┌─────────────────────┐      OpenAPI spec / target base URL
│   FastAPI Service    │◄──────────────────────────────────
│   (api/main.py)      │
└──────────┬───────────┘
           │ triggers
┌──────────▼───────────┐
│   Testing Agent        │
│   (agent/*.py)         │
│                         │
│  1. TestGenerator       │──uses──► OpenAI (LangChain)
│     (positive/negative  │
│      scenarios)         │
│                         │
│  2. TestExecutor        │──calls──► MCP Client ──stdio──► MCP Server
│     (runs each case)    │                                  │
│                         │                          ┌───────┴────────┐
│  3. FailureAnalyzer     │                          │  MCP Tools:     │
│     (LLM explains diff) │                          │  - discover_    │
│                         │                          │    endpoints    │
│  4. ReportGenerator     │                          │  - send_request │
│     (md/json report)    │                          │  - validate_    │
└─────────────────────────┘                          │    response     │
                                                       │  - analyze_    │
                                                       │    status_code │
                                                       └────────┬───────┘
                                                                │ HTTP
                                                       ┌────────▼───────┐
                                                       │  Target API     │
                                                       │  (any REST API, │
                                                       │  e.g. sample_   │
                                                       │  target_api/)   │
                                                       └─────────────────┘

mcp-api-testing-agent/
├── mcp_server/
│   ├── server.py               # MCP server (FastMCP) exposing the 4 tools
│   └── tools/
│       ├── discover.py         # discover_endpoints — parses OpenAPI spec
│       ├── request_tool.py     # send_request — issues HTTP calls
│       ├── validate.py         # validate_response — schema/status checks
│       └── status_analyzer.py  # analyze_status_code — status code semantics
├── agent/
│   ├── mcp_client.py           # stdio MCP client used by the agent
│   ├── test_generator.py       # LLM-based positive/negative test generation
│   ├── test_executor.py        # runs generated test cases via MCP tools
│   ├── failure_analyzer.py     # LLM explains expected-vs-actual mismatches
│   └── report_generator.py     # Markdown + JSON report writer
├── api/
│   └── main.py                  # FastAPI app: POST /agent/run, GET /agent/reports/{id}
├── schemas/
│   └── models.py                # Pydantic models shared across the app
├── sample_target_api/
│   └── demo_api.py              # tiny FastAPI service to test the agent against
├── scripts/
│   └── run_agent.py             # CLI entrypoint (no FastAPI needed)
├── reports/                     # generated test reports land here
├── Dockerfile
├── docker-compose.yml
├── requirements.txt
└── .env.example

python -m venv venv && source venv/bin/activate
pip install -r requirements.txt
cp .env.example .env   # add your OPENAI_API_KEY

uvicorn sample_target_api.demo_api:app --port 9000

python scripts/run_agent.py --spec http://localhost:9000/openapi.json --base-url http://localhost:9000

uvicorn api.main:app --port 8000

curl -X POST http://localhost:8000/agent/run \
  -H "Content-Type: application/json" \
  -d '{"spec_url": "http://localhost:9000/openapi.json", "base_url": "http://localhost:9000"}'

python -m mcp_server.server

{
  "mcpServers": {
    "api-testing-agent": {
      "command": "python",
      "args": ["-m", "mcp_server.server"],
      "cwd": "/absolute/path/to/mcp-api-testing-agent"
    }
  }
}

docker compose up --build

# API Test Report — 2026-02-03T10:15:00

Target: http://localhost:9000
Total: 18   Passed: 15   Failed: 3   Pass rate: 83%

## Failures

### POST /tasks — missing required field "title" (negative test)
Expected: 422 Unprocessable Entity
Actual:   500 Internal Server Error
Analysis: The endpoint does not validate the request body before hitting the
database layer, so a missing "title" causes an unhandled exception instead
of a client-error response. Severity: High — indicates missing input
validation.