Healix (krishsharma1008/TestBot_MCP) is an MCP server listed on the M8ven Trust Index. M8ven has not graded it: we have no way to read this server ourselves. No publisher has claimed this listing.
End-to-end AI test generation and QA automation server that orchestrates auto-detection, browser exploration, test generation, execution, and dashboard analysis directly from your IDE.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
krishsharma1008
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
BROWSERBROWSER_USE_API_KEYBROWSER_USE_PYTHONEXPO_NO_BROWSEREXPO_NO_DEPENDENCY_VALIDATIONEXPO_NO_INTERACTIVEEXPO_NO_TELEMETRYEXPO_SKIP_MANIFEST_VALIDATION_TOKENHEALIX_API_KEYUsers only need a . All AI calls are proxied server-side through the webapp — no OpenAI key needed on user machines.HEALIX_AUTO_APPLY_TEST_PATCHESHEALIX_AUTO_OPEN_BROWSERHEALIX_BROWSER_HEADLESSHEALIX_BROWSER_USE_API_KEYHEALIX_BROWSER_USE_MODELHEALIX_BROWSER_USE_PYTHONHEALIX_CALIBRATION_MODELHEALIX_DASHBOARD_URLNo Webapp base URL. Used for all API calls and dashboard deep-links. Production Vercel URLHEALIX_DISABLE_STEP_CALIBRATIONHEALIX_GEN_ASYNCtrue routes /api/generate-tests through Inngest background jobs. Default: false.HEALIX_HEADLESSHEALIX_LOCAL_PHASE_TIMEOUT_MSHEALIX_LOG_REDACTIONHEALIX_LOG_REDACTION_LEVELHEALIX_MAX_ARTIFACT_BYTESHEALIX_MCP_TELEMETRYHEALIX_MCP_TELEMETRY_QUEUE_SIZEHEALIX_MCP_TELEMETRY_TIMEOUT_MSHEALIX_MODEL_LADDERSHEALIX_OPENAI_TIMEOUT_MSHEALIX_PLAYWRIGHT_ACTION_TIMEOUT_MSHEALIX_PLAYWRIGHT_CRASH_RETRIESHEALIX_PLAYWRIGHT_EXPECT_TIMEOUT_MSHEALIX_PLAYWRIGHT_NAVIGATION_TIMEOUT_MSHEALIX_PLAYWRIGHT_RETRIESHEALIX_PLAYWRIGHT_TEST_TIMEOUT_MSHEALIX_PROJECT_KEYHEALIX_RUN_LOG_DIRHEALIX_SERVER_HEALTHCHECK_INTERVAL_MSHEALIX_SERVER_START_TIMEOUT_MSHEALIX_SKIP_CALIBRATIONHEALIX_WEBAPP_AGENT_TIMEOUT_MSHEALIX_WEBAPP_TIMEOUT_MSHEALIX_WEBAPP_URLJIRA_API_TOKENJIRA_BASE_URLJIRA_PROJECT_KEYOPENAI_API_KEYOpenAI API key. Used only by webapp API routes — never by the MCP.PLAYWRIGHT_BROWSERS_PATHPLAYWRIGHT_JSON_OUTPUT_FILEPLAYWRIGHT_MCP_ALLOW_INSTALLPLAYWRIGHT_MCP_ENABLEDPLAYWRIGHT_MCP_OUTPUT_DIRPLAYWRIGHT_MCP_PACKAGEPLAYWRIGHT_MCP_VERSIONSTRIPE_SECRET_KEYSTRIPE_WEBHOOK_SECRETTELEMETRY_RATE_LIMIT_PER_MINUTETELEMETRY_RATE_LIMIT_PER_SECONDHEALIX_ALL_ROLESHEALIX_LLM_PROXY_URLOPENAI_BASE_URLOPENAI_API_BASEHEALIX_BROWSER_USE_PROVIDERHEALIX_PREAUTH_VERIFIED_ROLESHEALIX_BROWSER_USE_MAX_STEPSHEALIX_TARGET_URLHEALIX_LOGIN_USERNAMEHEALIX_LOGIN_PASSWORDHEALIX_TOTAL_TIMEOUT_SDATABASE_URLNEXT_PUBLIC_APP_URLNEXT_PUBLIC_SUPABASE_URLPORTSUPABASE_SERVICE_ROLE_KEYDependencies
2 dependencies, 2 flagged: @playwright/mcp, @playwright/test
Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
5/5 tools missing one or more hints — healix_configure (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); healix_test_my_app (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); healix_check_run_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +2 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
License file
No license file
Add a LICENSE file (MIT, Apache-2.0, etc.).
Tool test coverage
Only 0/5 tools referenced in tests (0%)
Write tests that reference each tool by name so every tool has at least one test.
Shell command execution
32 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Secrets stay with their owner
1 secret/sensitive value flow into network calls (HEALIX_API_KEY → dynamic) (1 other flows matched canonical API hosts)
Audit where credentials are sent. A NOTION_TOKEN should only reach api.notion.com — never a third-party host.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/krishsharma1008-testbot-mcp-1ckvje)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check