MCP Server by browserstack

Findings (23)

• highHigh. Something risky that needs a close look before you install.
  network issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/lib/local.ts:10
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/lib/local.ts:21
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/lib/local.ts:51
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/lib/local.ts:56
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/lib/local.ts:61
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/lib/local.ts:66
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  basic-ftp@5.3.1: 1 known vulnerability

  GHSA-c475-qrg2-pj4r

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  extract-zip@2.0.1: 2 known vulnerabilities

  GHSA-7pqw-9j4j-h8q3, GHSA-jmr9-qjv8-65gv

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install contacted hosts other than package registries

  api.browserstack.com
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  tests/tools/percyTokenLeak.test.ts:97
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.14: 2 known vulnerabilities

  GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.7: 2 known vulnerabilities

  GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  csv-parse@6.2.1: 1 known vulnerability

  GHSA-8cw4-87c7-c6xx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-copy@4.0.3: 1 known vulnerability

  GHSA-jggr-w7fw-pc2j

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.7: 5 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@10.5.0: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.12.28: 9 known vulnerabilities

  GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9, GHSA-8j4g-w8fx-2239, GHSA-crvj-82cr-hjcx +4 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.5.0: 5 known vulnerabilities

  GHSA-2vr4-cq9g-pvrc, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.9: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  vitest@4.1.7: 1 known vulnerability

  GHSA-82fw-gwwq-j7x9

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  BROWSERSTACK_LOCAL_OPTION_, DEV_MODE, USE_OWN_LOCAL_BINARY_PROCESS, REMOTE_MCP, MCP_UPLOAD_BASE_DIR, O11Y_TFA_RCA_BASE_URL, BROWSERSTACK_AUTOMATION_BASE_URL, BROWSERSTACK_O11Y_UI_BASE_URL, ASK_BROWSERSTACK_ATLAS_URL, ASK_BROWSERSTACK_AUTH_TOKEN_URL, ASK_BROWSERSTACK_RELAY_TRANSPORT, ASK_BROWSERSTACK…

Network activity

Tools exposed (52)

• accessibilityExpert

  Answer accessibility, a11y, and WCAG questions using BrowserStack's accessibility knowledge base.

• startAccessibilityScan

  Scan a web page URL for accessibility issues and get a CSV report. For a mobile app, run it on App Automate with accessibility on (setupBrowserStackAppAutomateTests), then fetchAccessibilityIssues.

• createAccessibilityAuthConfig

  Create an authentication configuration for accessibility scans. Supports both form-based and basic authentication.

• getAccessibilityAuthConfig

  Get an accessibility auth config by ID. Id: from createAccessibilityAuthConfig, or askBrowserStackAI with product "a11y" to find one.

• fetchAccessibilityIssues

  Fetch accessibility issues from one source: scanId+scanRunId, buildId, workflowReportId, appReportId or reportUrl. Ids: a link, startAccessibilityScan, or web_accessibility lists (searchCapability).

• setupBrowserStackAutomateTests

  Set up and run web tests on BrowserStack Automate with the SDK (functional or integration). For Percy visual testing use the Percy tool.

• percyVisualTestIntegrationAgent

  Integrate Percy visual testing into a new project and demo visual change detection step by step. Primary tool for "Integrate percy in this project".

• expandPercyVisualTesting

  Set up or expand Percy visual testing coverage in an existing project that may already use Percy (Percy Web and Percy Automate).

• addPercySnapshotCommands

  Adds Percy snapshot commands to the specified test files.

• listTestFiles

  Lists all test files for a given set of directories.

• runPercyScan

  Run a Percy visual test scan. Example prompts : Run this Percy build/scan. Never run percy scan/build without this tool

• fetchPercyChanges

  Retrieves and summarizes all visual changes detected by Percy AI between the latest and previous builds, helping quickly review what has changed in your project.

• managePercyBuildApproval

  Approve or reject a Percy build

• runAppLiveSession

  Open a manual App Live session for the user to operate by hand; the agent cannot drive it. To tap, type or read the app yourself, use a mobiledevicecontrol session via invokeCapability.

• runBrowserLiveSession

  Open a manual Live browser session for the user to operate by hand; the agent cannot drive it. To click, type or read the page yourself, use a devicecontrol session via invokeCapability.

• createProjectOrFolder

  Create a project and/or folder in BrowserStack Test Management. Creating a project needs no identifier; a folder inside an EXISTING project needs its id (PR-*); no tool lists projects, so use the capability functions.

• createTestCase

  Create a test case in BrowserStack Test Management. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• updateTestCase

  Update an existing test case; only the supplied fields change. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• listTestCases

  List test cases in a project, optionally one folder (see listFolders). Filters: case_type, priority, paging. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• listFolders

  List folders (id, name, counts) in a project; parent_id lists sub-folders. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• listTestCaseTemplates

  List test-case templates with their numeric template_id. Use the id with createTestCase to apply a custom template (the 'template' slug only selects system templates).

• createTestRun

  Create a test run in BrowserStack Test Management. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• listTestRuns

  List test runs with filters (dates, assignee, state). Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• updateTestRun

  Update a test run or add test cases to it. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• addTestResult

  Add a test result to a test run. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• uploadProductRequirementFile

  Upload files (e.g., PDRs, PDFs) to BrowserStack Test Management and retrieve a file mapping ID. This is utilized for generating test cases from files and is part of the Test Case Generator AI Agent in BrowserStack. Needs a project id (PR-*); no tool lists projects, so get it from the capability func

• createTestCasesFromFile

  Generate test cases from a file in BrowserStack Test Management using the Test Case Generator AI Agent.

• createLCASteps

  Generate Low Code Automation (LCA) steps for a test case. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions.

• listTestPlans

  List test plans (TP-*) with status, dates and run counts; paginated. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions. Creating a test plan or sub-plan, and linking or unlinking test runs, are not available as tools here: use the capability functions (they a

• getTestPlan

  Get a test plan (TP-*): metadata, linked runs, case count and status summary. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions. Requires a test plan identifier (TP-*). Call listTestPlans first if you do not have it. Creating a test plan or sub-plan, and link

• listSubTestPlans

  List sub-plans under a test plan (TP-*); paginated. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions. Requires a test plan identifier (TP-*). Call listTestPlans first if you do not have it. Creating a test plan or sub-plan, and linking or unlinking test runs

• getSubTestPlan

  Get a sub-plan (STP-*): metadata and linked runs. Needs a project id (PR-*); no tool lists projects, so get it from the capability functions. Requires a test plan identifier (TP-*). Call listTestPlans first if you do not have it. Creating a test plan or sub-plan, and linking or unlinking test runs,

• takeAppScreenshot

  Take a screenshot of an app running on a BrowserStack device.

• runAppTestsOnBrowserStack

  Run pre-built Espresso (Android) or XCUITest (iOS) suites on BrowserStack by upload. Not for Appium: use setupBrowserStackAppAutomateTests.

• setupBrowserStackAppAutomateTests

  Set up the App Automate SDK for Appium tests. For pre-built Espresso or XCUITest suites use runAppTestsOnBrowserStack.

• getFailureLogs

  Fetch logs or the video URL for an Automate/App Automate session. Needs a session id: listSessions lists them; getBuildId or listBuildId finds the build.

• fetchAutomationScreenshots

  Fetch screenshots captured during an Automate/App Automate session.

• listSessions

  List sessions for a hashed Automate/App Automate build: session IDs, status, OS, browser/device, dashboard URL.

• fetchSelfHealedSelectors

  Fetch self-healed selectors and the test source. Pass exactly one of `sessionId` or `buildUuid`; give the pairs to prepareSelfHealingPlan. Needs a session id: listSessions lists them; getBuildId or listBuildId finds the build.

• prepareSelfHealingPlan

  Build an edit plan from healed locator pairs plus test source; it does NOT modify files. `sessions`: [{sessionId, locators: [{original, healed}]}] or the raw healing report. Needs a session id: listSessions lists them; getBuildId or listBuildId finds the build.

• fetchBuildInsights

  Fetch build details and quality gate results. Includes hashed_id and session_type for listSessions.

• fetchRCA

  AI root cause for failed Automate/App Automate tests. Suggests fixes only; never auto-apply, require explicit user approval. Requires test ids. Call listTestIds first if you do not have it.

• getBuildId

  Get the BrowserStack build ID for a given project and build name, scoped to the current user's builds.

• listBuildId

  Get the latest build ID for a project and build name, across all users (no user filter).

• listTestIds

  List all tests of a BrowserStack build (each with its status and session id); optional status filter. Requires a BrowserStack build id. Call getBuildId or listBuildId first if you do not have it.

• askBrowserStackAI

  (Alpha, limited availability. If not enabled it returns an entitlement error; complete the task with the individual tools instead.) Use this when no other BrowserStack tool here fits, or when the ones you tried did not get you there. Prefer a specific tool whenever one fits. Describe the task in pla

• listProducts

  List BrowserStack products and their entities. START HERE: searchCapability needs a product name from this. Pass the user's request as `query`; if it reports a clash, ask the user which product they mean and wait. Never pick for them or merge products.

• describeEntity

  Describe an entity: identifiers, relations and product vocabulary. Read before filtering or writing; ids often need resolving first.

• searchCapability

  Find capabilities in ONE product by plain language. CALL listProducts FIRST; `product` must be spelled exactly as listProducts spells it. If `weak_match` is true, search again with `suggested_vocabulary` before invoking. Results are a shortlist: call describeCapability for the contract, then invokeC

• describeCapability

  Full contract (parameters, returns, response shapes) for ONE capability from searchCapability. Call it before invokeCapability. Identify by `name`; use `method` + `path` only when no name was returned.

• invokeCapability

  Run a capability after describeCapability, by `name` (or `method` + `path` if unnamed); args go in path_params / query / body. `select` narrows the response only where the contract carries `narrowable`. If `completed` is false, fetch the next page with the capability's own page parameter, not `offse

• submitFeedback

  Report a blocker, tool error, missing capability, or user feedback to BrowserStack. Never include PII or credentials.