ALLOW_INSTALL

configPLAYWRIGHT_MCP_ENABLED

configPLAYWRIGHT_MCP_OUTPUT_DIR

configPLAYWRIGHT_MCP_PACKAGE

configPLAYWRIGHT_MCP_VERSION

configPORT

🔐 secretSTRIPE_SECRET_KEY

🔐 secretSTRIPE_WEBHOOK_SECRET

🔐 secretSUPABASE_SERVICE_ROLE_KEY— Supabase service role key (server-side only — never expose).

configTELEMETRY_RATE_LIMIT_PER_MINUTE

configTELEMETRY_RATE_LIMIT_PER_SECOND

configHEALIX_ALL_ROLES

configHEALIX_LLM_PROXY_URL

configOPENAI_BASE_URL

configOPENAI_API_BASE

configHEALIX_BROWSER_USE_PROVIDER

configHEALIX_PREAUTH_VERIFIED_ROLES

configHEALIX_BROWSER_USE_MAX_STEPS

configHEALIX_TARGET_URL

configHEALIX_LOGIN_USERNAME

🔐 secretHEALIX_LOGIN_PASSWORD

configHEALIX_TOTAL_TIMEOUT_S

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/krishsharma1008-testbot-mcp-1ckvje)](https://m8ven.ai/mcp/krishsharma1008-testbot-mcp-1ckvje)

commit: 12a628555a23eb697561f5878f832a29038c3be9

code hash: b2e5041db772ee0a3f222220a6530a85cc2b892496726d54643b1b7f81d8d554

verified: 6/22/2026, 12:59:15 PM

view raw JSON →