MCP tools for AI agents

Connect an AI agent to SpecTestEngine through MCP so it can create specifications, run tests and return structured evidence with user-controlled access.

AI agent workspace

Connect an AI agent with access you can review and revoke.

Connect a supported local MCP client over OAuth, then approve its STE project, actions and expiry. Connected-agent access is available only when enabled by your operator. The agent uses native tools without receiving your password or browser session.

ConnectionStreamable HTTP + OAuth

Primary usersDevelopers, QA, AI agents

Main outcomeExplicit, expiring project access

What a connected agent can do today

Call ste_connection_status to see approved access. Native connected agents can read and delete project flows, and create or update drafts using inline browser actions. Saved specification references, macros, visual baselines and execution are unavailable in this initial rollout. Broader tools listed below require separately authorized machine integrations.

Approval lasts up to eight hours and is shared by this OAuth client and account. Your project permissions and subscription still apply. Flow content may contain sensitive values you saved. Never paste passwords, cookies or bearer tokens into a conversation.

Compatible WebMCP browsers expose discovery and a consented flow-list read using document.modelContext. Unsupported browsers can use the native MCP connection.

Create test assets from a user request

An authorized agent can read the MCP tool descriptions, create REST, SOAP, GraphQL, or flow assets, and keep the user in the loop instead of asking them to click through every form manually.

Run specs and flows

The agent can execute generated or existing tests, inspect run evidence, compare status/body/header mismatches, and return a clear summary of what passed or failed.

Inspect durable evidence

The agent can return run evidence, snapshot comparisons, visual document-diff links, and immutable generation details instead of reducing a result to a pass/fail sentence.

Keep project access bounded

Interactive clients act as the signed-in user through OAuth and the active project. Headless clients receive an explicit service identity with selected test permissions.

Work with API documents

Agents can upload request documents, build attachment-aware REST, SOAP, or GraphQL tests, and use document assertions without turning response files into permanent MCP data.

Choose agent or deterministic SDK

Use MCP when an agent should discover the next testing action. Use the SDK when your application already knows the exact operation and needs a deterministic API contract.

Connect Codex, Claude Code, or a headless agent

1Choose interactive or headlessUse interactive OAuth for Codex, Claude Code, or another human-driven client. Use a service identity only for CI or unattended automation.

2Create the integrationOpen Profile → AI and agents for copy-ready setup for Claude Code, Codex, VS Code and Cursor, live availability and the approved OAuth client IDs. Automatic client registration is not supported, so use one of those IDs if your client asks.

3Connect over Streamable HTTPThe client connects to https://ste.software/mcp, discovers the OAuth authorization server, signs in, and reads its effective project access before acting.

4Review and approve accessThe agent calls ste_request_api_access and shows you an approval URL. Select actions and expiry, then return to the agent. Manage or revoke the connection in Profile → AI and agents.

Two authentication modes, one MCP endpoint

Interactive OAuth

Codex and Claude Code use Authorization Code with PKCE. The user signs in through the configured issuer. A separate STE approval grants selected actions in one project.

Headless / CI OAuth

A CI job or unattended agent uses Client Credentials to obtain a short-lived access token. Its one-time client secret belongs to the service identity, not to a human user.

Discovery contract

The MCP endpoint publishes OAuth Protected Resource Metadata and points clients to the SpecTestEngine authorization server. Clients refresh access through OAuth.

Example request to an AI agent

Connect to SpecTestEngine, check ste_connection_status and request flow:read if needed. Show me the approval URL, wait for my decision, then list the flows in my approved project.

Project-scoped access

OAuth resolves the current user, active project, permissions, subscription, and MCP hard allowlist on the server. The agent never receives personal browser credentials.

Tool descriptions guide the agent

The MCP server describes available operations and payloads, so the agent can act through stable product capabilities instead of relying on brittle screen automation.

Human-readable output

The agent should finish by telling the user what it created, what it ran, which evidence changed, and what needs attention.