
Security News
GPT-6 Astra Attempts Supply Chain Attacks Against Open Source Maintainers in Testing
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
@shiplightai/mcp
Advanced tools
UI automation MCP for agentic development workflows. Lets AI coding agents (Claude Code, Cursor, Windsurf, etc.) verify the UI changes they make — closing the build-verify loop automatically. Every interaction is captured as a human-readable step, producing rerunnable regression tests.
claude mcp add shiplight -e PWDEBUG=console -- npx -y @shiplightai/mcp@latest
Add to your MCP config (e.g., .cursor/mcp.json):
{
"mcpServers": {
"shiplight": {
"command": "npx",
"args": ["-y", "@shiplightai/mcp@latest"]
}
}
}
| Variable | Required | Description |
|---|---|---|
PWDEBUG | Yes | Must be set to console. Enables Playwright semantic locator generation (e.g., getByRole, getByTestId) for action entities. Without this, only XPath locators are available. |
ANTHROPIC_API_KEY | One AI key required | Anthropic API key (for Claude models) |
GOOGLE_API_KEY | One AI key required | Google AI API key (for Gemini models) |
SHIPLIGHT_API_TOKEN | No | Shiplight cloud API token (enables cloud features) |
At least one AI API key is needed for the test execution agent. The model is auto-detected from the key (ANTHROPIC_API_KEY → claude-haiku-4-5, GOOGLE_API_KEY → gemini-2.5-pro).
Pass environment variables through your MCP config:
{
"mcpServers": {
"shiplight": {
"command": "npx",
"args": ["-y", "@shiplightai/mcp@latest"],
"env": {
"PWDEBUG": "console",
"ANTHROPIC_API_KEY": "sk-ant-..."
}
}
}
}
The server resolves environment variables in this order:
.env file in the current working directory where the MCP server startsExisting environment variables are never overridden by .env, so project-local .env values act as a fallback.
Once connected, your AI coding agent can:
.test.yaml files for fast, deterministic replaySHIPLIGHT_API_TOKEN is set).test.yaml files locallyFAQs
Shiplight MCP server for AI-powered test automation
The npm package @shiplightai/mcp receives a total of 598 weekly downloads. As such, @shiplightai/mcp popularity was classified as not popular.
We found that @shiplightai/mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.

Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.