/ 100

1 month ago

glama

Full-MCP-QA

Item: Full-MCP-QA
Rating: 35
Author: M8ven

Exposes the qa_agent_status tool that reports configured integrations and the latest QA metric for the Website QA Agent.

→ tamzidnahian/Full-MCP-QA · listed on glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

Glama

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: SLACK_BOT_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Tests do not pass

Either the test suite is broken or the code regressed. Either way the published behaviour can’t be verified by the publisher’s own tests.

🔐

You'll be asked for 8 credentials: AGENT_TRANSITION_ON_PASS, AGENT_WEBHOOK_ALLOW_SHARED_SECRET, GITHUB_PERSONAL_ACCESS_TOKEN, GITHUB_TOKEN, JIRA_API_TOKEN, JIRA_PROJECT_KEY, OPENAI_API_KEY, SLACK_BOT_TOKEN

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// required environment variables

This server reads these from process.env. You'll be asked to provide them before it can run.

configAGENT_MAX_TICKETS

configAGENT_POLL_SECONDS

🔐 secretAGENT_TRANSITION_ON_PASS— transitions passed Jira tickets only when =true and JIRA_TRANSITION_DONE_ID are set

🔐 secretAGENT_WEBHOOK_ALLOW_SHARED_SECRET— If you connect directly from Jira Automation and cannot compute an HMAC signature, set =true and send X-QA-Agent-Secret: <JIRA_WEBHOOK_SECRET>. Do not put the secret in the URL.

configAGENT_WEBHOOK_PORT

configAGENT_WEBHOOK_SIGNATURE_WINDOW_MS

configGITHUB_BASE_BRANCH

🔐 secretGITHUB_PERSONAL_ACCESS_TOKEN— creates a GitHub issue for failed tests when GITHUB_REPO and either GITHUB_TOKEN or are set

configGITHUB_REPO— 3. Optional: fill SLACK_WEBHOOK_URL, , GITHUB_TOKEN, JIRA_TRANSITION_DONE_ID, and JIRA_WEBHOOK_SECRET.

🔐 secretGITHUB_TOKEN— 3. Optional: fill SLACK_WEBHOOK_URL, GITHUB_REPO, , JIRA_TRANSITION_DONE_ID, and JIRA_WEBHOOK_SECRET.

🔐 secretJIRA_API_TOKEN

configJIRA_AUTONOMOUS_FAILURE_LABEL

configJIRA_BASE_URL

configJIRA_EMAIL

configJIRA_LABEL

🔐 secretJIRA_PROJECT_KEY

configJIRA_TRANSITION_DONE_ID— 3. Optional: fill SLACK_WEBHOOK_URL, GITHUB_REPO, GITHUB_TOKEN, , and JIRA_WEBHOOK_SECRET.

🔐 secretOPENAI_API_KEY— 2. Fill in TARGET_URL, Jira credentials, and .

🔐 secretSLACK_BOT_TOKEN— sends a Slack message when SLACK_WEBHOOK_URL is set, or when and SLACK_CHANNEL_ID are set

configSLACK_CHANNEL_ID— sends a Slack message when SLACK_WEBHOOK_URL is set, or when SLACK_BOT_TOKEN and are set

configSLACK_WEBHOOK_URL— 3. Optional: fill , GITHUB_REPO, GITHUB_TOKEN, JIRA_TRANSITION_DONE_ID, and JIRA_WEBHOOK_SECRET.

configTARGET_TEST_HINTS

configTARGET_URL— 2. Fill in , Jira credentials, and OPENAI_API_KEY.

// full audit trail

The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.

// improvement guidance — verified publishers only

We have 2 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Score](https://m8ven.ai/badge/mcp/tamzidnahian-full-mcp-qa-6l8vvo)](https://m8ven.ai/mcp/tamzidnahian-full-mcp-qa-6l8vvo)

commit: ba0a1a2a65ddf6bd3459dd0848bd9e7a1a4ff9fd

code hash: afc158e8251901f2e773a2f837e1982c1ce768bc39868718f72cc8c08e1aed5f

verified: 6/22/2026, 12:37:37 PM

view raw JSON →