
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
@loadmill/test-mcp
Advanced tools
What's test-mcp? • Installation • Getting Started • Configuration & Test Format • How to Run • CLI Flags • Test Discovery • Interactive Mode • Roadmap • Contributing • License
test-mcp is a headless MCP client for automated testing of MCP servers and agents.
If you’re building an MCP server or agent, test-mcp lets you run natural-language test scripts and assertions end-to-end, so you can validate behavior in a fast and repeatable way.
https://github.com/user-attachments/assets/c4e5295b-7217-47f2-96d9-76befcea8b21
test-mcp gives you three core components:
Together, these let you automate and validate MCP server behavior with simple, repeatable tests.
Supported Transports & Providers:
# using npm
npm install -g @loadmill/test-mcp
# or with pnpm
pnpm add -g @loadmill/test-mcp
[!NOTE]
Whiletest-mcpitself can run on Node.js 18 or higher, many popular MCP servers require Node.js 20.
For the smoothest experience, we recommend using Node.js 20.
When running from source:
git clone https://github.com/loadmill/test-mcp
cd test-mcp
npm install
# For OpenAI (default example)
echo "OPENAI_API_KEY=your_api_key_here" > .env
# Or for Anthropic
echo "ANTHROPIC_API_KEY=your_api_key_here" > .env
npm run build
To try test-mcp quickly with the included examples:
# from source
node build/index.js
This will run a demonstration that shows both local STDIO and remote HTTP MCP servers working together. The test rolls a local dice server and queries a remote MCP server registry.
1) Example config (mcp.config.json)
{
"mcpClient": {
"provider": "openai",
"model": "gpt-4o-mini",
"api_key": "${env:OPENAI_API_KEY}"
},
"mcpServers": {
"loadmill": {
"type": "stdio",
"command": "npx",
"args": ["@loadmill/mcp"],
"env": {
"LOADMILL_API_TOKEN": "${env:LOADMILL_API_TOKEN}"
}
}
}
}
OpenAI is also supported - see configuration variations in the examples/ folder.
2) Example test (tests/bank-transaction.test.yaml)
description: "Maker Checker Bank - Transaction Creation and Rejection Flow"
steps:
- prompt: "Login with username alice and password alice123 and transfer $100 to Bob"
- prompt: "Login with username bob and password bob456, reject transaction from Alice"
- assert: "Validate the transaction was created and rejected successfully"
By default, test-mcp looks for mcp.config.json in the project root and runs tests in the tests/ folder.
Globally installed:
test-mcp
From source:
node build/index.js
Point to a specific config or tests directory:
test-mcp --config mcp.config.json --tests-dir ./tests
Options:
-c, --config <file> Path to config file (default: mcp.config.json)
-t, --tests-dir <dir> Directory containing test files (default: tests)
-i, --interactive Run in interactive chat mode
--trace Enable detailed tracing output
-h, --help Show help
All files ending in .test.yaml under the tests/ directory are executed.
Recursive discovery and full glob patterns are planned for later.
Run the client without tests and chat with your MCP servers:
test-mcp -i
stdio transporthttp transport${}Contributions, ideas, and bug reports are welcome! See CONTRIBUTING.md.
Apache License 2.0 © Loadmill
FAQs
Headless MCP client for automated testing
The npm package @loadmill/test-mcp receives a total of 0 weekly downloads. As such, @loadmill/test-mcp popularity was classified as not popular.
We found that @loadmill/test-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.