CI/CD plugins · REST API

Enterprise CI/CD integrations for API testing

Name: Total Shift Left
Brand: Total Shift Left
Availability: InStock

A first-party GitHub Action, Jenkins plugin and Azure DevOps task, plus a public REST API for any other pipeline that can make an HTTP call. Quality gates, JSON summaries and JUnit XML — with on-prem and air-gapped support throughout.

Book Demo See pricing

Why integrate Total Shift Left with your pipeline?

Move API quality checks earlier in your delivery process. Catch failures before they merge — automatically.

Quality gates in every build

Set pass-rate thresholds and error-test policies so broken APIs never reach production. Gate results map directly to your pipeline step status.

Structured results, everywhere

A JSON summary and JUnit XML from every packaged integration, written to your workspace automatically and ready for your CI’s native test-results tab. The REST API returns the same JSON.

One runner, identical behaviour

The GitHub Action, Azure DevOps task, CircleCI orb, Bitbucket pipe and GitLab component are thin adapters over a single shared implementation — so the same inputs produce the same gate decision on every platform.

GitHub Repository

Every integration, source included

Total-Shift-Left/Shift-Left-API-Integrations holds the full source for the GitHub Action, Jenkins plugin, Azure DevOps task, CircleCI orb, Bitbucket pipe and GitLab component — plus the shared runner they all call. MIT licensed. Read exactly how your builds are graded, open an issue, or send a pull request. Packaged builds (HPI, VSIX) are attached to release tags so they cannot drift from the source beside them.

View on GitHub

Available integrations

Install the GitHub Action, Jenkins plugin or Azure DevOps task today. The CircleCI orb, Bitbucket pipe and GitLab component are public in source but not yet on their registries — those platforms use the REST API pattern below for now. The MCP server for AI agents is available as of the September 2026 release.

Jenkins

Available

Add Total Shift Left into Jenkins Freestyle jobs with minimal setup.

Build step for Freestyle projects with full UI configuration
One-click Test Connection to verify credentials
Configurable quality gate with pass threshold and error-test checks
JUnit XML and JSON summary workspace artifacts
Full Java plugin source is public; build the HPI yourself or take a release

View integration details

GitHub Actions

Available

One step in your workflow — the first-party action runs a pack and gates the build.

Add it with uses: Total-Shift-Left/Shift-Left-API-Integrations/github-actions@v1
Runs on node20 from a pre-built bundle — no install or build step in your workflow
Quality gate exits non-zero, so branch protection blocks the PR merge
JSON summary and JUnit XML written to the workspace on every run
decision, success_rate and execution_id exposed as step outputs

View integration details

Azure DevOps

Available

Run Total Shift Left test packs directly inside Azure Pipelines.

Installed from the Visual Studio Marketplace, then added as a pipeline task
Quality gates with configurable pass thresholds
JUnit XML and JSON summary artifact output
Output variables for downstream pipeline steps
Multi-tenant support with optional Tenant ID

View integration details

GitLab CI

Source available

CI/CD component written and public — not in the GitLab catalog yet. Use the REST API today.

Component source is public and wraps the same runner as every other integration
Not yet in the GitLab CI/CD Catalog, so an include: component: reference will not resolve
Today: call the public REST API from a `.gitlab-ci.yml` job with curl or any HTTP client
Protected, masked CI/CD variables keep credentials out of job logs
Works with self-managed GitLab + self-hosted Shift-Left in air-gapped environments

View integration details

CircleCI

Source available

Orb written and public — not on the CircleCI registry yet. Use the REST API today.

Orb source is public and wraps the same runner as every other integration
Not yet on the CircleCI registry, so totalshiftleft/shiftleft@1.0.0 will not resolve
Today: call the public REST API from a `run` step with curl or any HTTP client
CircleCI Context-secured credentials for org-wide scoping
Self-hosted runner support for firewalled Shift-Left deployments

View integration details

Bitbucket Pipelines

Source available

Pipe written and public — image not on Docker Hub yet. Use the REST API today.

Pipe source is public and wraps the same runner as every other integration
Image not yet on Docker Hub, so a pipe: totalshiftleft/... reference will not resolve
Today: call the public REST API from a pipeline step with curl or any HTTP client
Secured workspace and repository variables for credential scoping
Self-hosted runner support for air-gapped environments

View integration details

MCP Server (Claude, Cursor, AI Agents)

Available

Model Context Protocol server — connect Claude, Cursor, or another MCP client.

Shipped in the September 2026 release (build 2.0.96.231)
Connect Claude, Cursor, or another MCP client to Shift-Left Studio
Separate from JSON-RPC 2.0 / MCP testing, which tests your own MCP server
No legacy enterprise platform (ReadyAPI, Tosca, Parasoft) ships an MCP server today
The public REST API remains available for agents and scripts — see below for a working example

View integration details

Self-Hosted LLM (Ollama, LM Studio, vLLM)

Available

Point AI test generation at a model you run — nothing leaves your perimeter.

Quick-fill base URLs for Ollama, LM Studio, and vLLM in AI Settings
Any OpenAI-compatible endpoint works — not limited to these three
Optional embedding model for offline RAG / semantic search
Test Connection verifies the model before you save
Enterprise plan capability

View integration details

Public REST API

No native plugin? Use the REST API from any CI/CD tool

Everything the packaged integrations do is available as a public REST endpoint. If your pipeline can make an HTTP call, it can trigger test packs, apply quality gates, and fetch results — GitLab CI, CircleCI, Bitbucket Pipelines, Bamboo, TeamCity, AWS CodeBuild, Buildkite, Drone, Harness, Tekton, Argo, or any custom runner.

Authenticate with email and password to obtain a bearer token
Trigger a test run pack and receive an execution ID
Poll execution status and retrieve full results
Download JSON results for your pipeline (packaged integrations also write JUnit XML)
Apply your own quality gate logic with pass-rate thresholds

View API reference Request an integration

trigger-test-pack.sh

# 1. Login and grab the bearer token
TOKEN=$(curl -s -X POST \
  "$SHIFTLEFT_URL/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"'"$EMAIL"'","password":"'"$PWD"'"}' \
  | jq -r .token)

# 2. Trigger a test run pack
EXEC_ID=$(curl -s -X POST \
  "$SHIFTLEFT_URL/api/v1/test-packs/$PACK_ID/run" \
  -H "Authorization: Bearer $TOKEN" \
  | jq -r .executionId)

# 3. Poll for completion and fetch results
curl -s \
  "$SHIFTLEFT_URL/api/v1/executions/$EXEC_ID" \
  -H "Authorization: Bearer $TOKEN"

Get started in three steps

Add the integration

A one-line uses: step on GitHub Actions. The Marketplace extension on Azure DevOps, or the HPI on Jenkins. For GitLab CI, CircleCI and Bitbucket Pipelines, call the public REST API from a pipeline step until the packaged versions publish.

Configure credentials

Add your Total Shift Left email and password as scoped secrets — encrypted GitHub Secrets, protected GitLab CI/CD variables, CircleCI Contexts, or Bitbucket secured variables. Never inline them in pipeline YAML.

Run in your pipeline

Pick a test pack, set your pass-rate threshold, and let CI handle the rest. The packaged integrations write JUnit XML and a JSON summary into the workspace and exit non-zero when the gate fails; the REST API returns the same JSON.

Integration FAQs

info@totalshiftleft.com

to learn more

Which CI/CD integrations does Total Shift Left support?
Three you can install today: a GitHub Action, the Jenkins plugin (Java/Maven HPI) and the Azure DevOps task (VSTS task/VSIX, on the Visual Studio Marketplace). Each runs the full test-run lifecycle — trigger, poll, quality gate, JUnit and JSON artifacts. A CircleCI orb, a Bitbucket pipe and a GitLab CI/CD component are written and public in source, but have not been pushed to their registries yet, so those platforms use the public REST API for now. So does anything else that can make an HTTP call — Bamboo, TeamCity, AWS CodeBuild, Buildkite, Drone, Harness, Tekton, Argo. See the REST API section below for the pattern.
Do I need a Total Shift Left account to use the plugins?
Yes. The plugins authenticate against your Total Shift Left instance using the public REST API. You need a user account with permission to call the CI/CD API endpoints. For production use, create a dedicated service account with project-scoped permissions.
Can I run tests against private or internal APIs?
Yes. As long as the CI/CD agent or runner has network access to your Total Shift Left server URL, tests will execute normally. For self-hosted Shift-Left deployments behind a corporate firewall, run the CI/CD job on a self-hosted runner inside the same network. The same pattern applies whether you use the Jenkins/Azure DevOps plugins or call the REST API directly.
What happens when a quality gate fails?
You control the outcome. Every integration exposes a pass-rate threshold and an ERROR-test policy — either failing causes the pipeline step to exit non-zero, which fails the job. Set gate-failure-result to succeeded-with-issues if you would rather warn than block. Combine with branch protection rules in your VCS to block PR/MR merges on quality regressions. The gate decision is also available as an output variable for downstream logic, as one of PASSED, GATE_FAIL_THRESHOLD, GATE_FAIL_ERROR_TESTS, FAILED, COMPLETED_WITH_ISSUES, OK, TIMEOUT or TRIGGER_ONLY.
Do the integrations behave the same on every CI platform?
Yes, by construction. The GitHub Action, Azure DevOps task, CircleCI orb, Bitbucket pipe and GitLab component are thin adapters over one shared runner package — each supplies a small object for reading inputs and writing outputs, and nothing else. The same inputs produce the same gate decision and the same artifacts everywhere. The Jenkins plugin is the one exception: it is an independent Java implementation of the same documented contract.
Why not just call the REST API with a curl script?
You can, and it is a perfectly good option. One caveat worth knowing: the status endpoint reports a test pack’s most recent execution, and the run endpoint returns before the scheduler has claimed the pack — so a script that polls immediately can read the previous run’s result and pass a build whose new run has not started. The packaged integrations record the execution id before triggering and only grade the run once that id changes. If you roll your own, guard against that case.
What is the MCP server, and why does it matter?
The Model Context Protocol is an open standard introduced by Anthropic in late 2024 that lets AI agents drive external systems through a tool/resource interface. Total Shift Left’s MCP server shipped in the September 2026 release (build 2.0.96.231): it lets you connect Claude, Cursor, or another MCP client to Shift-Left Studio, so the agent can work with the platform from inside the conversation. The public REST API also remains available to any agent framework that supports custom HTTP tool calls. See the dedicated MCP page and the release notes for details.
Is there a cost for the CI/CD plugins and MCP server?
Every integration is free to install and MIT-licensed; you need an active Total Shift Left subscription to run tests. The REST API is included with your subscription — no separate plugin cost for GitLab CI, CircleCI, Bitbucket Pipelines, or any other tool. For which plans include the MCP server, see the pricing page or ask your account contact.
Can I use Shift-Left from a CI/CD tool that's not on the list?
Yes. Every action the plugins perform is available via the public /api/v1 REST API. Bamboo, TeamCity, AWS CodeBuild, Buildkite, Drone, custom runners — anything that can make HTTP calls can trigger test packs, apply quality gates, and fetch results. See the public REST API section below for code examples.

Ready to automate API testing in your pipeline?

Start your free 15-day trial. Install a plugin and run your first test pack in minutes.

Start Trial Book Demo