Visual QA workspace
Author in plain language, run a suite, then open the HTML report or publish it to a shareable URL — export, timeline, and history in one place.
Test MCP servers in natural language.
MCP Rigor is an open-source, deterministic, black-box test framework for Model Context Protocol servers — built for QA teams, developers, and product owners.
An open-source project proudly funded by LoopIQ.
Test: "An active customer can be found"
Call tool "find_customer" with:
customerId: "C-100"
Expect "structuredContent.status" equals "active"No test code. No AI interpretation. The same sentence always compiles into the same test.
See it run
From visual QA to agent-driven testing — every path uses the same deterministic runtime.
MCP server for AI agents
An agent connects to mcprigor serve, validates a suite, runs it, and receives structured results.
CLI and CI
Check the wording, convert English to equivalent YAML, run against a live server, and publish evidence — from any terminal or pipeline.
For QA
Write tests that read like acceptance criteria in a local browser workspace with autocomplete, batch runs, run history, and pass-rate trends.
For AI agents
Expose MCP Rigor as an MCP server with mcprigor serve — coding agents write, validate, and run deterministic tests for the MCP servers they build.
For developers
Contract locks with SHA-256 fingerprints, classified drift reports, sanitized traces, semantic snapshots, and stable error codes.
Performance governance
Fail slow calls immediately, enforce p50/p95 budgets over recorded history, and block latency regressions in CI without maintaining a separate baseline file. Performance guide →
Deterministic security audit
Probe malformed requests, spoofed tools, oversized payloads, path traversal, prompt injection, and secret exposure — then export a scored rich PDF. Audit guide →
Multi-server compositions
Route scenarios across a mounted MCP fleet, detect tool/schema collisions, and gate combined contract drift with one stable composition lock. Composition guide →
GitHub Action
Run suites and drift in CI, publish a rich job summary, and update one PR comment with pass tables, drift details, flaky warnings, and failures. Action guide →
Coverage gate
Find untested tools, prompts, resources, templates, properties, and enum/union branches; enforce --fail-under 80. Coverage guide →
Production monitoring
Schedule HTTP MCP tests, feed existing trends and performance baselines, and notify webhooks on failures and recoveries. Monitoring guide →
Session timeline
Every HTML report embeds a clickable HAR-style timeline: one row per JSON-RPC call with durations, request params, and response bodies. Evidence guide →
Shareable hosted reports
mcprigor publish turns a run into a static report URL on your own Netlify site — redacted first, gated by your hosting access. Publishing guide →
For product owners
Readable tests double as living acceptance criteria, and evidence bundles prove what was tested, against which server, and when.
Transport parity
Run the same scenario against a local stdio server and a deployed Streamable HTTP endpoint and see exactly where behavior differs.
Data-driven
Tables, CSV, JSON, YAML, Excel, REST, and Google Sheets — with typed columns, filters, joins, and seeded sampling.
Safe by default
Remote data and custom code are opt-in. Reports are sanitized and secrets are redacted centrally.
Install and run in one minute
npm install mcprigor
npx mcprigor init tests/acceptance.mcpr
npx mcprigor check tests/acceptance.mcpr
npx mcprigor test tests/acceptance.mcpr --html report.html
npx mcprigor serve . # expose as an MCP server for AI agentsPublished on npm with compiled code — no build from source. Tests use the .mcpr extension and compile to the same runtime model as YAML.
Backed by LoopIQ
MCP Rigor is funded and supported by LoopIQ, the AI-Native governance platform for software releases. LoopIQ connects requirements to runnable tests; MCP Rigor executes them deterministically with auditable evidence — one thread from requirement → test → execution → proof.
Frequently asked questions
What is MCP Rigor?
MCP Rigor is an open-source, deterministic, black-box test framework for Model Context Protocol (MCP) servers. QA teams write tests in natural language (.mcpr files); developers get contract locks, drift detection, evidence bundles, and transport parity. It is funded by LoopIQ.
How do I test an MCP server?
Install with npm install mcprigor, create a test with npx mcprigor init tests/acceptance.mcpr, validate it with npx mcprigor check, and run it with npx mcprigor test. Tests call tools, read resources, and get prompts, then assert on response fields.
Does MCP Rigor use AI to interpret tests?
No. The natural-language wording compiles deterministically — the same sentence always produces the same test. No AI model interprets the wording, which keeps runs repeatable in CI.
What transports does MCP Rigor support?
Local stdio subprocesses and deployed Streamable HTTP servers. Transport parity mode runs the same scenario against both and reports semantic differences.
How do I test an MCP server that requires authentication?
Point the suite at the Streamable HTTP endpoint and pass credentials as headers, using ${env.NAME} placeholders so no secret lives in the test file — for example Authorization: "Bearer ${env.QA_TOKEN}". API keys and custom headers work the same way, short-lived OAuth tokens can be fetched at run time with Token from, and for servers that need a real user login, OAuth: oauth runs an interactive browser authorization-code flow once and carries the refreshed session into every test. Every resolved token is redacted from reports. See the Authentication guide.
What is the .mcpr file extension?
MCP Rigor natural-language tests use the .mcpr extension — short for MCP Rigor. A .mcpr file contains readable test scenarios that compile deterministically to the same runtime model as YAML.
Is MCP Rigor free?
Yes. MCP Rigor is open source under the Apache-2.0 license, funded and supported by LoopIQ, the AI-Native governance platform for software releases.
Who is MCP Rigor for?
QA engineers who want natural-language MCP tests, developers who need contract drift detection and debugging evidence, and product owners who want readable acceptance criteria with auditable proof.
Can MCP Rigor enforce MCP performance budgets?
Yes. Tests can set per-call latency limits, suite-level percentile budgets such as p95 over 20 calls, and a CI regression gate that compares current latency with recorded history.
Can MCP Rigor audit MCP server security?
Yes. The deterministic audit pack probes malformed requests, tool-name spoofing, oversized payloads, resource path traversal, prompt injection, and secret-canary exposure. Tool execution requires an explicit allowlist.
Can MCP Rigor test multiple MCP servers together?
Yes. Named-server compositions route tests to individual servers, detect tool and schema collisions across the mounted fleet, and create combined contract locks for fleet drift gates.
Does MCP Rigor have a GitHub Action?
Yes. The composite Action runs suites and contract drift, adds flaky-history warnings, writes a rich job summary, and creates or updates one pull-request comment.
How does MCP Rigor measure test coverage?
Coverage compares test references with the live discovered MCP contract: tools, resources, resource templates, prompts, input properties, enums, and union branches. CI can enforce a minimum score.
Can MCP Rigor continuously monitor a production MCP server?
Yes. Monitoring repeatedly runs a Streamable HTTP suite, appends results to trend history, and sends JSON webhooks on failures, recoveries, changes, or every run.
Can MCP Rigor show the raw requests and responses of a test run?
Yes. HTML reports embed a clickable HAR-style session timeline: every JSON-RPC call with its duration, request parameters, and response body, redacted before rendering.
Can MCP Rigor share test reports outside CI?
Yes. mcprigor publish deploys the HTML report to your own static hosting and prints a shareable URL, or writes a local bundle for any static host.