bugsmash-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@bugsmash-mcpshow me my recent BugSmash reviewer feedback"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
BugSmash MCP
Local Model Context Protocol server that lets an LLM read and manage BugSmash reviewer feedback without ever seeing your BugSmash API key.
LLM (Claude) --MCP--> bugsmash-mcp --HTTPS + X-API-Key--> https://api.bugsmash.io/api/v2Install
npm install -g @mxrcochxvez/bugsmash-mcpOr run without a global install via npx (see connector config below).
Requires Node.js 18+.
Related MCP server: Gerrit MCP Server
Generate an API key
Sign in at tools.bugsmash.io.
Open your profile menu → Settings.
Find the API Key section and copy the key.
Treat it like a password. If it leaks, regenerate it immediately from the same settings page.
Official auth docs: docs.bugsmash.io/authentication
Set BUGSMASH_API_KEY (do not commit it)
Export the key in your shell — never put it in a committed file.
export BUGSMASH_API_KEY="your-key-here"macOS / Linux (zsh), persist for your user:
echo 'export BUGSMASH_API_KEY="your-key-here"' >> ~/.zshrc
source ~/.zshrcConfirm it is set (does not print the value):
test -n "$BUGSMASH_API_KEY" && echo "BUGSMASH_API_KEY is set"Register as a user-level MCP connector
Use a user scope so the server is available in every project.
Claude Code / Claude CLI (recommended: npx)
claude mcp add --scope user bugsmash --env BUGSMASH_API_KEY=$BUGSMASH_API_KEY -- npx -y @mxrcochxvez/bugsmash-mcpIf you installed globally:
claude mcp add --scope user bugsmash --env BUGSMASH_API_KEY=$BUGSMASH_API_KEY -- bugsmash-mcpClaude Desktop
Edit your Claude Desktop config (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"bugsmash": {
"command": "npx",
"args": ["-y", "@mxrcochxvez/bugsmash-mcp"],
"env": {
"BUGSMASH_API_KEY": "your-key-here"
}
}
}
}Prefer injecting the key from the environment your Desktop app inherits, rather than pasting it into a synced config file when possible.
Cursor
Add a similar MCP entry: command npx, args ["-y", "@mxrcochxvez/bugsmash-mcp"], and BUGSMASH_API_KEY under env.
Tools
Tool | BugSmash API | Purpose |
|
| Paginated project list (find |
|
| Project details + versions |
|
| All reviewer comments on a project |
|
| Single comment (+ replies) |
|
| Update text / status / priority / privacy |
|
| Thread replies |
|
| Reply on a thread |
Base URL: https://api.bugsmash.io/api/v2
Auth header: X-API-Key (never a tool argument).
Typical flow: list_projects → list_feedback → optionally update_feedback / post_reply.
Security note
The API key is read only from
BUGSMASH_API_KEY.It is never accepted as a tool parameter.
It must never be logged, printed, masked-partially in errors, or returned in tool responses.
On startup, a missing key exits with the generic message
BUGSMASH_API_KEY is not set.All HTTP calls go through one helper that attaches
X-API-Key; request headers are not surfaced on errors.
Local development
git clone https://github.com/mxrcochxvez/bugsmash_mcp.git
cd bugsmash_mcp
npm install
npm run build
export BUGSMASH_API_KEY="your-key-here"
npm startnpm run typecheck # tsc --noEmit
npm run pack:check # preview files included in the npm tarballAPI reference: docs.bugsmash.io
Available Tools
7 toolsget_feedbackGet BugSmash commentA
Fetch a single comment by UUID, including replies when present. Maps to GET /comment/{commentId}.
| Name | Required | Description | Default |
|---|---|---|---|
| commentId | Yes | Comment UUID | |
| plainText | No | Return text as plain text instead of HTML (default true) | |
| locationMetadata | No | Include location metadata on the comment |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that this is a GET request (read-only) and that replies are included when present, adding useful behavioral context. However, it does not mention error handling, authentication, rate limits, or the exact response structure beyond the inclusion of replies, which limits transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core purpose, and contains no redundant or unnecessary information. It efficiently conveys the tool's function and HTTP mapping.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only fetch tool with complete parameter schema, the description is quite complete. It specifies the single-comment scope and the inclusion of replies, which is important. The absence of an output schema is mitigated by the simplicity, though it could mention error behavior or the reply structure. Overall, it is sufficient for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters (commentId, plainText, locationMetadata) are already described in the schema. The description adds no extra parameter semantics beyond the endpoint mapping, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it fetches a single comment by UUID and includes replies when present, using a specific verb and resource. This distinguishes it from sibling tools like list_feedback (which lists) and list_replies (which lists replies). The endpoint mapping 'GET /comment/{commentId}' further specifies the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you have a comment UUID and need a single comment with its replies. It provides clear context but does not explicitly mention when not to use it or alternatives like list_replies for replies alone. The sibling tools provide context, but the description itself lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_projectGet BugSmash projectA
Fetch details for a single BugSmash project, including versions and review links. Maps to GET /project/{projectId}.
| Name | Required | Description | Default |
|---|---|---|---|
| projectId | Yes | Project UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It uses the verb 'Fetch' and maps to HTTP GET, which strongly implies a read-only operation. It also discloses what is included in the response ('versions and review links'), adding useful context beyond the schema. It doesn't explicitly state side effects, but for a GET operation this is transparent enough.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. It front-loads the action ('Fetch details'), specifies the resource, and includes a useful endpoint mapping. Every sentence earns its place, achieving maximum conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and no output schema. The description adequately conveys the purpose and mentions key return contents (versions and review links). While it could list all possible details, for a 'details' endpoint this is sufficient and complete enough for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of the single parameter (projectId as 'Project UUID'), so the baseline is 3. The description adds context by mapping it to the URL path (/project/{projectId}) and relating it to the 'single project' concept, but it does not add much beyond what the schema already provides. This is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool fetches details for a single BugSmash project, with a specific verb ('Fetch'), resource ('BugSmash project'), and scope ('single'). It also maps to a specific REST endpoint, and the qualifier 'single' distinguishes it from sibling tool list_projects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool: to get details for a single project. The word 'single' implies it is not for listing projects, but it does not explicitly name alternatives or state when not to use it. This is clear context without explicit exclusions, matching category 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_feedbackList BugSmash feedbackA
Retrieve all reviewer comments for a project. Maps to GET /comments?projectId. Prefer plainText=true for LLM consumption. Optionally include location metadata (pin/DOM/page).
| Name | Required | Description | Default |
|---|---|---|---|
| status | No | Client-side filter: only return comments with this status (Active or Resolved). The API returns all comments; filtering happens locally. | |
| plainText | No | Return comment bodies as plain text instead of HTML (default true for this tool) | |
| projectId | Yes | Project UUID whose comments to list | |
| locationMetadata | No | Include pin coordinates, DOM path, page number, and related location fields |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the HTTP method (GET), implies read-only behavior, states it returns all comments, and mentions optional location metadata. It does not mention authentication, response shape, or rate limits, but the disclosed details are useful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each adding distinct information: purpose, endpoint, plainText preference, and optional metadata. No filler or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a straightforward list operation with a fully described input schema. The description covers the essential behavior and optional parameters. The absence of an output schema is partially mitigated by the phrase 'reviewer comments' and the optional location metadata, though a brief mention of the response format would have improved completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds only a minor recommendation to prefer plainText=true for LLM consumption, which is already indicated as the default in the schema. No substantial new parameter semantics are provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Retrieve all reviewer comments for a project' with a specific verb and resource, and uses 'all' to distinguish from get_feedback. The endpoint mapping further clarifies the exact operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: this tool is for listing all comments for a project. However, it does not explicitly contrast with get_feedback or list_replies, though the word 'all' implies a distinction. No exclusion or alternative tool is named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_projectsList BugSmash projectsA
List review projects in the BugSmash workspace (paginated). Use this to discover project IDs before calling list_feedback. Maps to GET /projects.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (default 1) | |
| limit | No | Results per page (max 50) | |
| types | No | Filter by one or more content types | |
| folderId | No | Filter by folder UUID. Pass the string "null" for root-level projects only. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It discloses pagination behavior and the HTTP method GET, implying a read-only operation, which is valuable behavioral context. However, it doesn't describe response structure or any rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the primary action. Three short sentences each serve a distinct purpose: stating the function, explaining the use case, and noting the API endpoint. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with four optional parameters, the description covers scope, pagination, and intended usage context. It lacks an explicit description of the return payload, but the mention of 'discover project IDs' provides adequate context for an agent to invoke and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no new parameter-level meaning beyond the schema; it only mentions pagination, which is already captured by page/limit parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'List' with the resource 'review projects' and scoping 'in the BugSmash workspace'. It also distinguishes itself from sibling 'list_feedback' by framing its purpose as discovering project IDs before calling that tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states 'Use this to discover project IDs before calling list_feedback', providing both a clear when-to-use scenario and an explicit alternative tool. This satisfies the requirement for usage guidance beyond the basic function.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_repliesList comment repliesA
List all replies on a comment thread. Maps to GET /comment/{commentId}/replies.
| Name | Required | Description | Default |
|---|---|---|---|
| commentId | Yes | Parent comment UUID | |
| plainText | No | Return reply text as plain text (default true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the full burden of behavioral disclosure. It only states the action and REST endpoint, failing to mention important behaviors such as pagination, authorization requirements, response format, or any read-only guarantees. The read-only nature is implied by 'List' but not explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise, consisting of two sentences. The first sentence clearly states the purpose, and the second provides a useful REST endpoint mapping. Every word earns its place, with no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 params, no output schema, no annotations), the description is adequate but has gaps. It does not describe the return structure or any constraints like pagination or ordering, which would be helpful since no output schema exists to fill in those details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with both commentId and plainText having clear descriptions. The tool description adds no extra meaning about parameters, so it does not go beyond the baseline provided by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'List' with a clear resource: 'all replies on a comment thread.' It also maps to a specific endpoint (GET /comment/{commentId}/replies), distinguishing it from sibling tools like list_projects and list_feedback, which target different resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used to retrieve all replies for a given comment thread, but it provides no explicit comparison to alternatives or exclusions. No 'when to use this instead of...' guidance is given, so the usage context is only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
post_replyReply to a BugSmash commentB
Post a reply on an existing comment thread. Maps to POST /reply.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Reply text | |
| commentId | Yes | Parent comment UUID | |
| isPrivate | No | Make the reply private to the workspace (default false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It only states the action and HTTP mapping, but fails to mention authentication requirements, side effects, privacy implications (e.g., isPrivate default), or whether the operation is idempotent. This is a write operation, so these details are critical.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that directly states the action without unnecessary filler. It is appropriately concise for a simple tool, though it could expand on context without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a mutation tool with no annotations and no output schema, so the description must explain expected outcomes or error conditions. It merely says 'post a reply' without describing success behavior, required permissions, or how privacy/visibility works. Given the schema's presence, the description is under-specified for safe autonomous invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents all three parameters with complete descriptions (100% coverage), so the baseline is 3. The description adds minimal semantic value beyond the schema, though 'existing comment thread' hints that commentId must be valid, which is already implied by 'Parent comment UUID'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'post' and clearly identifies the resource ('a reply' on 'an existing comment thread'), which unambiguously distinguishes it from sibling tools like list_replies (read-only) and update_feedback (modifying feedback). The mapping to POST /reply reinforces the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention list_replies as the read counterpart, nor does it state any exclusions or prerequisites (e.g., requiring an existing comment thread). There is no context to help an agent decide between this and update_feedback.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_feedbackUpdate BugSmash commentA
Update a comment's text, status (e.g. mark Resolved), priority, or privacy. Maps to PATCH /comment/{commentId}. At least one field besides commentId is required.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | Updated comment text | |
| status | No | New status: "Active" or "Resolved" | |
| priority | No | Priority: "Unset", "P1", "P2", "P3", or "P4" | |
| commentId | Yes | Comment UUID to update | |
| isPrivate | No | Make the comment private (true) or public to reviewers (false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the HTTP method (PATCH, implying partial update) and the requirement that at least one field besides commentId must be provided. However, it does not mention permissions, side effects, idempotency, or return format, which could be important for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loaded with the action and resource, and includes the endpoint and a key constraint. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple update operation with five parameters and no output schema, the description covers the key aspects: what fields can be updated, the endpoint, and the requirement for a non-commentId field. It is slightly lacking in usage context (e.g., when to prefer this over other sibling tools), but overall sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are already well-documented. The description adds a critical constraint not in the schema: 'At least one field besides commentId is required.' This meaningfully clarifies parameter usage beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Update' and the resource ('a comment's text, status, e.g. mark Resolved, priority, or privacy'), and explicitly maps to PATCH /comment/{commentId}. This differentiates it from sibling tools like list_feedback and post_reply, which are read/create operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this to update an existing comment's fields. It does not explicitly name alternatives or exclusions, but the sibling tools are all read or create operations, so the purpose is implied. The mention of PATCH and the required-field constraint further clarify when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v1.0.1- First observed
get_feedback - First observed
get_project - First observed
list_feedback - First observed
list_projects - First observed
list_replies - First observed
post_reply - First observed
update_feedback
TDQS
Scored across 7 tools
Each tool targets a distinct resource and action: projects vs comments vs replies, and list/get vs update/post. No two tools overlap in purpose, making selection unambiguous.
All tool names follow a consistent verb_noun pattern (list_projects, get_project, get_feedback, list_feedback, update_feedback, list_replies, post_reply), with no stylistic deviations.
With 7 tools, the server is well-scoped for its purpose. Each tool is necessary and non-redundant, covering project discovery, feedback retrieval/update, and reply management.
The tool set provides complete coverage for the domain: discover projects, fetch project details, list/get feedback, update feedback, and manage reply threads. No critical operations are missing for the intended workflow.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
MCP server that lets AI assistants use all OneSchema features exposed via the public API.
MCP server providing access to the Scorecard API to evaluate and optimize LLM systems.
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
Related MCP Servers
- AlicenseAqualityCmaintenanceA MCP server for interacting with FogBugz issue tracker through LLMs such as Claude. Supports both the XML API (/api.asp) and the JSON API (/f/api/0/jsonapi) with automatic version detection at startup. Works with on-premise and on-demand FogBugz installations.1952MIT
- AlicenseNot gradedqualityDmaintenanceAn MCP server that enables language models to query and manage Gerrit code reviews via the REST API.1Apache 2.0
- AlicenseAqualityCmaintenanceMCP server that exposes code review tasks from the Fix My Comments VS Code extension to AI agents, enabling them to list, retrieve, reply to, and update task statuses.49MIT
- AlicenseNot gradedqualityAmaintenanceMCP server for Open Feedback, enabling AI assistants to submit, list, get, update status of, and analyze product feedback via a local HTTP API and JSONL storage.346Apache 2.0