Allows running Jest test suites and parsing results to provide pass/fail verdicts and failure details.
Allows running Mocha test suites and parsing results to provide pass/fail verdicts and failure details.
Allows running Vitest test suites and parsing results to provide pass/fail verdicts and failure details.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-testbed Run the tests for this candidate solution and give me a pass/fail verdict."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
An MCP server that gives an agent an isolated workspace, runs its tests, and returns a deterministic pass/fail verdict.
The use case is grading. If you are evaluating whether a model can solve a software engineering problem, you need to put its candidate solution somewhere safe, run a suite against it, and get back an answer a program can act on. Doing that naively produces results that are almost right, which is the worst kind: output littered with absolute paths, wall clock durations and colour codes, so two runs of identical code never match, and any comparison against a reference solution fails for reasons that have nothing to do with the code.
This server exists to make that last part go away.
create_workspace -> write_files -> run_tests -> read_workspace -> destroy_workspacenpm install
npm test # 50 tests
npm run buildRegister it with any MCP host. For Claude Desktop or Claude Code:
{
"mcpServers": {
"testbed": {
"command": "node",
"args": ["/absolute/path/to/mcp-testbed/dist/index.js"]
}
}
}Related MCP server: Advanced MCP Server
const { workspaceId } = (await client.callTool({
name: 'create_workspace',
arguments: {
files: {
'package.json': JSON.stringify({ name: 'candidate', type: 'module' }),
'add.js': 'export const add = (a, b) => a * b;', // wrong on purpose
'add.test.js': `
import assert from 'node:assert/strict';
import { test } from 'node:test';
import { add } from './add.js';
test('adds two numbers', () => assert.equal(add(2, 3), 5));
`,
},
},
})).structuredContent;
const result = (await client.callTool({
name: 'run_tests',
arguments: { workspaceId, command: 'node', args: ['--test'] },
})).structuredContent;{
"passed": false,
"reporter": "node-test",
"total": 1,
"passedCount": 0,
"failedCount": 1,
"failures": [{ "name": "adds two numbers" }],
"exitCode": 1,
"timedOut": false,
"truncated": false,
"stdout": "...normalized...",
"rawStdout": "...untouched..."
}This is the part worth reading. Four sources of run to run variation are removed from stdout and stderr, while rawStdout and rawStderr keep the untouched output for a human to debug with.
Source of noise | Handling |
Absolute paths | Workspace root becomes |
Durations |
|
Timestamps | ISO 8601 becomes |
Colour codes | ANSI sequences stripped before anything else, since an escape can sit mid-token and stop other patterns matching. |
The environment is pinned rather than inherited. TZ=UTC, LC_ALL=C, a fixed PATH, HOME pointed at the workspace, and package manager banners suppressed. Inheriting the parent environment is the most common reason a suite passes on one machine and fails on another, so the parent environment is dropped entirely.
Directory listings are sorted, because readdir order is filesystem dependent.
The end to end test asserts the actual property: the same failing test in two different workspaces produces byte identical output.
Normalization is deliberately narrow. Over-aggressive scrubbing is worse than none, because it can erase the difference between a passing run and a failing one. There is a test asserting that a pass and a fail do not normalize to the same string.
run_tests recognises node --test, TAP, Jest, Vitest and Mocha, and reports which parser matched. When none matches it returns reporter: "exit-code" with null counts rather than guessing. A wrong count is worse than an absent one, since a grader would treat it as ground truth.
Two rules override a clean-looking summary:
A non-zero exit code is a failure even when every test reported passing. A suite can print all green and still exit non-zero because teardown crashed.
A run killed on timeout is never a pass, whatever the partial output said.
Workspaces are addressed by opaque UUID. A caller never sees or supplies an absolute path.
Path containment resolves the target and checks it against a separator terminated prefix. A plain startsWith(root) would accept /tmp/ws-evil for a root of /tmp/ws, and there is a test for exactly that case. Absolute paths, .. traversal and null bytes are rejected, as are files that would change how a run behaves (.npmrc, .git). Writes are validated as a batch before any of them touch disk, so a bad path halfway through cannot leave a partial write behind.
Runs are bounded on both axes: a wall clock timeout that kills the whole process group (killing only the direct child leaves orphaned test workers alive), and a per stream output cap so a runaway console.log cannot exhaust memory.
Threat model. This is workspace isolation, not a security sandbox. run_tests executes a command you hand it, with your user's permissions and network access. It protects a grading run from the mess an agent makes, not a host from hostile code. If you are running genuinely untrusted code, put a container or VM boundary around this process.
Tool | Purpose |
| Creates an isolated temp directory, optionally seeded with files. Returns its id. |
| Writes or overwrites files. All or nothing. |
| Runs a command under a fixed environment and timeout. Returns a structured verdict plus normalized and raw output. |
| Lists files, or reads one. Listings are sorted and exclude |
| Deletes a workspace. Idempotent. |
Tool descriptions are written for the model that will call them. A model decides whether to reach for a tool almost entirely from its description, so each states what it does, what it returns, and when not to use it.
src/normalize.ts output normalization
src/workspace.ts workspace lifecycle and path containment
src/runner.ts bounded process execution
src/parsers.ts test reporter parsing
src/server.ts MCP tool surface
src/index.ts stdio entry pointTests drive the server through a linked in-memory transport rather than calling handlers directly, so schema validation, serialization and tool registration are all exercised the way a real host exercises them. A unit test that called the handler would pass even if the tool were never registered.
Node 20 or newer. Runtime dependencies are @modelcontextprotocol/server and zod, nothing else.
MIT
Creates an isolated temporary directory and returns its id. Optionally seeds it with files. Every other tool addresses a workspace by this id; paths are always relative to it. Call destroy_workspace when finished.
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | Map of workspace-relative path to file contents, e.g. {"src/index.js": "..."} |
| Name | Required | Description |
|---|---|---|
| workspaceId | Yes | |
| filesWritten | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnly=false, idempotent=false, destructive=false), the description adds key behavioral context: the workspace is isolated and temporary, returns an id, can be seeded with files, and must be explicitly destroyed. It explains that all paths are relative to the workspace, which is vital for correct usage. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action, then the optional seeding, then the crucial usage context and cleanup instruction. Every sentence earns its place with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's modest complexity (one optional parameter, nested object), the description is fully complete. It covers the lifecycle, id-based addressing, path semantics, and cleanup, while the output schema (not shown but present) handles the return value. The description is sufficient for correct invocation in the context of sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the 'files' parameter with high coverage (100%), including an example. The description adds 'Optionally seeds it with files,' which reinforces optionality but does not add new semantic detail beyond what the schema provides. Baseline 3 is appropriate given complete schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates an isolated temporary directory and returns its id. It also mentions optional file seeding, which distinguishes it from sibling tools like read_workspace, write_files, run_tests, and destroy_workspace. The verb 'creates' plus the resource 'workspace' and the specific behavior are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says every other tool addresses a workspace by this id and paths are relative to it, making it clear this is the entry point. It also instructs to call destroy_workspace when finished, providing explicit cleanup guidance and distinguishing when to use this tool versus when to stop using it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Deletes a workspace and everything in it. Safe to call on an id that no longer exists.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | Yes |
| Name | Required | Description |
|---|---|---|
| destroyed | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose destructiveness (destructiveHint=true) and idempotency (idempotentHint=true). The description adds the crucial behavioral detail that it deletes 'everything in it,' specifying the full scope of destruction. This goes beyond the annotation and provides valuable transparency without contradicting the structured data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long and immediately states the primary action ('Deletes a workspace and everything in it'). The second sentence adds a valuable idempotency note. No wasted words or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter), the annotations covering safety, and the presence of an output schema (not shown but indicated), the description is largely complete. It covers the destructive scope and idempotency, which are the main behavioral aspects. It might mention reversibility or permissions, but these are not critical given the annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has only one parameter (workspaceId) with no description (0% schema description coverage). The description does not explain the parameter at all, leaving the agent to infer its meaning from the tool name alone. Since schema coverage is low, the description should compensate but does not, resulting in a low score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Deletes a workspace and everything in it.' It uses a specific verb ('deletes'), resource ('workspace'), and scope ('everything in it'), which distinguishes it from sibling tools like read_workspace, create_workspace, write_files, and run_tests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage as the destructive operation for workspaces. It also provides a clear usage condition: 'Safe to call on an id that no longer exists,' which is a useful guideline. However, it does not explicitly mention when not to use it or suggest alternatives, though the context with siblings makes the intended use clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Lists the files in a workspace, or returns the contents of one file when path is given. node_modules and .git are excluded from listings. Listings are sorted, so repeated calls match.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Workspace-relative file path. Omit to list all files. | |
| workspaceId | Yes |
| Name | Required | Description |
|---|---|---|
| path | No | |
| files | No | |
| contents | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent annotations, the description discloses additional behavioral traits: node_modules and .git are excluded from listings, listings are sorted, and repeated calls match. This adds valuable context about output stability and hidden filters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the primary action. Every clause adds information: listing, file content, exclusions, sorting. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The presence of an output schema and annotations reduces the need for return-value or safety details. The description covers the two main use cases and relevant edge cases (exclusions, deterministic ordering). It leaves out error handling (e.g., missing file) but that is not critical given the schema and simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the 'path' parameter well ('Omit to list all files'). The description reinforces this but adds little about the 'workspaceId' parameter. With 50% schema coverage, the description could have compensated more for the undocumented workspaceId, but the context makes its purpose obvious.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('Lists', 'returns') and clearly identifies the resource (files in a workspace). It distinguishes between the two main behaviors (listing vs. file content) and, given sibling tools like write_files and destroy_workspace, the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: use this to read or list workspace files. However, it does not explicitly state when not to use this tool or name alternatives. Since it is the only read-oriented tool among the siblings, the use case is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Runs a command in a workspace under a fixed environment and a wall clock timeout, then parses the output into a pass/fail summary with failing test names. Output is normalized (paths, durations, timestamps and colour codes removed) so two identical runs produce identical text. Returns the verdict plus both normalized and raw output.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | ||
| args | No | ||
| command | No | Executable to run. Not passed through a shell. | npm |
| timeoutMs | No | ||
| workspaceId | Yes | ||
| maxOutputBytes | No |
| Name | Required | Description |
|---|---|---|
| total | Yes | |
| passed | Yes | |
| stderr | Yes | |
| stdout | Yes | |
| exitCode | Yes | |
| failures | Yes | |
| reporter | Yes | |
| timedOut | Yes | |
| rawStderr | Yes | |
| rawStdout | Yes | |
| truncated | Yes | |
| durationMs | Yes | |
| failedCount | Yes | |
| passedCount | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations by disclosing normalization behavior ('paths, durations, timestamps and colour codes removed'), reproducibility ('two identical runs produce identical text'), and the return format ('verdict plus both normalized and raw output'). These behavioral details are not present in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the primary action, and every clause adds meaningful detail (fixed environment, timeout, normalization, return output). It is concise without being under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers behavioral and output aspects well, and an output schema exists to detail return values. However, it omits parameter semantics and explicit usage guidance, leaving gaps for a 6-parameter tool with low schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 17% (only 'command' has a description). The description mentions 'fixed environment' and 'wall clock timeout' but does not map these to the 'env', 'timeoutMs', or other parameters. It fails to compensate for the lack of schema-level parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'Runs a command in a workspace under a fixed environment and a wall clock timeout, then parses the output into a pass/fail summary with failing test names.' This specific verb+resource+scope distinguishes it from sibling file-operation tools like read_workspace and write_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies it is for running tests but does not explicitly state when to use it versus alternatives. No exclusions or alternative tool mentions are provided, so the usage context is inferred rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Writes or overwrites files in an existing workspace, creating parent directories as needed. Paths must be relative and stay inside the workspace. Either every file is written or none is.
| Name | Required | Description | Default |
|---|---|---|---|
| files | Yes | Map of workspace-relative path to file contents, e.g. {"src/index.js": "..."} | |
| workspaceId | Yes |
| Name | Required | Description |
|---|---|---|
| filesWritten | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint and idempotentHint; the description adds valuable context: parent-directory creation, path safety (relative and inside workspace), and atomic all-or-nothing behavior. It does not contradict annotations and improves transparency beyond the structured hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact (three sentences) and front-loaded with the main action. Each sentence serves a distinct purpose: basic behavior, path constraints, and atomicity. There is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema and annotations, the description covers the essential context: purpose, workspace requirement, path safety, and atomicity. It is complete for a 2-parameter write tool and does not need to explain return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers the 'files' parameter with a good example, but 'workspaceId' has no schema description. The description compensates by implying workspaceId must reference an existing workspace and by adding constraints on the file paths (relative, inside workspace). This adds meaning beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb and resource: writes/overwrites files in an existing workspace. It distinguishes itself from siblings (read_workspace, create_workspace, run_tests, destroy_workspace) by focusing on file-level mutations rather than workspace lifecycle or read operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context (existing workspace, relative path constraints, atomicity) and implies when to use it (writing files), but it does not explicitly name alternatives or contrast with sibling tools. This is clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Each tool has a clearly distinct role: create workspace, read/list files, write files, run tests, and destroy workspace. There is no overlap in purpose, so an agent can easily select the right tool.
All tool names follow a consistent verb_noun pattern (create_workspace, read_workspace, write_files, run_tests, destroy_workspace), using snake_case throughout. The naming is predictable and intuitive.
Five tools is appropriate for the scope of managing isolated test workspaces and running tests. Each tool serves a necessary function without redundancy or bloat.
The set covers the full lifecycle of a test workspace: creation, reading, writing, test execution, and destruction. No essential operations are missing; write_files handles overwrites, and read_workspace supports both listing and file content retrieval.
Unclaimed servers have limited discoverability.
If you are the server author, to access and configure the admin panel.
Execute code in 8 languages (Python, JS, TS, Go, Java, C++, C, Bash) in gVisor sandboxes.
Build Apps and run code in 30 languages — sandboxed, with persistent sessions for agent loops.
Test the voice agents you run: scored transcripts, pass/fail verdicts, latency and WER metrics.
Run Python code in a secure sandbox without local setup. Declare inline dependencies and execute s…
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/anthonys1760/mcp-testbed'
If you have feedback or need assistance with the MCP directory API, please join our Discord server
