@rootxqa/mcp

Model Context Protocol server for RootXQA — gives your IDE's AI agent 7 QA tools: scan live URLs, deep root-cause analysis, write test code, generate locators, review code for bugs, and list open issues, all without leaving your editor.

Works with Cursor, Claude Code, Windsurf, and any MCP-compatible client.

What this does

Once installed, the AI inside your IDE can do things like:

"scan https://myapp.com for issues"
"write a Playwright test for the checkout flow"
"generate a locator for this button: <button aria-label='Submit'>"
"review this code for security bugs"
"list my open critical bugs"

It calls your RootXQA account's live API and returns the results directly in the AI chat — findings, test code, locators, bug lists, everything.

Setup

Step 1 — Get your token

1. Open the RootXQA dashboard
2. Go to Settings → Copy Token
3. Copy the token (it's a 30-day JWT — generate a new one any time)

Step 2 — Add to your editor

Cursor — create or edit ~/.cursor/mcp.json:

{
  "mcpServers": {
    "rootxqa": {
      "command": "npx",
      "args": ["-y", "@rootxqa/mcp"],
      "env": {
        "ROOTXQA_TOKEN": "<paste your token here>"
      }
    }
  }
}

Claude Code — run in your terminal:

claude mcp add rootxqa -e ROOTXQA_TOKEN=<your-token> -- npx -y @rootxqa/mcp

Or add to ~/.claude.json (global) / .mcp.json (project root) with the same JSON block as above.

Windsurf / others — same mcpServers JSON block in their config file.

Step 3 — Restart your editor

After saving the config, restart Cursor / Claude Code. You'll see rootxqa appear in the MCP tools panel with 7 tools listed.

Tools

scan_url — Quick scan · Free

Fast public-surface scan of a live deployed URL. No credits needed.

Example prompt:

scan https://myapp.com for issues

Returns: issue count, severity breakdown, summary, and a fix prompt.

deep_scan — Root cause crawl · Uses credits

Multi-page crawl that pins the exact root cause of each finding — with file location, line reference, and why it breaks. For the full report you need scan credits; a free preview is always available.

Example prompt:

deep scan https://myapp.com

Returns: pages crawled, each finding with location + root cause, link to downloadable HTML report.

ask_xqa — QA copilot · Uses credits

The full RootXQA AI copilot, grounded on your own test/bug data. Writes real automation code in any framework. Also handles URL input — paste a URL and XQA picks the right scan type.

Example prompts:

write a Playwright test for the login page
generate Cypress tests for the cart with invalid coupon codes
write pytest API tests for POST /api/users with validation errors
generate a Page Object for the checkout page

Frameworks supported: Playwright, Cypress, Selenium, pytest, WebdriverIO, Jest, and more.

generate_locator — Element selectors · Uses credits

Stable, ranked selectors for a UI element. Paste the element's HTML for an exact match; describe it for a best-effort result.

Example prompts:

locator for: <button class="btn-primary" aria-label="Place order">Place order</button>
generate a locator for the email input on the login form

Returns: Playwright semantic locator (getByRole, getByTestId, getByLabel), CSS selector, XPath — ranked by stability.

scan_code — Bug detection · Pro plan

Passes a code snippet or unified diff through the QualixAI bug-detection engine. Finds missing auth, injection risks, null derefs, silent catches, data leaks, and logic errors — each with a root cause and a fix snippet.

Example prompts:

scan this code for bugs: <paste code>
review this diff for security issues: <paste diff>

Pass filename (e.g. api/users.py) for better language detection.

generate_test — Test code generation · Uses credits

Generate complete, runnable test files from a plain-English description. Covers UI/E2E, API, unit/integration, BDD Gherkin scenarios, and Page Object Models.

Example prompts:

generate a Playwright TypeScript test with Page Object Model for user login
write BDD Gherkin scenarios and step definitions for product search
generate pytest API tests for the /api/orders endpoint

Options: framework (playwright / cypress / selenium / pytest / jest / ...), language (typescript / python / java / ...), style (bdd / pom / flat).

list_bugs — Open bug list · Free

Lists open bugs across your account — from QualixAI PR scans and from Scout / Ask XQA reports. Filter by severity or status.

Example prompts:

list my open critical bugs
show all bugs with status open
list high and critical bugs from the last scan

Credits

| Tool | Cost | |---|---| | scan_url | Free | | list_bugs | Free | | ask_xqa | Daily credits | | deep_scan | Daily credits + scan credits for full report | | generate_locator | Daily credits | | generate_test | Daily credits | | scan_code | Pro plan required |

Free plan — 200 credits/day, resets at UTC midnight.
Pro — 1,000 credits/day + 2,000 monthly bonus scan credits (₹199/mo).
Studio — 5,000 credits/day + 15,000 monthly bonus scan credits (₹999/mo).

Upgrade from the dashboard → Settings → Plan & Billing.

Environment variables

| Variable | Required | Default | Description | |---|---|---|---| | ROOTXQA_TOKEN | Yes | — | 30-day CLI token from dashboard → Settings → Copy Token | | ROOTXQA_API_BASE | No | https://api.excuea.com | Override to point at a local dev server |

Local development (running from source)

cd mcp
npm install

In your MCP config, replace npx -y @rootxqa/mcp with a direct node call:

{
  "mcpServers": {
    "rootxqa": {
      "command": "node",
      "args": ["D:/path/to/rootxqa/mcp/src/index.js"],
      "env": {
        "ROOTXQA_TOKEN": "<your token>",
        "ROOTXQA_API_BASE": "http://localhost:8000"
      }
    }
  }
}

The server speaks MCP over stdio. Diagnostics go to stderr (stdout is the MCP wire channel). On startup you'll see:

rootxqa MCP server running · API http://localhost:8000 · token set

Troubleshooting

Tools don't appear in Cursor / Claude Code
→ Restart the editor after editing the config file. Check the MCP panel for a connection error log.

"No RootXQA token configured"
→ Make sure ROOTXQA_TOKEN is set in the env block of your MCP config. Get it from Settings → Copy Token.

"RootXQA API 401"
→ Token expired (30-day TTL). Go to Settings → Copy Token and generate a fresh one.

"RootXQA API 402 / not enough credits"
→ Daily limit hit. Wait for midnight UTC reset, buy a scan credit pack, or upgrade your plan.

scan_code returns "Upgrade to Pro"
→ On-demand code scanning requires a Pro or Studio plan.

deep_scan shows a locked preview
→ Full report needs scan credits. Buy a credit pack from Settings or from the deep scan paywall in the dashboard.

Links

• Dashboard: excuea.com
• XQA Scout Chrome Extension: installs alongside the dashboard
• MCP spec: modelcontextprotocol.io
• npm: npmjs.com/package/@rootxqa/mcp