Testlie
Menu

Get started

On this page

MCP connections and sandboxes

There are three separate MCP capabilities:

  • Connect → MCP → Agents → Testlie: give an agent limited access to your team's test systems and captures.
  • Connect → MCP → Testlie → external servers: discover capabilities and explicitly run allowed tools on a server you configure.
  • Systems → MCP sandboxes: test your own MCP clients against isolated tools or knowledge servers.

Connect an agent to Testlie

Create an MCP grant while signed in as a team owner or administrator. Choose a project or the whole team, permissions, and a lifetime of 7–90 days. The default is system metadata for 30 days. Copy the token once; only its hash is stored.

Configure a client supporting Streamable HTTP and custom headers:

json
{
  "mcpServers": {
    "testlie": {
      "url": "https://testlie.com/api/mcp",
      "headers": { "Authorization": "Bearer YOUR_MCP_GRANT" }
    }
  }
}

Client configuration formats vary. Store the grant in the client's secret storage rather than committing it to a repository. Ordinary Testlie API keys and browser cookies do not authenticate this endpoint. Tokens belong in the Authorization header, never a URL.

Permissions:

Permission Tools
System metadata list_systems: up to 50 test API systems and 50 email inboxes, excluding credentials
Captured data list_api_calls, read_api_call, list_messages: latest 20 calls or email subjects; masked call bodies limited to 12,000 characters each
Failure controls set_api_failure: set none, rate_limit or server_error on an accessible test API

No tools expose stored credentials, delete records, send messages or change outbound destinations. Project grants exclude ungrouped systems and other projects. Deleting a project revokes its grants. Revoking a grant, expiry, or removing/demoting its issuer disables subsequent requests. In-flight requests may finish. Tool attempts and outcomes appear in the audit log without captured content or tokens.

This is stateless HTTP, capped at 120 requests per minute per grant per web process and 64 KB per request. Session streaming, subscriptions, sampling and elicitation are unavailable. Both the established 2025-era Streamable HTTP handshake and the SDK's modern request format are handled.

Authentication support: dedicated manual bearer tokens. OAuth account linking, automatic token refresh and stdio are not implemented. A client that requires OAuth instead of custom authorization headers cannot connect yet.

Connect Testlie to an external server

Save a public HTTPS endpoint and an optional dedicated bearer token. Tokens are encrypted at rest and excluded from connection-list responses. Saving a connection validates its address; it does not initialize the server or call a tool.

Use Discover to inspect server information, tools, resources and prompts. Discovery sends MCP initialization and capability-list requests. Tool descriptions, schemas and returned text are untrusted data, displayed as text; Testlie does not follow instructions, invoke a model, or automatically run returned tools.

Allow tools by their exact names when creating a connection. An empty allowlist permits discovery only. Each tool call requires JSON arguments and an explicit confirmation. A tool may change the external system even if its description claims it is read-only. Supply only test data and credentials with the permissions you intend. Remove and recreate a connection to change credentials or its allowlist.

Only owners and administrators can manage or use external connections. Each request is audited. Redirects, URL credentials, query parameters, fragments, and private/reserved network destinations are refused. DNS is checked at the actual socket connection. Requests have an eight-second network deadline, a 64 KB outgoing body cap and a 256 KB incoming cap. Long-lived SSE servers may not be compatible with this bounded inspector; responses must complete within the deadline. OAuth discovery, interactive authorization, stdio and remote sampling/elicitation are unavailable. Discovery lists a single page per capability.

Test an MCP client

Create one of these under Systems → MCP sandboxes:

  • MCP tools server: echo returns a string; sum adds up to 100 numbers. Set the outcome to Decline for deterministic MCP tool errors.
  • MCP knowledge server: list/read testlie://fixture/welcome and list/get the summarize-fixture prompt.

Use the system's base URL and generated test bearer token. The configuration snippet appears on the configured system page. Requests and responses are captured under that system and count against your existing API mock quotas. API rate-limit/server-error and response-delay scenarios work through the existing failure controls. Test tokens can be rotated with the existing credential controls.

These are protocol test fixtures, not replicas of third-party MCP products. They execute no arbitrary code and access no filesystem. Send sample data only. Captured data follows the same retention and masking rules as other API test systems.