CI/CD plugins · REST API

Enterprise CI/CD integrations for API testing

First-party plugins for Jenkins and Azure DevOps, plus a public REST API that works with GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, and any other pipeline that can make an HTTP call. Quality gates and audit-ready JSON results everywhere (JUnit XML on the Jenkins/Azure DevOps plugins), on-prem and air-gapped support.

Book DemoSee pricing

Why integrate Total Shift Left with your pipeline?

Move API quality checks earlier in your delivery process. Catch failures before they merge — automatically.

Quality gates in every build

Set pass-rate thresholds and error-test policies so broken APIs never reach production. Gate results map directly to your pipeline step status.

Structured results, everywhere

JSON results from every integration path; the Jenkins and Azure DevOps plugins also publish XML for native test-result tabs — all written to your workspace automatically.

Zero-friction setup

Install the plugin, add your credentials, and start testing. No custom scripts, no CLI dependencies, no learning curve.

GitHub Repository

All integrations in one place

Browse the Jenkins and Azure DevOps plugin packages at Total-Shift-Left/Shift-Left-API-Integrations. Download the latest builds (HPI, VSIX), review changelogs, and open issues or feature requests. Other CI/CD tools connect via the public REST API below — there is no packaged artifact for those yet.

View on GitHub

Available integrations

First-party plugins for Jenkins and Azure DevOps, a REST API pattern for every other CI/CD tool, and an MCP server that's still in development.

Jenkins

Available

Add Total Shift Left into Jenkins Freestyle jobs with minimal setup.

  • Build step for Freestyle projects with full UI configuration
  • One-click Test Connection to verify credentials
  • Configurable quality gate with pass threshold and error-test checks
  • XML and JSON summary workspace artifacts
  • Build sidebar link with execution summary
View integration details

GitHub Actions

REST API

Trigger test packs via the REST API — no packaged GitHub Action yet.

  • Call the public REST API from a workflow step with a few lines of YAML
  • Quality gate logic (exit non-zero) can block PR merges via branch protection
  • Parse the JSON results endpoint into your own PR summary step
  • Works across parallel/matrix jobs since it is a plain HTTP call
  • Self-hosted runner support for air-gapped Shift-Left deployments
View integration details

Azure DevOps

Available

Run Total Shift Left test packs directly inside Azure Pipelines.

  • Trigger test run packs via the ShiftLeft public API
  • Quality gates with configurable pass thresholds
  • XML and JSON summary artifact output
  • Output variables for downstream pipeline steps
  • Multi-tenant support with optional Tenant ID
View integration details

GitLab CI

REST API

Trigger test packs via the REST API from any GitLab Runner — no packaged plugin yet.

  • Call the public REST API from a `.gitlab-ci.yml` job with curl or any HTTP client
  • Protected, masked CI/CD variables keep credentials out of job logs
  • Works with parallel:matrix jobs since it is a plain HTTP call
  • Works with self-managed GitLab + self-hosted Shift-Left in air-gapped environments
  • Wire the gate result into a "Pipelines must succeed" merge check yourself
View integration details

CircleCI

REST API

Trigger test packs via the REST API from any CircleCI job — no packaged orb yet.

  • Call the public REST API from a `run` step with curl or any HTTP client
  • Parse the JSON results yourself if you want them in the CircleCI Tests tab
  • CircleCI Context-secured credentials for org-wide scoping
  • Self-hosted runner support for firewalled Shift-Left deployments
  • Works across parallel jobs or shards since it is a plain HTTP call
View integration details

Bitbucket Pipelines

REST API

Trigger test packs via the REST API from Bitbucket Cloud Pipelines — no packaged pipe yet.

  • Call the public REST API from a pipeline step with curl or any HTTP client
  • Workspace and repository variables for credential scoping
  • Wire the gate result into a "Require successful builds" merge check yourself
  • Self-hosted runner support for air-gapped environments
  • Works across parallel steps since it is a plain HTTP call
View integration details

MCP Server (Claude, Cursor, AI Agents)

In development

Model Context Protocol server — in development, not shipped yet.

  • Planned: tool calls for generating tests, explaining coverage gaps, and validating results
  • Planned: resources exposing coverage, gaps, schema, and output data to the agent
  • Intended to work with Claude Desktop, Cursor, and other MCP-compatible clients
  • No legacy enterprise platform (ReadyAPI, Tosca, Parasoft) ships an MCP server today either
  • Use the public REST API from your agent today — see below for a working example
View integration details

Self-Hosted LLM (Ollama, LM Studio, vLLM)

Available

Point AI test generation at a model you run — nothing leaves your perimeter.

  • Quick-fill base URLs for Ollama, LM Studio, and vLLM in AI Settings
  • Any OpenAI-compatible endpoint works — not limited to these three
  • Optional embedding model for offline RAG / semantic search
  • Test Connection verifies the model before you save
  • Enterprise plan capability
View integration details

Public REST API

No native plugin? Use the REST API from any CI/CD tool

Every Total Shift Left action the plugins perform is available as a public REST endpoint. If your pipeline can make an HTTP call, it can trigger test packs, apply quality gates, and fetch results — GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, Bamboo, TeamCity, AWS CodeBuild, or any custom runner.

  • Authenticate with email and password to obtain a bearer token
  • Trigger a test run pack and receive an execution ID
  • Poll execution status and retrieve full results
  • Download JSON results for your pipeline (Jenkins and Azure DevOps also get XML)
  • Apply your own quality gate logic with pass-rate thresholds
View API referenceRequest an integration
trigger-test-pack.sh
# 1. Login and grab the bearer token
TOKEN=$(curl -s -X POST \
  "$SHIFTLEFT_URL/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"'"$EMAIL"'","password":"'"$PWD"'"}' \
  | jq -r .token)

# 2. Trigger a test run pack
EXEC_ID=$(curl -s -X POST \
  "$SHIFTLEFT_URL/api/v1/test-packs/$PACK_ID/run" \
  -H "Authorization: Bearer $TOKEN" \
  | jq -r .executionId)

# 3. Poll for completion and fetch results
curl -s \
  "$SHIFTLEFT_URL/api/v1/executions/$EXEC_ID" \
  -H "Authorization: Bearer $TOKEN"

Get started in three steps

1

Install the plugin or wire up the API

VSIX (Azure DevOps) or HPI (Jenkins) for a packaged install. For GitHub Actions, GitLab CI, CircleCI, and Bitbucket Pipelines, call the public REST API from a pipeline step instead — one-time setup per CI tool.

2

Configure credentials

Add your Total Shift Left email and password as scoped secrets — protected GitHub Secrets, GitLab CI/CD variables, CircleCI Contexts, or Bitbucket secured variables.

3

Run in your pipeline

Add the build step, job, or API call, pick a test pack, set your quality gate, and let CI handle the rest. The Jenkins and Azure DevOps plugins return JUnit XML and JSON artifacts; the REST API returns JSON.

Integration FAQs

Contact us at

info@totalshiftleft.com

to learn more

  • Which CI/CD integrations does Total Shift Left support?
    Two first-party plugins today: Jenkins (Java/Maven HPI) and Azure DevOps (VSTS task/VSIX). Both integrate the test run lifecycle (trigger, poll, JUnit/JSON artifact) and support quality gates as native, installable artifacts. Every other CI/CD tool — GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, Bamboo, TeamCity, and anything else that can make an HTTP call — connects through the public REST API rather than a packaged plugin. See the REST API section below for the pattern.
  • Do I need a Total Shift Left account to use the plugins?
    Yes. The plugins authenticate against your Total Shift Left instance using the public REST API. You need a user account with permission to call the CI/CD API endpoints. For production use, create a dedicated service account with project-scoped permissions.
  • Can I run tests against private or internal APIs?
    Yes. As long as the CI/CD agent or runner has network access to your Total Shift Left server URL, tests will execute normally. For self-hosted Shift-Left deployments behind a corporate firewall, run the CI/CD job on a self-hosted runner inside the same network. The same pattern applies whether you use the Jenkins/Azure DevOps plugins or call the REST API directly.
  • What happens when a quality gate fails?
    You control the outcome. Each plugin exposes a pass-rate threshold and an ERROR-test policy — either failing causes the pipeline step to exit non-zero, which fails the job. Combine with branch protection rules in your VCS to block PR/MR merges on quality regressions. The gate decision is also available as an output variable for downstream logic.
  • What is the MCP server, and why does it matter?
    The Model Context Protocol is an open standard introduced by Anthropic in late 2024 that lets AI agents drive external systems through a tool/resource interface. A native MCP server for Total Shift Left is in development — it is not available today, and we don’t have a public ship date yet. The goal is to let Claude Desktop, Cursor, and other MCP-compatible agents drive test generation, coverage analysis, and execution from inside the conversation. In the meantime, the public REST API can be wired into any agent framework that supports custom HTTP tool calls. See the dedicated MCP page for details on what’s planned.
  • Is there a cost for the CI/CD plugins and MCP server?
    The Jenkins and Azure DevOps plugins are free to install; you need an active Total Shift Left subscription to run tests. The REST API is included with your subscription — no separate plugin cost for GitHub Actions, GitLab CI, CircleCI, Bitbucket Pipelines, or any other tool. The MCP server hasn’t shipped yet, so pricing and tier gating for it haven’t been decided.
  • Can I use Shift-Left from a CI/CD tool that's not on the list?
    Yes. Every action the plugins perform is available via the public /api/v1 REST API. Bamboo, TeamCity, AWS CodeBuild, Buildkite, Drone, custom runners — anything that can make HTTP calls can trigger test packs, apply quality gates, and fetch results. See the public REST API section below for code examples.

Ready to automate API testing in your pipeline?

Start your free 15-day trial. Install a plugin and run your first test pack in minutes.

Start TrialBook Demo