MCP Server

Status: available

Availability: Professional, Trial and Enterprise. The free Citizen Developer edition does not include the MCP server.

The MCP server for AI agents shipped in the September 2026 release (build 2.0.96.231). It lets you connect Claude, Cursor, or another client that speaks the Model Context Protocol (MCP) to Shift-Left API.

See the September 2026 release notes for the full list of changes in that build.

How it works

The MCP server has two parts:

• The MCP surface on your server. Your Shift-Left API installation (cloud or self-hosted) answers MCP tool calls over HTTPS. It is switched on by the edition, not by a setting.
• A small local client that your AI client starts on your computer. Claude Desktop, Cursor and other MCP clients talk to it over stdio, and it calls your server with a platform API key.

The agent can do only what the key allows. A key's permissions are its scopes intersected with the permissions of the person who created it, so an agent never has more access than that person. Each key is limited to 300 requests every 5 minutes.

Note: The client is not published on npm yet, so an npx install command will not work. Until it is, run the client from a local copy; contact support if you do not have one.

Set it up

1. Go to Settings → Integrations → AI Agents (MCP). On the free Citizen Developer edition this screen shows an upgrade notice instead.
2. Create the key. The screen creates an API key with the scopes the MCP tools need and prints the client configuration.
3. Paste the printed configuration into your MCP client (for example Claude Desktop or Cursor). It sets SLS_BASE_URL (your server's address) and SLS_API_KEY (the key).
4. Restart the MCP client and ask it to list your projects to check the connection.

The client refuses a plain http:// server address unless you set SLS_ALLOW_INSECURE=true. Use HTTPS for anything other than a local test installation.

What an agent can do

The server gives an agent 17 tools, 3 resources and 4 prompts.

• Resources: the coverage and the gaps of a project, and the status of a run (tsl://project/{id}/coverage, tsl://project/{id}/gaps, tsl://run/{jobId}).
• Prompts: build a suite from a spec, show what is untested, run a smoke test, and triage failures.
• generate_tests uses the deterministic generator by default, with no AI model involved, and takes up to 100 endpoints per call.
• The performance and security tools also need the matching paid add-on (performance, security) or a Trial.

Safety

• Production is refused. A run against an environment marked as production is refused unless the tool call asks for it and the client is started with SLS_ALLOW_PRODUCTION_RUNS=true.
• Security runs need their own permission. An agent can start a security run only if its key has the separate run-security-checks permission. The run passes the same checks as the Run button, and production is refused.
• No load tests. An agent can read load runs and reports but cannot start a load test.
• Read-only mode. Start the client with SLS_READ_ONLY=true to give an agent read access only.
• Local AI only. MCP_REQUIRE_LOCAL_AI keeps any AI-assisted generation on a self-hosted model.
• Each tool is marked read-only or destructive, so your MCP client can ask before calling the destructive ones. Results are capped at 25 KB per call.

Limits

• The client runs on your computer over stdio. There is no hosted remote MCP endpoint to point an agent at.
• The free Citizen Developer edition does not include the MCP server or API keys.
• Revoking the key in Settings → Access & Identity → API Keys disconnects the agent on its next call.

MCP server vs. JSON-RPC 2.0 / MCP testing

The same release also added JSON-RPC 2.0 and MCP testing. The two are different features:

• MCP server (this article): an AI agent connects to Shift-Left API and works with it.
• JSON-RPC 2.0 / MCP testing: Shift-Left API tests your JSON-RPC service or MCP server, discovering its tools as testable endpoints. Available in Trial and Enterprise editions.

Alternative: the Public API

If you would rather drive Shift-Left API from a script, pipeline, or an agent framework that makes plain HTTP calls, use the Public API: authenticate, trigger test runs, poll status, and fetch results.

Related articles

• Release notes
• API keys
• Generate endpoint test cases
• Coverage and fidelity
• Public API
• AI Settings