suitest (suiflex/suitest) is an MCP server listed on the M8ven Trust Index. It scores 89 out of 100, grade B. It declares 38 tools. The publisher has proved control of what we score (Verified Publisher). It is connected through the M8ven GitHub App, so the listing is re-checked on every push.

Back to MCP Trust IndexM8ven
B
Emerging
89/100

suitest

Self-hostable, MCP-native testing platform. Manual test management, deterministic runs, optional AI. Your stack, your LLM, your data.

→ suiflex/suitest· listed on github_code

Emerging. No concerning findings. Grades remain capped until the project builds reputation through adoption. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored

every push re-verified

Who stands behind it

gmail.com (@suiflex) · Verified Publisher

Source: github_code · also listed on github_repo_search

Install from

GitHub

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: SUITEST_API_KEY. We can’t prove the destination matches the brand the credential belongs to.
🔐
You'll be asked for 3 credentials: SUITEST_API_KEY, SUITEST_TOKEN, SUITEST_ENCRYPTION_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
Are you the publisher? Confirm or correct these findings.
// tools this server exposes35 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

http.request

Execute an HTTP request via httpx.AsyncClient.

http.assert_status

Assert a response status code equals an expected integer.

http.assert_json_path
http.assert_pdf_text
http.assert_header
graphql.query

Execute a GraphQL query.

graphql.mutate

Execute a GraphQL mutation.

graphql.assert_data

Run a query and assert a JSONPath over the data payload.

grpc.call

Invoke a unary gRPC method via server reflection.

grpc.assert_response

Invoke a unary method and assert a JSONPath on the response.

k8s.get

Get one resource by kind/namespace/name.

k8s.list

List resources of a kind in a namespace.

k8s.assert_condition

Assert a JSONPath on a resource equals an expected value.

mongo.find

Find documents in a collection by filter.

mongo.insert_one

Insert a single document.

mongo.delete

Delete documents matching a filter.

mongo.assert_count

Assert the document count matching a filter.

db.query

Execute a SELECT; returns rows as list[dict].

db.exec

Execute DML/DDL; returns affected rowcount.

db.assert_row_count

Assert COUNT(*) over a table matches an exact value.

db.insert

Parameterized INSERT keyed by column->value.

db.delete

Parameterized DELETE keyed by column->value WHERE.

db.assert_row_exists

Assert >=1 row matches the WHERE filter.

dynamic_tool_618
tauri.launch
tauri.close

End the WebDriver session and stop the application.

tauri.click

Click the first element matching the selector.

tauri.type_text

Send text to the element matching the selector.

tauri.get_text

Return the rendered text of the matching element.

tauri.assert_text

Assert the matching element's text equals or contains a value.

tauri.assert_visible
tauri.eval
tauri.start_video
tauri.stop_video
tauri.screenshot

PNG screenshot of the application window.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configKURIR_BIN
🔐 secretSUITEST_API_KEY💡 SUITEST_API_URL and are required. MCP startup verifies the key and stops until the workspace LLM has been validated in Settings. Provider credentials stay on the Suitest server.
configSUITEST_API_PORT
configSUITEST_API_URL💡 and SUITEST_API_KEY are required. MCP startup verifies the key and stops until the workspace LLM has been validated in Settings. Provider credentials stay on the Suitest server.
configSUITEST_CONFIG_DIR
configSUITEST_PYTHON
configVITE_BACKEND_PORT
configVITE_PORT
configXDG_CONFIG_HOME
🔐 secretSUITEST_TOKEN
configSUITEST_WORKSPACE_ID
configSUITEST_WEB_DIST
configSUITEST_REDIS_URL
configSUITEST_OTEL_DISABLED
configOTEL_EXPORTER_OTLP_ENDPOINT
configOTEL_SERVICE_NAME
configSUITEST_DATA_DIR
configSUITEST_ARTIFACTS_DIR
🔐 secretSUITEST_ENCRYPTION_KEY
configSUITEST_EMBEDDINGS
configSUITEST_EMBEDDINGS_MODEL
configDISPLAY
configWAYLAND_DISPLAY
configXDG_CURRENT_DESKTOP
configSUITEST_DATABASE_URL
configDEMO_SUITE_PATH
configSUITEST_RECREATE_PROJECT
Deployment configuration, supplied by whoever hosts the server. Users are not asked for these.
deployDEMO_APP_URL
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

38/38 tools missing one or more hints — http.request (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); http.assert_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); http.assert_json_path (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +35 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool test coverage

21/38 tools referenced in tests (55%)

Write tests that reference each tool by name so every tool has at least one test.

// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/suiflex/suitest)](https://m8ven.ai/mcp/suiflex/suitest)
Shows your grade and updates automatically. Prefer no grade? Append ?variant=verified to the badge URL.
commit: 2cf4a2da3a84919124b00ffa8364284da0172994
code hash: 21f7f4c9fc60cffd341780a91a99309bc03848850986de7fed47be77d46a747a
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client