
Research
/Security News
77 Firefox Extensions Linked to Crypto Wallet and Credential Theft
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.
validoria-mcp
Advanced tools
MCP server for Teste.no — continuous testing control center for websites, APIs, and webshops. Thin proxy to the Teste.no MCP endpoint.
MCP (Model Context Protocol) server for Teste.no — a continuous testing control center for websites, APIs, and webshops.
This package is a thin stdio client that connects Cursor, Claude, or any MCP-compatible host to your Teste.no instance via the tRPC API. It does not embed a database or queue — it calls your Teste.no API over HTTP with a Bearer token.
In Teste.no, go to Settings → API Keys and create a token with the scopes you need:
read — list targets, findings, incidents, runs, statswrite — trigger tests, manage incidents, record deploymentsadmin — create/update/delete targets, muting rules, system healthAdd to ~/.cursor/mcp.json:
{
"mcpServers": {
"teste-no": {
"command": "npx",
"args": ["-y", "teste-no-mcp"],
"env": {
"TESTE_NO_API_URL": "http://localhost:4207",
"TESTE_NO_API_KEY": "tno_<your-api-key>"
}
}
}
}
TESTE_NO_API_URL=http://localhost:4207 \
TESTE_NO_API_KEY=tno_xxx \
npx -y teste-no-mcp verify
Or from the package directory:
npm run verify
| Variable | Required | Default | Description |
|---|---|---|---|
TESTE_NO_API_KEY | Yes | — | API token (prefix tno_) from Settings → API Keys |
TESTE_NO_API_URL | No | http://localhost:4207 | Base URL of the Teste.no API server |
| Tool | Description |
|---|---|
list_targets | List monitoring targets with status and uptime |
get_target | Target details including composite scores |
get_target_scores | Security/SEO/Performance/Accessibility scores (0-100) |
list_findings | Open issues, filter by severity/target/status |
get_finding | Finding detail with evidence and AI analysis |
list_incidents | Grouped operational issues |
get_incident | Incident detail with linked findings and deployment correlation |
list_runs | Recent test runs, filter by target/status/slug |
get_run | Run detail with metrics, score, and findings |
active_runs | Currently running and queued tests |
team_stats | Team-wide overview stats |
target_stats | Per-target statistics |
daily_trends | Time-series data for trend analysis (up to 90 days) |
get_site_map | Latest crawl snapshot with page inventory and SEO issues |
list_maintenance_windows | Scheduled maintenance windows for a target |
list_tests | All 43 available test definitions (plugins) |
| Tool | Description |
|---|---|
trigger_test | Run a specific test by slug or ID |
trigger_all_tests | Fan-out scan of all enabled tests for a target |
acknowledge_incident | Mark an incident as acknowledged |
resolve_incident | Resolve an incident |
mute_finding | Mute an open finding |
create_maintenance_window | Schedule alert suppression window |
delete_maintenance_window | Remove a maintenance window |
record_deployment | Track a deployment for incident correlation |
recompute_scores | Force recompute composite scores |
| Tool | Description |
|---|---|
create_target | Add a new website/API/webshop target |
update_target | Update target properties |
delete_target | Permanently delete a target |
create_muting_rule | Auto-mute findings by pattern |
system_health | Platform health report (queues, stuck runs, stats) |
Admin tools require
adminscope and the token owner must be in ADVANCED UI mode.
The package includes a .cursor/rules/teste-no-mcp.mdc file that teaches agents when to call which tools. Install it globally:
npx -y teste-no-mcp install-cursor-rule
Or copy it manually to your project's .cursor/rules/ directory.
Teste.no also works as a ChatGPT MCP App via Streamable HTTP with OAuth 2.1.
https://api.teste.no/api/mcp/.well-known/oauth-protected-resourceChatGPT uses Dynamic Client Registration (PKCE). No API key needed — authentication
is handled via OAuth tokens. See docs/mcp-chatgpt.md for details.
┌──────────────┐ stdio (JSON-RPC) ┌──────────────────┐
│ Cursor IDE │ ◄──────────────────────► │ teste-no-mcp │
│ (MCP host) │ │ (this package) │
└──────────────┘ └────────┬─────────┘
│ HTTP + Bearer
▼
┌──────────────────┐
│ Teste.no API │
│ (Fastify+tRPC) │
└────────┬─────────┘
│
┌───────┴───────┐
│ PostgreSQL │
│ Redis+BullMQ │
└───────────────┘
The MCP package is a zero-dependency client (only @modelcontextprotocol/sdk and zod). All business logic, authorization, and data access happen in the Teste.no API.
If developing inside the teste.no monorepo:
cd packages/teste-no-mcp
pnpm install
pnpm dev # tsx watch mode
cd packages/teste-no-mcp
npm version patch # or minor/major
npm publish
The prepare script runs tsc before publish to ensure dist/ is built.
MIT
FAQs
MCP server for Teste.no — continuous testing control center for websites, APIs, and webshops. Thin proxy to the Teste.no MCP endpoint.
We found that validoria-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket uncovered 77 linked Firefox extensions, including 40 that steal wallet secrets or credentials and 37 deceptive sports-score shells.

Security News
NIST disclosed an unreleased AI tool called V-etalon and opened a broad inquiry into NVD modernization after years of automation plans produced no public enrichment system.

Security News
In his AI Council 2026 talk, Feross Aboukhadijeh covers recent package compromises, vulnerability discovery, and a more automated security model.