MCP API
Give Claude, Cursor or any MCP client read access to your Test & Feedback reports — and the session running right now. The agent pulls console, network, repro steps, environment and screenshots into context and fixes the bug. No copy-paste.
Endpoint
https://report.teifi.work/api/mcp
Transport: streamable HTTP (MCP). Access is read-only and scoped to your Linear organization.
Authentication
Send a bearer token in the Authorization header. Two kinds work:
- A Portal Snapshot token (recommended) — create one in the extension dashboard (⚙ → MCP access). It works on its own, so the agent never needs a Linear key. Starts with
tk_. - A Linear API key — a personal API key from Linear (Settings → Security & access). The organization must be authorized.
Connect
Claude Code
claude mcp add --transport http teifi-reports \ https://report.teifi.work/api/mcp \ --header "Authorization: Bearer <your-token>"
Cursor / Claude Desktop — .mcp.json / mcp.json
{
"mcpServers": {
"teifi-reports": {
"url": "https://report.teifi.work/api/mcp",
"headers": { "Authorization": "Bearer <your-token>" }
}
}
}After adding, restart the client (or run /mcp in Claude Code) so the tools load.
Tools
list_reports(query?, limit?)
Parameters: query — optional title filter. limit — optional (default 20, max 50).
Returns: An array of recent reports: id, title, url, createdAt, findingCount, hasErrors.
Example response
[
{
"id": "63db0966-3f38-41f5-a6da-a40e470691ac",
"title": "Checkout total is undefined",
"url": "https://report.teifi.work/r/63db0966-…",
"createdAt": "2026-07-16T17:16:05.082Z",
"findingCount": 2,
"hasErrors": true
}
]get_report(id)
Parameters: id — the report UUID (from list_reports or a /r/<id> link).
Returns: One report: title, severity, fingerprint and findings — each with note, steps, environment, console (with stack traces), network (failed + all, with redacted request/response bodies) and screenshot/video URLs.
Example response
{
"title": "Checkout total is undefined",
"severity": "critical",
"fingerprint": "ef013bcde93421a6",
"url": "https://report.teifi.work/r/63db0966-…",
"activity": ["Open /checkout", "Apply coupon", "Click pay"],
"findings": [
{
"note": "Total shows undefined after coupon",
"severity": "critical",
"steps": ["Apply coupon SAVE10", "Click Pay"],
"env": { "url": "https://app.example.com/checkout", "browser": "Chrome 149", "os": "macOS" },
"media": [{ "type": "image", "url": "https://cdn.teifi.work/images/…png" }],
"console": [{ "level": "error", "text": "TypeError: cannot read 'total'…", "stack": ["at computeCart (cart.js:142:19)"] }],
"network": [{ "ok": false, "status": 500, "method": "POST", "url": "/api/pricing", "resBody": "{\"error\":\"coupon_service_timeout\"}" }]
}
]
}get_active_session()
Parameters: None.
Returns: The session in progress for your org (or a note if none): live console, network and repro steps as they happen, plus any findings captured so far. Goes stale 10 minutes after the last update.
Example response
{
"id": "…",
"title": "Test session — 7/17/2026",
"active": true,
"updatedAt": "2026-07-17T00:29:05Z",
"liveUrl": "https://app.example.com/checkout",
"env": { "browser": "Chrome 149", "os": "macOS" },
"steps": ["Open /checkout", "Apply coupon"],
"console": [{ "level": "error", "text": "TypeError: cannot read 'total'…" }],
"network": [{ "ok": false, "status": 500, "url": "/api/pricing" }],
"findingsSoFar": []
}Typical workflows
- Fix a filed bug:
list_reports→ pick the id →get_report(id)→ reproduce & fix. - Fix from a link: paste a
/r/<id>URL →get_report(id). - Watch a live repro: poll
get_active_session()while a tester reproduces the bug — see the error the moment it appears, then fix.
Best practices & security
- One token per client/machine. Label it so you can revoke precisely.
- Treat the token as a secret. It grants read access to every report in your org — never commit it, paste it in chat/PRs, or put it in a screenshot.
- Copy it once. Tokens are shown only at creation; store them in your client config.
- Rotate on exposure or loss. Revoke in the dashboard and mint a new one — old tokens keep working until revoked.
- Read-only by design. The tools only read — an agent cannot create, edit or delete anything through MCP.
- Secrets are redacted server-side: auth headers, bearer tokens, JWTs and sensitive query params are stripped; recording inputs are masked.