@qulib/mcp

${EXPLORE_AUTH_DESCRIPTION} (Alias for new integrations: qulib_explore_auth)

${EXPLORE_AUTH_DESCRIPTION} (Canonical qulib_ form; explore_auth is the legacy alias kept for backwards compatibility.)

${DETECT_AUTH_DESCRIPTION} (Alias for new integrations: qulib_detect_auth)

${DETECT_AUTH_DESCRIPTION} (Canonical qulib_ form; detect_auth is the legacy alias kept for backwards compatibility.)

${ANALYZE_APP_DESCRIPTION} (Alias for new integrations: qulib_analyze_app)

${ANALYZE_APP_DESCRIPTION} (Canonical qulib_ form; analyze_app is the legacy alias kept for backwards compatibility.)

Score an automation repository for QA maturity across six dimensions: test coverage breadth, framework adoption, test-id hygiene, CI integration, auth test coverage, and component test ratio. Returns an overall score (0–100), maturity level (L1–L5), and prioritized recommendations.

Generate a ready-to-run test scaffold for a deployed web app. Crawls the URL, identifies quality gaps and user flows, then produces framework-specific test files plus the project config and package.json deps. Returns generatedTests (array of {filename, code, outputPath}) and projectConfig so an agent can write the files directly to a repo without any manual test-writing. Supported frameworks: cypress-e2e (default) and playwright — both fully implemented (real generated specs, project config, and dry-run TypeScript compile validation). Optionally pass recipes (e.g. ["auth","a11y"]) to append proven NQ-2/CaseLoom-derived test patterns for common flows — auth adds login/logout/protected-route tests, a11y adds heading/landmark/title checks, nav adds deep-link/404 tests, seed adds state-reset helpers. Optionally pass journeys — pre-recorded user flows (Chrome DevTools Recorder JSON exports, or already-shaped qulib scenarios) — to scaffold from those instead of crawling; format is auto-detected per entry.

Discover API endpoints in a repository and score their test coverage. Returns an api-test-coverage dimension score (0–100) with per-endpoint contextual evidence — which endpoints are covered by tests and which are not. Discovery is evidence-only: Tier1=OpenAPI/Swagger specs, Tier2=framework routes (Next.js App-Router route.ts exports, Pages API routes, Express, Fastify, Hono, NestJS decorators), Tier3=heuristic opt-in (tRPC). Never fabricates endpoints. Returns "not_applicable" when no API endpoints are found.

Compute a fused Release Confidence verdict by composing qulib evidence collectors.

Grade release evidence provenance deterministically and compute the Witnessed-State-Ratio (WSR).

Structured diff between two analyze outputs — added findings, resolved findings, severity changes, and a confidence delta.

Scan a captured page surface (HTML body, inline scripts, HTML comments, meta tags, response headers) for signals that an AI system prompt or agent instructions are inadvertently exposed to the public. Conservative — requires corroborating signals to minimise false positives. Returns an array of prompt-leakage Gaps (may be empty when nothing is detected). Each Gap includes severity (critical/high/medium), evidence, and a remediation recommendation.