Docs / Security testing

Security testing

MCP Test Harness owns the CI gate: deterministic security payloads, auth boundaries, quality gate, and manifest rug-pull. Runtime enforcement stays with MCP-Bastion.

Full rationale: Why security-first in the handbook.

What to enable

quality_gate:
  require_security_tests: true
  fail_on_severity: high
manifest_gate:
  enabled: true
  path: __snapshots__/mcp_manifest.snap

Commands

mcp-test -m security
mcp-test --sarif-output findings.sarif
mcp-test manifest check
mcp-test --report-format html --report-output report.html

Lifecycle

Scan / config → Test / CI (this harness) → Enforce / runtime (Bastion)

Canonical guide: SECURITY_TESTING.md