MCP bridge for the Qiksy browser extension — expose live QA findings, forms, network and session to any MCP-capable coding agent.
npm · fingerprint 9290efe651f8a479a1a6b07b · repository · RSS
2 descriptions rewritten, 2 tools added.
--- pinned/qa_click +++ observed/qa_click { - "description": "Click an element on the page under test — by a qa_snapshot ref, by a CSS selector, or by the control's accessible `name` (the one to use right after a fill, since filling re-renders the step and staleness is what makes a ref refuse). Sends the full pointer sequence (pointerdown → mouseup → click), so component libraries that listen for pointerdown — Radix, shadcn, MUI — react to it like a real click. Scrolls the element into view first, and refuses a target that matches nothing or has zero size rather than silently doing nothing. Returns what the click CHANGED — what appeared, disappeared or updated once the page settled — so you do not need a follow-up qa_snapshot to find out whether it did anything. `changed: null` means the page did not move, which is itself the answer. On a recent extension build the reply also carries `announced` — what the page's live regions (aria-live / role=status / role=alert) actually spoke during the settle window, or null if they stayed silent: a toast that appeared in `changed` but not in `announced` is invisible to a screen reader (WCAG 4.1.3). Requires Qiksy Pro and the one-time “Agent control” confirmation in the panel; without both the extension answers pro-required / consent-required and does nothing.", + "description": "Click an element on the page under test — by a qa_snapshot ref, by a CSS selector, or by the control's accessible `name` (the one to use right after a fill, since filling re-renders the step and staleness is what makes a ref refuse). Sends the full pointer sequence (pointerdown → mouseup → click), so component libraries that listen for pointerdown — Radix, shadcn, MUI — react to it like a real click. Scrolls the element into view first, and refuses a target that matches nothing or has zero size rather than silently doing nothing. Returns what the click CHANGED — what appeared, disappeared or updated once the page settled — so you do not need a follow-up qa_snapshot to find out whether it did anything. `changed: null` means the page did not move, which is itself the answer. On a recent extension build the reply also carries `announced` — what the page's live regions (aria-live / role=status / role=alert) actually spoke during the settle window, or null if they stayed silent: a toast that appeared in `changed` but not in `announced` is invisible to a screen reader (WCAG 4.1.3). AND WHEN THE PRESS NAVIGATED there is no diff to give: the reply carries `navigated: <the new url>` instead. That IS what the press did — do not press again, a second one would land on the NEXT page rather than repeat this one. Requires Qiksy Pro and the one-time “Agent control” confirmation in the panel; without both the extension answers pro-required / consent-required and does nothing.", "execution": { "taskSupport": "forbidden" },
+ tool added: qa_screenshot
--- pinned/qa_upload +++ observed/qa_upload { - "description": "Put a file into an <input type=file> — including the hidden ones behind a styled dropzone, which a click can never reach. Three ways to choose what goes in: `fixture` for a hostile edge-case file (the upload counterpart of naughty strings — empty, oversize, wrong-type, corrupt, unicode name, unsanitised SVG…), `path` for a file on this machine, or `content` as base64. Pass `content` as base64 to attach a file YOU generated (a PDF fixture, a malformed CSV, an oversized image); omit it and Qiksy attaches a neutral test file matched to the field's `accept`. A content script has no filesystem access and the OS file picker is a modal an agent must never open, so bytes over this bridge are the only way a file from outside the browser gets in. Delivery fires both paths uploaders use — assigning `input.files` + change, and a synthetic drop on the nearest dropzone — because react-dropzone-style components listen only for the second. SEVERAL FIELDS IN ONE CALL: pass `files` — an array of the same arguments — and they are attached in order, one round trip for the whole step instead of one per file.", + "description": "Put a file into an <input type=file> — including the hidden ones behind a styled dropzone, which a click can never reach. Three ways to choose what goes in: `fixture` for a hostile edge-case file (the upload counterpart of naughty strings — empty, oversize, wrong-type, corrupt, unicode name, unsanitised SVG…), `path` for a file on this machine, or `content` as base64. Pass `content` as base64 to attach a file YOU generated (a PDF fixture, a malformed CSV, an oversized image); omit it and Qiksy attaches a neutral test file matched to the field's `accept`. A content script has no filesystem access and the OS file picker is a modal an agent must never open, so bytes over this bridge are the only way a file from outside the browser gets in. AND WHERE THERE IS NO FILE INPUT AT ALL — a button that calls the native picker straight away, as YouTube Studio's audio-language dialog does — name that button with `field` and the file is handed to the picker it opens, exactly as a person choosing it would. The reply says `via` when that route was used, and it says so only when the page actually took the file. Delivery fires both paths uploaders use — assigning `input.files` + change, and a synthetic drop on the nearest dropzone — because react-dropzone-style components listen only for the second. SEVERAL FIELDS IN ONE CALL: pass `files` — an array of the same arguments — and they are attached in order, one round trip for the whole step instead of one per file.", "execution": { "taskSupport": "forbidden" },
+ tool added: qa_wait_for
If you run this server, put the proxy in front of it. It pins these exact fingerprints on first connect and stops the session if they move.
npx --yes mcp-pin@0.1.0 -- <your qiksy-mcp command>Or subscribe to this page's RSS feed to be told when it changes.
The badge states one fact about time and nothing else. It never claims a server is safe.
[](https://mcp-pin.gautamkhosla.com/servers/ec41970852a8356d.html)