Qase MCP (official)
Capped at 70: core tools not tested (only setup or self-check calls passed); the tests add up to 100. Why scores are capped
Test points add up to 100; the score is capped at 70 until a tool call passes. Not a quality or security rating. Methodology
Test points before the cap (100/100)
- Install20/20
- Handshake30/30
- Maintenance25/25
- Docs15/15
- License10/10
Tested npm @qase/mcp-server 3.0.6 (repo qase-tms/qase-mcp-server, 37 GitHub stars when tested; registry name io.qase/mcp-server), started over stdio. Its 42 tools listed without credentials. Only the built-in help tools work without an account: qql_help and qase_discover_tools passed; qase_get returned an error because no QASE_API_TOKEN was set (expected). Test-case, run and project tools need a Qase account and were not tested. Recategorized 2026-11-10: qql_help and qase_discover_tools are self-check, so passing_real_calls is 0 and the score is capped at 70 until an account tool passes (core tools not tested).
Tool-call test (2026-11-05, direct MCP stdio client, no LLM): pass. 2 of 3 calls passed: qql_help and qase_discover_tools (help tools only). Account tools need QASE_API_TOKEN; not tested. Evidence: local test run, Nov 5, 2026.
Transport (tested 2026-11-05): stdio
Tested version: 3.0.6 · tested 2026-11-05
Token cost (estimate): approx. 13196 tokens, cl100k estimate (42 tools, measured 2026-11-11, version 3.0.6). This is an estimate from our testing of the tool names, descriptions and input schemas, counted with cl100k_base.
Permissions: 7 read, 32 write (state-changing), 3 unclassified · Auth: API key · Rate limit: unknown · Pricing unit: unknown
Auth: API key. Rate limit: unknown. Pricing unit: unknown.
qase_api— write (state-changing)qase_attachment_delete— write (state-changing)qase_attachment_upload— write (state-changing)qase_case_bulk_create— write (state-changing)qase_case_delete— write (state-changing)qase_case_upsert— write (state-changing)qase_ci_report— write (state-changing)qase_custom_field_delete— write (state-changing)qase_custom_field_upsert— write (state-changing)qase_defect_delete— write (state-changing)qase_defect_upsert— write (state-changing)qase_discover_tools— readqase_environment_delete— write (state-changing)qase_environment_upsert— write (state-changing)qase_external_issue_link— unclassifiedqase_get— readqase_milestone_delete— write (state-changing)qase_milestone_upsert— write (state-changing)qase_plan_delete— write (state-changing)qase_plan_upsert— write (state-changing)qase_project_context— readqase_project_create— write (state-changing)qase_project_delete— write (state-changing)qase_regression_run— unclassifiedqase_result_delete— write (state-changing)qase_result_record— write (state-changing)qase_review_bulk_create— write (state-changing)qase_review_create— write (state-changing)qase_review_delete— write (state-changing)qase_review_list— readqase_review_update— write (state-changing)qase_run_complete— unclassifiedqase_run_delete— write (state-changing)qase_run_upsert— write (state-changing)qase_shared_step_delete— write (state-changing)qase_shared_step_upsert— write (state-changing)qase_suite_delete— write (state-changing)qase_suite_upsert— write (state-changing)qase_tool_help— readqase_triage_defect— write (state-changing)qql_help— readqql_search— read
listing-flags calls_need_key or auth_kind
Score 70/100 · Tools 42 · Token cost approx. 13,196 tokens · Compare · Last tested 2026-11-05 · Version tested 3.0.6 · Package @qase/mcp-server · Repo qase-tms/qase-mcp-server
Summary: Qase MCP (official) completed an MCP handshake without credentials and exposed 42 tools.
Evidence summary
- Handshake
- pass
- Tools listed
- 42
- Context cost
- approx. 13196 tokens, cl100k estimate (42 tools, measured 2026-11-11, version 3.0.6; an estimate) ranking · add up your servers' context cost
- API key
- Help tools work without a key; account tools need a QASE_API_TOKEN
- Tested
- 2026-11-05
Test results
| Test | Result | Points | Evidence |
|---|---|---|---|
| install | pass | 20 | npm install @qase/mcp-server (Node 20, Linux) succeeded in 4s. |
| handshake | pass | 30 | MCP initialize + tools/list over stdio succeeded with no credentials; 42 tools listed in 8.2s. |
| maintenance | pass | 25 | Repo pushed 0 days before test; 37 GitHub stars. |
| docs | pass | 15 | README over 3,000 chars; install instructions present; mcpServers config example present. Check of the package's own README (README shipped in npm package). |
| license | pass | 10 | MIT (OSI-approved). |
Local-model readiness
Token cost (estimate): approx. 13196 tokens, cl100k estimate for 42 tools · about 161% of an 8k context. This is an estimate from our testing (counted with cl100k_base).
Small-model friendly (schema heuristic, not a model result): unknown.
Not tested
Small-model task runs: Not yet tested.
What we tested and what we didn't
Tested on 2026-11-05
- Install from the registry
- We connected with no credentials and asked for its tool list: it listed 42 tools (Method details: MCP
initializethentools/list) - Maintenance signals (last push, archived/deprecated status)
- Docs (README length, install and config example)
- License (OSI-approved or not)
- Token cost (estimate)
Not tested
- Security: not audited (no code review, no permission or data-flow analysis)
- Real tasks (no functional task runs yet)
- Behaviour with real credentials or a real account
- Performance, rate limits or load
- Correctness of results beyond the listed tasks
Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.
Known security issues
Checked on 2026-11-09 for version 3.0.6 against OSV, GitHub advisories, GitHub repository advisories. Scope: the package itself; dependencies not scanned.
No published advisories found in OSV and GitHub advisories for @qase/mcp-server 3.0.6 as of 2026-11-09. This is not a security audit.
Monthly roundup: MCP security issues, October 2026.
Tool list changes
Unchanged since the previous snapshot (latest 2026-11-11).
Snapshot hash (fingerprint of the tool list)
4dc9e4920a9d: SHA-256 of the canonical tool names, descriptions and input schemas. If it changes, the tool list changed.
Raw test record (JSON)
{
"name": "@qase/mcp-server",
"version": "3.0.6",
"registry": "npm",
"status": "working",
"tested": "2026-11-05",
"tools_count": 42,
"deprecated": false,
"archived": false,
"tests": {
"install": [
"pass",
20,
"`npm install @qase/mcp-server` (Node 20, Linux) succeeded in 4s."
],
"handshake": [
"pass",
30,
"MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 42 tools listed in 8.2s."
],
"maintenance": [
"pass",
25,
"Repo pushed 0 days before test; 37 GitHub stars."
],
"docs": [
"pass",
15,
"README over 3,000 chars; install instructions present; `mcpServers` config example present. Check of the package's own README (README shipped in npm package)."
],
"license": [
"pass",
10,
"MIT (OSI-approved)."
]
}
}Install
npx -y @qase/mcp-server
Pin the version we tested
npx -y @qase/mcp-server@3.0.6
tested 2026-11-05. Newer versions may differ and were not tested by us.
{
"mcpServers": {
"qase-mcp": {
"command": "npx",
"args": [
"-y",
"@qase/mcp-server@3.0.6"
]
}
}
}Tools listed
qase_api, qase_attachment_delete, qase_attachment_upload, qase_case_bulk_create, qase_case_delete, qase_case_upsert, qase_ci_report, qase_custom_field_delete, qase_custom_field_upsert, qase_defect_delete, qase_defect_upsert, qase_discover_tools, qase_environment_delete, qase_environment_upsert, qase_external_issue_link, qase_get, qase_milestone_delete, qase_milestone_upsert, qase_plan_delete, qase_plan_upsert, qase_project_context, qase_project_create, qase_project_delete, qase_regression_run, qase_result_delete, qase_result_record, qase_review_bulk_create, qase_review_create, qase_review_delete, qase_review_list, qase_review_update, qase_run_complete, qase_run_delete, qase_run_upsert, qase_shared_step_delete, qase_shared_step_upsert, qase_suite_delete, qase_suite_upsert, qase_tool_help, qase_triage_defect
Tool history: captured Nov 11, 2026. All tool history.
Quick config
{
"mcpServers": {
"qase-mcp": {
"command": "npx",
"args": [
"-y",
"@qase/mcp-server"
]
}
}
}Add to config Opens the config generator with this server selected.
Setup
- Install. Run
npm install @qase/mcp-server(Node 20). This is the exact command we ran on 2026-11-05. - Configure. Add the mcpServers entry below to your MCP client config.
- Verify. Restart the client and check that tools/list returns tools (42 in our test).
{
"mcpServers": {
"qase-mcp": {
"command": "npx",
"args": [
"-y",
"@qase/mcp-server"
]
}
}
}Test history
- 2026-11-05: New
FAQ
Is Qase MCP deprecated?
No. @qase/mcp-server was not deprecated or archived when we last tested it on 2026-11-05.
What replaces Qase MCP?
Nothing; Qase MCP (official) is not deprecated as of 2026-11-05.
Does Qase MCP need an API key?
Yes, an API key is needed for account tools. It connects and lists 42 tools without a key, but only the help tools (qql_help and qase_discover_tools) worked without a key; account tools need a QASE_API_TOKEN: qase_get returned 'needs QASE_API_TOKEN' (our probe, 2026-11-05).
Embed the badge
Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.