TestingBot MCP Server
TestingBot testing infrastructure management for AI-driven mobile and web automation tasks.
Data last scanned today · Reviewed today
Overview
This MCP server provides a bridge between AI assistants and the TestingBot platform. It allows users to execute automated test suites—including Maestro, Espresso, and XCUITest—directly from an agent, alongside features for managing mobile app files and cross-browser screenshot testing. Beyond test execution, the server facilitates infrastructure maintenance by providing tools for device and browser querying, tunnel management for local testing, and team account administration. It supports an OAuth-style login flow via the tb_login tool, reducing the need for manual API credential management.
Our verdict
With a security score of 33/100, this server is currently classified as high-risk. This rating is primarily due to the fact that it is a community-maintained project that has not yet undergone editorial review, combined with an unverified authentication method and unknown risk levels for its specific tools. Given these factors, it is recommended only for users comfortable with the current lack of external auditing who can manage the risks associated with providing their testing infrastructure credentials to an unverified MCP server.
- Supports OAuth-style login to avoid manual API key handling.
- Enables direct management of mobile app files like APKs.
- Includes eight direct dependencies, minimizing the supply-chain surface area.
- Licensed under the permissive MIT license.
- Security score of 33/100 indicates high risk level.
- Authentication methods have not yet been editorially reviewed.
- Server implementation has not yet undergone security auditing.
- Maintained by the community rather than the official TestingBot vendor.
Setup
{
"mcpServers": {
"testingbot-mcp-server": {
"args": [
"-y",
"@testingbot/mcp-server"
],
"command": "npx"
}
}
}Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.
- No read-only mode — running this grants full read/write access.
- No built-in authentication — anyone with access to this config can invoke every tool it exposes.
Tools
| Tool | Description | Risk |
|---|---|---|
| startLiveSession | Start an interactive live testing session on TestingBot. | medium |
| startDesktopLiveSession | Convenience tool to start a desktop browser live testing session. | medium |
| startMobileLiveSession | Convenience tool to start a mobile device live testing session. | medium |
| getBrowsers | Get list of available browsers and platforms for testing. | low |
| getDevices | Get list of available mobile devices (real devices and simulators). | low |
| getTests | Retrieve a list of recent tests with pagination. | low |
| getTestDetails | Get comprehensive details about a specific test. | low |
| updateTest | Update test metadata such as name, status, or build. | medium |
| deleteTest | Delete a test by session ID. | high |
| stopTest | Stop a running test by session ID. | medium |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What are the system requirements for running the TestingBot MCP server?
You need Node.js version 18 or later, with 22.15.0 or later recommended, plus an active TestingBot account and an MCP-compatible client like Claude Desktop, Cursor, or VS Code.
›How do I authenticate with TestingBot without manually copying API keys?
You can use the tb_login tool within your AI agent. This triggers an OAuth-style browser flow that securely handles credentials, storing them in your user directory without requiring manual JSON configuration.
›Can I use the TestingBot server in remote environments like SSH or dev containers?
Yes, if the loopback browser flow is unavailable, the server automatically falls back to a device code mechanism, providing a URL and code for you to authorize the session manually in a browser.
›How does the server determine which credentials to use?
The server checks for credentials in the following order: environment variables, the ~/.testingbot/credentials file created by tb_login, and finally defaults to a degraded mode if neither is provided.
›How can I switch between different TestingBot accounts?
You can manage multiple accounts by setting the TESTINGBOT_PROFILE environment variable to specify a different account profile.
›What happens if I don't configure API credentials immediately upon startup?
The server will start, but it will enter a degraded mode where all tool calls except for tb_login will report that you need to authenticate.
Changelog
- Securityv1.1.2
2026-08-27
- Improvedv1.1.1
2026-08-27
- New
- Fixv1.0.2
2026-06-18
- Fix1.0.1
2025-12-17
- Improved1.0.0 release
2025-10-24
Badge
Maintain this server? Add the live badge to your README.