MCP tools for AI agents

Connect an AI agent to SpecTestEngine through MCP so it can create specifications, run tests and return structured evidence with user-controlled access.

AI agent workspace

Let a user-authorized AI agent create and run tests for you.

MCP is the bridge between SpecTestEngine and external AI agents. A user can give an interactive client OAuth access to the active project, or create a dedicated service identity for unattended automation. The agent uses the documented tools to create specifications, run checks, inspect evidence, and return a clear testing report without receiving the user's password or browser session.

ConnectionStreamable HTTP + OAuth

Primary usersDevelopers, QA, AI agents

Main outcomeTests created, run, and explained

Create test assets from a user request

An authorized agent can read the MCP tool descriptions, create REST, SOAP, GraphQL, or flow assets, and keep the user in the loop instead of asking them to click through every form manually.

Run specs and flows

The agent can execute generated or existing tests, inspect run evidence, compare status/body/header mismatches, and return a clear summary of what passed or failed.

Inspect durable evidence

The agent can return run evidence, snapshot comparisons, visual document-diff links, and immutable generation details instead of reducing a result to a pass/fail sentence.

Keep project access bounded

Interactive clients act as the signed-in user through OAuth and the active project. Headless clients receive an explicit service identity with selected test permissions.

Work with API documents

Agents can upload request documents, build attachment-aware REST, SOAP, or GraphQL tests, and use document assertions without turning response files into permanent MCP data.

Choose agent or deterministic SDK

Use MCP when an agent should discover the next testing action. Use the SDK when your application already knows the exact operation and needs a deterministic API contract.

Connect Codex, Claude Code, or a headless agent

1Choose interactive or headlessUse interactive OAuth for Codex, Claude Code, or another human-driven client. Use a service identity only for CI or unattended automation.

2Create the integrationOpen Project administration → Agent integrations. The generated interactive command includes the client ID and required project audience. Service credentials are shown once.

3Connect over Streamable HTTPThe client connects to https://ste.software/mcp, discovers the OAuth authorization server, signs in, and reads its effective project access before acting.

4Create, run, and reportThe agent creates specs or flows, runs them, checks the evidence, and sends the user a human-readable result.

Two authentication modes, one MCP endpoint

Interactive OAuth

Codex and Claude Code use Authorization Code with PKCE. The user signs in through SpecTestEngine and the client receives short-lived tokens for the active project.

Headless / CI OAuth

A CI job or unattended agent uses Client Credentials to obtain a short-lived access token. Its one-time client secret belongs to the service identity, not to a human user.

Discovery contract

The MCP endpoint publishes OAuth Protected Resource Metadata and points clients to the SpecTestEngine authorization server. Clients refresh access through OAuth.

Example request to an AI agent

Use my authorized SpecTestEngine MCP connection. Create REST specs for the checkout API, run them, inspect failures, regenerate unstable assertions only when the evidence proves the contract changed, and give me a short report with links to the created assets and visual evidence.

Project-scoped access

OAuth resolves the current user, active project, permissions, subscription, and MCP hard allowlist on the server. The agent never receives personal browser credentials.

Tool descriptions guide the agent

The MCP server describes available operations and payloads, so the agent can act through stable product capabilities instead of relying on brittle screen automation.

Human-readable output

The agent should finish by telling the user what it created, what it ran, which evidence changed, and what needs attention.