Version 0.1: 合成QAデータを使用したリリースインテリジェンス基盤。
AIエージェント評価機能はVersion 0.2で計画されています。
説明可能なModel Context Protocol（MCP）サーバーです。AIクライアントがソフトウェアのテスト結果と欠陥を分析し、エビデンスに基づいたリリース準備完了（release-readiness）の推奨事項を生成するのに役立ちます。
このリポジトリ内のすべてのリリース、テスト、欠陥、および顧客影響シナリオは架空のものです。雇用主、顧客、本番環境、個人、または規制対象のデータは使用されていません。
リリースの判断には、テスト結果、欠陥記録、チーム文書に分散したエビデンスが必要となることがよくあります。
このサーバーは、AIクライアントに以下のような質問に答えるための、小規模で読み取り専用のインターフェースを提供します。
特定のリリースを出荷すべきか？
どの失敗したテストがリリースブロッカーになり得るか？
未解決の欠陥リスクはどこに集中しているか？
対象を絞った回帰テストでは、どのテストを優先すべきか？
AIはリスクスコアを独自に作り出しません。サーバーはそれを決定論的に計算し、根拠となるエビデンス、重み、ブロッカー、および推奨される次のアクションを人間のレビューのために返します。
Related MCP server: QA Copilot AI
種別 | 名前 | 目的 |
Tool |
| 説明可能な |
Tool |
| 失敗したテストとブロックされたテストを、オプションの重大度フィルタ付きで取得します |
Tool |
| 重大度で重み付けされた未解決欠陥リスクによってコンポーネントをランク付けします |
Tool |
| 範囲を限定したリスクベースの回帰テスト計画を作成します |
Resource |
| 分析に利用可能な合成リリースを一覧表示します |
Prompt |
| エビデンスに基づくリリース準備完了レビューをガイドします |
flowchart TD
A[AI host or MCP Inspector] -->|MCP request| B[Python MCP server]
B --> C[QA service and risk rules]
C --> D[(Synthetic SQLite data)]
D --> C
C -->|Structured evidence| B
B -->|Tool result| A
D -. optional migration .-> E[(Snowflake)]SQLiteにより、Version 0.1は再現可能で資格情報なしで動作します。オプションのsnowflake/setup.sqlファイルは、SnowflakeネイティブのMCPパスの可能性を示しています。
Python 3.10以降
ビジュアルMCP Inspector用のNode.js/npm
git clone https://github.com/Zoya-Ammar/ai-agent-release-assurance-mcp.git
cd ai-agent-release-assurance-mcp
uv sync --extra dev
uv run python -m banking_qa_mcp.seed
uv run mcp dev src/banking_qa_mcp/server.py最後のコマンドでMCP Inspectorが起動します。
Toolsを開き、assess_release_readinessを選択して、次を入力します：
{
"release_id": "REL-2026.08.1"
}期待される主要な結果：
{
"recommendation": "NO_GO",
"risk_score": 100,
"test_pass_rate_percent": 62.5,
"blockers": [
"Open SEV1 defect",
"Failed or blocked critical test",
"Failed or blocked high-criticality test"
]
}比較として、REL-2026.08.2はリスクスコア7でGOを返します。
完全な自動テストスイートを実行します：
uv run pytest -q依存関係なしのコア検証を実行します：
uv run python scripts/smoke_test.pyVersion 0.1には以下のテストが含まれています：
高リスクおよび低リスクのリリース推奨
テスト結果のフィルタリング
回帰テスト計画の制限と優先順位付け
無効なリリース識別子
スコアは100で上限が設定されています：
25 × failed or blocked critical tests
12 × failed or blocked high-criticality tests
35 × open SEV1 defects
18 × open SEV2 defects
7 × open SEV3 defects
2 × open SEV4 defects未解決のSEV1欠陥、失敗またはブロックされたクリティカルテスト、または失敗またはブロックされた高重要度テストも、明示的なリリースブロッカーとして報告されます。
これらの重みはデモンストレーション用のポリシーであり、金融サービスやソフトウェア品質の普遍的な基準ではありません。本番環境では、しきい値は適切なリスク管理者による承認、バージョン管理、検証、および定期的なレビューが必要になります。
Version 0.1は、アプリケーション層で意図的に読み取り専用です。本番実装には以下も含める必要があります：
認証とロールベースの認可
最小権限のデータベースおよびサービスロール
入力および出力の検証
ツール呼び出しと推奨事項の監査ログ
レート制限と可観測性
シークレット管理と暗号化された転送
リリース判断に対する人間の承認
取得コンテンツに対するプロンプトインジェクションのテスト
オプションのSnowflakeの例には、サンドボックスデモンストレーション用のネイティブSQL実行ツールが含まれています。これは専用の読み取り専用ロールで制限し、デモ以外の使用前にはさらに範囲を絞り込む必要があります。
次のバージョンでは、このリリースインテリジェンス基盤をAIエージェント保証システムに拡張します。
計画されている機能は次のとおりです：
独自のAIエージェント評価コーパス
グラウンディングと引用の検証
プロンプトインジェクション耐性テスト
プライバシーとデータ最小化のチェック
アクセシビリティとネガティブパスシナリオ
ベースラインと候補の比較
エージェントバージョン間の回帰検出
PlaywrightベースのUIおよびアクセシビリティ実行
Snowflakeをバックエンドにした評価エビデンス
人間がレビューするAIエージェントのリリース推奨
このリポジトリは教育用のポートフォリオプロトタイプです。本番の銀行システム、コンプライアンスツール、または自律的なリリース権限ではありません。
このプロジェクトはMIT Licenseの下で利用可能です。
Calculate an explainable GO, CONDITIONAL_GO, or NO_GO recommendation.
| Name | Required | Description | Default |
|---|---|---|---|
| release_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses that the output is an explainable recommendation with three possible values, but it does not reveal how the recommendation is derived, whether it depends on external sources, or what 'explainable' means in practice. This is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the action and outcome with no filler. It is appropriately sized for a one-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has only one parameter and no output schema, and the description names the three output categories, which covers the basic return shape. But it omits the criteria behind the recommendation, the source of the release ID, and any caveats, leaving the agent with an incomplete picture of how to invoke and interpret it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not elaborate on release_id beyond the schema's string type and title. Since the only parameter is central to the tool, the description should at least clarify what qualifies as a release_id and how it is used; it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear action ('Calculate') and a specific deliverable ('GO, CONDITIONAL_GO, or NO_GO recommendation'), which goes beyond the tool name. It is distinguishable from the sibling tools by its outcome-oriented purpose, though it does not explicitly contrast itself with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied: this is the high-level readiness assessment tool, while siblings like get_failed_tests and find_defect_hotspots are lower-level diagnostic tools. However, the description never states when to use this tool versus its alternatives, so an agent must infer the boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Rank release components by the weighted risk of unresolved defects.
| Name | Required | Description | Default |
|---|---|---|---|
| release_id | Yes |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It implies a read-only ranking operation and specifically scopes to unresolved defects, but it does not explain how 'weighted risk' is computed, whether historical data is considered, or what happens when no defects are found. Basic but not rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the action and object, then adds the precise qualifier. Every word earns its place with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema covers return values, and the single parameter is simple. However, the description omits when to prefer this over sibling tools and does not clarify the meaning of 'components' or 'weighted risk.' It is minimally viable but leaves notable gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description should compensate, but it never explains what release_id means or how it relates to the ranking. The schema only shows it is a required string. The description uses 'release' in its wording, providing only a weak hint, not clear parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Rank'), a resource ('release components'), and a distinguishing criterion ('weighted risk of unresolved defects'). This clearly differentiates it from sibling tools like get_failed_tests or assess_release_readiness, which focus on different outputs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus the sibling tools. It does not mention alternatives, exclusions, or conditions under which another tool would be a better fit, leaving the agent to infer usage purely from the name and purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Return failed and blocked tests, optionally filtered by criticality.
| Name | Required | Description | Default |
|---|---|---|---|
| release_id | Yes | ||
| criticality | No |
| Name | Required | Description |
|---|---|---|
| result | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the output (failed/blocked tests) but does not mention pagination, ordering, empty-result behavior, required release context, or consequences. Nothing contradicts annotations because none exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every word adds meaning, and the main result is stated before the optional filter.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite a simple two-parameter shape and an output schema, the definition lacks enough context for confident invocation: no sibling differentiation, no release_id semantics, and no criticality value guidance. This is insufficient for a low-coverage schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only clarifies the optional criticality filter; it does not explain release_id or enumerate accepted criticality values, leaving a required parameter largely undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'Return failed and blocked tests'. This clearly distinguishes it from siblings like assess_release_readiness and recommend_regression_tests, which are analysis/recommendation tools rather than retrieval tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to prefer this tool over its siblings. The only usage hint is the optional criticality filter, which is more of a parameter option than a when-to-use instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Build a risk-based regression plan grounded in test and defect evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| max_tests | No | ||
| release_id | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It mentions that the plan is 'risk-based' and 'grounded in test and defect evidence,' but it does not disclose what the tool returns, how it uses release_id and max_tests, or whether it only reads data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. It begins with the action and object and adds value by specifying risk-based and evidence-grounded characteristics.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two parameters, no annotations, and no output schema, this one-line description is incomplete. It does not explain expected outputs, the role of max_tests, or selection criteria, leaving important context for correct invocation unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions release_id or max_tests. The phrase 'test and defect evidence' does not explain the required release parameter or the meaning of the max_tests default, so the agent gets no parameter help beyond field names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action, 'Build a risk-based regression plan,' and a clear resource. It distinguishes itself from sibling tools by focusing on test recommendation and evidence grounding, though it does not explicitly name or contrast any sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given for when to use this tool versus assess_release_readiness, get_failed_tests, or find_defect_hotspots. There are no prerequisites or exclusions, so an agent must infer usage solely from the name and purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0assess_release_readinessfind_defect_hotspotsget_failed_testsrecommend_regression_testsScored across 4 tools
Each tool produces a distinct output: a GO/NO-GO decision, a filtered list of test failures, a component risk ranking, and a regression test plan. find_defect_hotspots and recommend_regression_tests share an evidence base of defect/test risk, but their purposes are clearly separated by output type, so misselection is unlikely.
All four tools follow a consistent verb_noun snake_case pattern (assess_release_readiness, get_failed_tests, find_defect_hotspots, recommend_regression_tests). The verb clearly signals the action (assess, get, find, recommend) and the noun signals the resource, making the pattern highly predictable.
Four tools is on the lean side but well-scoped for release assurance: each tool fills a distinct role covering evidence gathering, risk analysis, planning, and final decision. There is no redundancy or bloat, and every tool earns its place in the pipeline.
The set forms a coherent end-to-end release readiness workflow: pull test failures, rank defect hotspots, build a regression plan from that evidence, and produce a final GO/NO-GO assessment. Minor gaps exist, such as no tool to drill into individual defect details or fetch component/change scope, but agents can work around these.
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
QA platform for agents: coverage signals, in-repo test plans, verified tests and release governance.
Diagnose AI workflows for failure, security, and handoff risks — RED/AMBER/GREEN per node.
Read-only, deterministic AI triage and readiness tools implementing Sophon's published rubrics.
