
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@blackwell-systems/jest-mcp-assert
Advanced tools
Jest integration for mcp-assert: run MCP server assertion YAML files as Jest tests
Jest integration for mcp-assert. Run MCP server assertion YAML files as Jest tests.
Same YAML files work across Jest, Vitest, pytest, and the CLI.
npm install -D @blackwell-systems/jest-mcp-assert @blackwell-systems/mcp-assert
// mcp.test.ts
import { describeMcpSuite } from '@blackwell-systems/jest-mcp-assert'
describeMcpSuite('my mcp server', 'evals/')
Each YAML file in evals/ becomes a Jest test case.
import { runMcpAssert } from '@blackwell-systems/jest-mcp-assert'
test('echo tool returns message', () => {
runMcpAssert('evals/echo.yaml')
})
test('greet tool with timeout', () => {
runMcpAssert('evals/greet.yaml', { timeout: '60s' })
})
runMcpAssert('evals/echo.yaml', {
timeout: '30s', // per-assertion timeout
fixture: 'test/fixtures', // {{fixture}} substitution
server: 'node server.js', // server override
binary: '/path/to/mcp-assert', // explicit binary path
})
@blackwell-systems/jest-mcp-assert is a thin bridge (~100 lines). It shells out to the mcp-assert Go binary with --json, parses the result, and maps it to Jest pass/fail outcomes. The Go binary handles all MCP protocol logic.
Binary resolution (in order):
binary optionmcp-assert on PATH (brew, go install, curl install)@blackwell-systems/mcp-assert npm packageAssertions are YAML files. See the mcp-assert docs for the full reference.
name: echo returns the input message
server:
command: node
args: ["server.js"]
assert:
tool: echo
args:
message: "hello"
expect:
not_error: true
contains: ["hello"]
MIT
FAQs
Jest integration for mcp-assert: run MCP server assertion YAML files as Jest tests
We found that @blackwell-systems/jest-mcp-assert demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.