blop
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| BLOP_ENV | No | Environment mode (production enables stricter validation expectations) | development |
| LOGIN_URL | No | Where blop navigates to log in | |
| APP_BASE_URL | No | Default app URL (used as fallback if no URL passed to tools) | |
| BLOP_DB_PATH | No | Where blop stores its database | .blop/runs.db |
| BLOP_HEADLESS | No | false = show browser window during tests (useful for debugging) | true |
| TEST_PASSWORD | No | Login password | |
| TEST_USERNAME | No | Login email/username | |
| BLOP_API_TOKEN | No | Blop Cloud API token | |
| BLOP_DEBUG_LOG | No | JSON log destination path | .blop/blop.log |
| BLOP_MAX_STEPS | No | Max steps the AI agent takes per flow | 50 |
| GOOGLE_API_KEY | Yes | Gemini API key. Get one free at aistudio.google.com | |
| BLOP_HOSTED_URL | No | Blop Cloud sync URL | |
| BLOP_PROJECT_ID | No | Blop Cloud project ID | |
| COOKIE_JSON_PATH | No | Path to exported browser cookies (JSON array) | |
| BLOP_ALLOWED_HOSTS | No | Optional host allowlist for app_url validation | |
| BLOP_SPA_SETTLE_MS | No | Extra settle time in ms after SPA navigation | 1500 |
| STORAGE_STATE_PATH | No | Path to a saved Playwright session (for SSO/OAuth) | |
| BLOP_COMPAT_HEADLESS | No | Run compatibility browser session headless or headed | true |
| BLOP_RUN_TIMEOUT_SECS | No | Total run timeout in seconds (0 disables timeout) | 0 |
| BLOP_COMPAT_OUTPUT_DIR | No | Where compatibility artifacts (snapshots/screenshots/storage-state files) are written | .playwright-mcp |
| BLOP_NETWORK_IDLE_WAIT | No | Seconds to wait for network idle after page load | 2.0 |
| BLOP_STEP_TIMEOUT_SECS | No | Per-step replay timeout in seconds | 45 |
| TEST_PASSWORD_SELECTOR | No | CSS selector for the password input field | auto-detected |
| TEST_USERNAME_SELECTOR | No | CSS selector for the username input field | auto-detected |
| BLOP_AGENT_MAX_FAILURES | No | Max recoverable action failures before agent aborts recording | profile-driven |
| BLOP_ALLOW_INTERNAL_URLS | No | Block private/internal app URLs unless explicitly enabled | false |
| BLOP_DISCOVERY_MAX_PAGES | No | Default crawl page cap for discovery tools | profile-driven |
| BLOP_ENABLE_COMPAT_TOOLS | No | Registers legacy/compat MCP tool surface when true | false |
| BLOP_EXPLORATION_PROFILE | No | Tuning preset (default or saas_marketing) for discovery and replay behavior | default |
| BLOP_ALLOW_SCREENSHOT_LLM | No | Privacy guard for visual-regression triage | false |
| BLOP_CAPABILITIES_PROFILE | No | Predefined capability profile (production_minimal, production_debug, full) | env-dependent |
| BLOP_COMPAT_SNAPSHOT_MODE | No | Snapshot mode hint for compatibility workflows | incremental |
| BLOP_REQUIRE_ABSOLUTE_PATHS | No | Require absolute paths for DB/runs/log values | false |
| BLOP_COMPAT_TEST_ID_ATTRIBUTE | No | Preferred test id attribute used when building element selectors | data-testid |
| BLOP_AGENT_MAX_ACTIONS_PER_STEP | No | Max agent actions per reasoning step during recording | profile-driven |
Capabilities
Features and capabilities supported by this server
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| save_auth_profileA | Save an authentication profile for use in test runs. Args: profile_name: Unique name for this profile auth_type: One of "env_login", "storage_state", or "cookie_json" login_url: Login page URL (required for env_login) username_env: Name of env var holding the username (default: TEST_USERNAME) password_env: Name of env var holding the password (default: TEST_PASSWORD) storage_state_path: Path to a Playwright storage_state.json file cookie_json_path: Path to a JSON file containing cookie objects user_data_dir: Optional path to a persistent Chromium profile directory (helps with anti-bot OAuth) Returns: dict with profile_name, auth_type, status, note |
| capture_auth_sessionA | Open a headed browser for interactive OAuth/MFA login and save the session state. A browser window opens — complete Google/GitHub OAuth or any MFA flow manually. The tool polls the URL every 500ms and saves storage state automatically once login succeeds. Args: profile_name: Name to save the auth profile under login_url: URL of the login page to open success_url_pattern: URL substring that indicates successful login (e.g. "/dashboard") If omitted, any URL change away from login_url counts as success timeout_secs: Max seconds to wait for login (default: 120) user_data_dir: Optional path to a persistent Chromium profile dir (for OAuth providers that detect fresh browser contexts as bots, e.g. Google, LinkedIn) Returns: dict with profile_name, requested_profile_name, status ("captured" | "timeout" | "error"), storage_state_path, note |
| evaluate_web_taskA | Run a browser agent for a natural-language task and return a rich evaluation report. One-shot evaluator — give it a URL and a task, get back a structured report with screenshots, console errors, network failures, and an agent step timeline. No need to discover/record/replay first. Args: app_url: The website URL to evaluate task: Natural-language description of what to test (e.g. "Try the signup flow and note UX issues") profile_name: Optional auth profile name for authenticated pages headless: Run browser in headless mode (default: False — shows the browser) max_steps: Maximum agent steps (default: 25) capture: Evidence to capture: "screenshots", "console", "network", "trace" (default: all four) format: Report format: "markdown" (default), "text", or "json" save_as_recorded_flow: If True, promote the evaluation into a recorded flow for regression flow_name: Flow name to use when saving as recorded flow (auto-generated if omitted) Returns: dict with summary, agent_steps, evidence (console_errors, network_failures, screenshots, trace_path), pass_fail, run_id, and formatted_report |
| cancel_runB | Cancel a running test and mark it as cancelled. Args: run_id: The run_id to cancel Returns: dict with run_id, previous_status, new_status |
| record_test_flowA | Record a test flow by running a Browser-Use agent to accomplish a goal. Captures each action with selector, target_text, dom_fingerprint, per-step screenshots, and generates final assertion steps from a Gemini screenshot analysis. Args: app_url: The website URL to test flow_name: Short name for this flow (used as identifier) goal: Plain-English description of what to accomplish profile_name: Optional auth profile name (from save_auth_profile) command: Optional natural language command for additional context business_criticality: "revenue" | "activation" | "retention" | "support" | "other" Returns: dict with flow_id, flow_name, step_count, status, artifacts_dir |
| package_authenticated_saas_baselineA | Package reusable authenticated SaaS goldens into strict-step release-gate flows. Use this after discovery or live exploration when you know the stable semantic path you want to gate on. It promotes curated recipes into recorded flows that replay in strict_steps mode and are ready for run_release_check(mode="replay"). Supported recipe_type values:
|
| get_test_resultsA | Get structured results for a test run. Prefer run_release_check + blop://release/{release_id}/brief for release gating. This tool remains the detailed run-level payload, now with summary-first fields. Args: run_id: The run_id returned from run_regression_test Returns: dict with run_id, status, cases (with assertion_results, replay_mode_used, step_failure_index, artifact_paths), severity_counts, failed_cases, next_actions |
| get_process_insightsB | Derive process-mining style variants from run health events (optional PM4Py when installed). Uses replay_step_completed and other health events. Install |
| export_run_traceA | Export OTLP-shaped JSON (resourceSpans) for a run — local SQLite only, no network upload. |
| debug_test_caseA | Re-run a failed test case in headed mode with verbose evidence capture. Shows the exact step that failed, repair attempt results, per-step screenshots, and a plain-English "why this failed" explanation with concrete next actions. Args: run_id: The run_id containing the failure case_id: The case_id of the specific failure to debug Returns: dict with case_id, run_id, status, screenshots, console_log, repro_steps, step_failure_index, replay_mode, assertion_failures, why_failed |
| get_mcp_capabilitiesA | O(1) probe: package version, surface flags, registered tool count, and canonical tool names. Use this or the |
| validate_release_setupA | Preflight check before a release: verifies API key, Chromium, DB, app reachability, and auth profile. This is the canonical MVP entry point — run this before discover_critical_journeys or run_release_check. Args: check_mobile: If True, also checks Appium server reachability for mobile testing. |
| discover_critical_journeysB | Crawl app_url and plan 3-8 critical user journeys in business language. Returns CriticalJourney objects with why_it_matters and include_in_release_gating fields so you can immediately scope which journeys gate a release. Revenue and activation journeys are automatically flagged for release gating. |
| run_release_checkA | Flagship release confidence tool: replay critical journeys and return a SHIP / INVESTIGATE / BLOCK decision. In replay mode (default), queues a regression run and returns immediately with run_id for polling. In targeted mode, runs a one-shot agent evaluation synchronously as a shortcut smoke check. Args: journey_ids: deprecated alias for flow_ids. flow_ids: recorded flow IDs to replay. If omitted, uses all flows matching criticality_filter. criticality_filter: defaults to ["revenue", "activation"]. release_id: optional caller-supplied release identifier (auto-generated if omitted). mode: "replay" (default, golden path for release gating) or "targeted" (one-shot eval). smoke_preflight: Optional advisory smoke sweep before replay. Does not block the release on its own. |
| triage_release_blockerA | Root-cause evidence + next actions for a release blocker. Accepts any of: run_id, release_id, flow_id, journey_id, incident_cluster_id (at least one required). Returns BlockerTriage with likely_cause, evidence_summary, user_business_impact, recommended_action, suggested_owner, and linked_artifacts. |
| get_qa_recommendationsA | QA-engineering view: test pyramid health, coverage gaps, flakiness signals, and prioritized recommendations. Aggregates recorded journeys and recent run cases for app_url, then returns a RecommendationSet plus embedded qa_context (risk matrix, defect mix, pyramid stats). Use scope to narrow the recommendation lists. |
| get_workspace_contextA | Return compact workspace metadata, resource URIs, and discovery defaults. |
| get_release_contextB | Return structured release brief (decision, risk, blockers) for a release_id. |
| get_journeys_for_releaseC | List recorded journeys filtered by release brief app_url or explicit app_url. |
| get_release_and_journeysC | Batch: release context plus journeys for the release app URL in one call. |
| get_prd_and_acceptance_criteriaC | Summaries and acceptance-style criteria from recorded flows / release brief (no external PRD yet). |
| get_ux_taxonomyA | Static UX/criticality hints for planning (cached, small JSON). |
| navigate_to_urlB | Navigate the shared browser session to a URL (ok/data envelope). |
| navigate_to_journeyC | Open a recorded journey's entry URL (flow_id == journey_id). |
| get_page_snapshotC | Compact interactive DOM snapshot (ARIA-ish) for the current page. |
| perform_stepC | One structured step: click | type | wait | press_key | navigate (see PerformStepSpec). |
| capture_artifactA | Capture screenshot, dom_snapshot, or network_log; optional run_id routes under runs/. |
| record_run_observationB | Idempotent agent observation keyed by (run_id, observation_key). |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| discover_critical_flows | |
| setup_auth | |
| run_smoke_regression | |
| record_flow_with_structure | |
| debug_failed_case | |
| context_first_discovery | |
| context_guided_regression | |
| observability_control_plane | |
| quick_web_eval | |
| release_readiness_review | |
| investigate_blocker | |
| explain_release_risk |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| health_resource | Server health check: DB reachability, LLM key, Chromium, active run count. |
| prompts_list_resource | Debug/internal resource: list available prompt templates with previews. |
| v2_contracts_resource | V2 MCP tool contracts: request/response schemas + examples. |
| journeys_resource | All recorded journeys as CriticalJourney-shaped objects. |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/n2400813g/blop-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server