windows-mcp-tool-tester — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited windows-mcp-tool-tester (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An automated testing skill that generates comprehensive test cases for a single Windows-MCP tool, executes them, and produces a structured test report with pass/fail results, performance metrics, and actionable recommendations.
destructive tools (FileSystem delete, Registry set/delete, Process kill, PowerShell) can modify or destroy data. Running in a VM or Windows Sandbox is strongly recommended. Before executing destructive test cases, confirm the user accepts the risk. See SECURITY.md.
If the user hasn't specified a tool, present the full list and ask them to pick one:
App, PowerShell, Screenshot, Snapshot, Click, Type, Scroll, Move, Shortcut, Wait, MultiSelect, MultiEdit, Clipboard, Process, Notification, FileSystem, Registry, Scrape
Once a tool is confirmed, proceed to Step 1. Do NOT test multiple tools in one session.
Read the tool's MCP description and parameter schema via the MCP server's tool listing. Identify:
Use this analysis to inform test case generation. If the description is ambiguous or silent on a behavior, note it as a documentation gap and design a test to probe it. The tool's response is the ground truth.
Design test cases that cover the following categories. Not every category applies to every tool — use judgment based on the tool's nature.
Test the tool's primary purpose with standard, well-formed inputs.
anyOf: [boolean, string] (e.g., drag, use_vision): test boolean true/false AND string "true"/"false" — both must produce the same behavior."true" (string) to true (boolean)before the tool sees it. To genuinely probe the string path, also test non-standard truthy strings like "yes" or "1" — if those fail while "true" passes, the tool likely only receives booleans and the string branch is untested.
anyOf: [<type>, null] (nullable): test with a valid value AND explicit null. An unhandled TypeError on null is a FAIL.loc and label)mode while calling another (e.g., window_loc in launch mode). Silently ignoring them is a documentation gap worth reporting.
idempotentHint: true: call twice with same args, verify same resultFor each test case, define:
ID: TC-{ToolName}-{Number}
Category: A/B/C/D/E/F
Description: What this test verifies
Parameters: The exact parameters to pass
Expected: What a correct result looks like (success/failure, key content in response)
Setup: Any prerequisite actions (create a file, open an app, etc.)
Teardown: Any cleanup actions after the testPresent the test plan to the user for confirmation before executing. Aim for 10-20 test cases depending on tool complexity.
Include an estimated execution time: approximately 30-45 seconds per test case (includes timing calls, tool execution, verification). App launches add 5-10s extra. Present as a range, e.g., "Estimated execution time: 8-12 minutes (15 test cases)".
Before running test cases, collect the test environment details for the report. Use these PowerShell commands for reliable results:
# OS version
(Get-CimInstance Win32_OperatingSystem).Caption + " " + (Get-CimInstance Win32_OperatingSystem).Version
# Display resolution (physical pixels)
Get-CimInstance Win32_VideoController | Select-Object CurrentHorizontalResolution, CurrentVerticalResolution
# Display count
(Get-CimInstance Win32_PnPEntity | Where-Object { $_.PNPClass -eq 'Monitor' -and $_.Status -eq 'OK' }).Count
# DPI scale factor (96 = 100%, 120 = 125%, 144 = 150%, 192 = 200%)
Get-ItemProperty 'HKCU:\Control Panel\Desktop\WindowMetrics' -Name AppliedDPI -ErrorAction SilentlyContinue | Select-Object -ExpandProperty AppliedDPIAlso call Screenshot once — its Screenshot Original Size cross-checks the DPI value, and its output includes Active Desktop and All Desktops.
For input tools (Type, Click, Scroll, Move, Shortcut, MultiSelect, MultiEdit), prepare the environment before executing any test cases:
shows a non-English input mode (e.g., "Chinese Mode", "Japanese Mode"), switch to English mode first using the Shortcut tool (typically shift to toggle). This is critical for Type tool tests — an active IME will intercept keystrokes and produce incorrect characters. Record the original IME state and restore it after testing.
element you intend to use with label parameter is actually listed in the Interactive Elements. Common pitfalls:
in the UI tree — use loc coordinates instead.
elements. If a planned label-based test has no valid label target, adapt the test to use loc, or pick a different element that does have a label (e.g., a search box, address bar).
the MCP connection, window focus, and UI tree cache. First calls are typically slower due to cold start effects — excluding them gives more representative performance numbers.
Run each test case sequentially. For each test:
Label freshness rule: Snapshot labels are a point-in-time snapshot. If any action between tests could change the UI state, call Snapshot again before using label parameters.State reset between tests: Each test case should start from a known, clean state. For input tools sharing a test window (e.g., Notepad), define a standard reset procedure and execute it in Setup: - Type tests: Shortcut (Ctrl+A) → Shortcut (Delete) to clear the text area - Click/Move tests: Move cursor to a neutral position away from interactive elements - Scroll tests: Reset scroll position to top (Ctrl+Home)
>
If a test's Setup includes clear=true in the tool call itself, you may skip the manual reset — but verify in the teardown that the state is clean for the next test.When spawning processes, record their PIDs for teardown (see Test Isolation Guidelines).
[long](([System.DateTime]::UtcNow - [System.DateTime]::UnixEpoch).TotalMilliseconds)Save the returned integer as $t_start.
$t_end.elapsed_ms = $t_end - $t_start. Note: this includes MCPoverhead from the timestamp calls themselves (~3-5s each). Use for relative comparison between test cases only. When testing the PowerShell tool itself, timing is self-referential — record times as N/A (self-referential) and rely on the PowerShell tool's own timeout behavior and status codes for performance assessment instead.
response_size:note +image in the report. Do not attempt to measure image byte size.
rely solely on the tool's return value. Never skip or sample. Rule: verification MUST NOT use the same tool under test. Use a different tool (preferably PowerShell) to cross-check. Verification methods:
Get-Clipboard to captureexact text for comparison.
Get-Process) to verify process exists, andScreenshot/Snapshot to verify window position/size.
Test-Path, Get-Content, Get-ChildItem)— never with the FileSystem tool itself.
Get-ItemProperty, reg query)— never with the Registry tool itself.
Get-Clipboard)— never with the Clipboard tool itself.
Get-Process -Id $pid)— never with the Process tool itself.
"tool reported success but side effect not confirmed" in the root cause analysis.
IMPORTANT: Never estimate response times. Always use the PowerShell measurement above. If unavailable, record N/A and explain why.| Result | Meaning |
|---|---|
| PASS | Response matches expected behavior exactly |
| SOFT PASS | Response is acceptable but slightly different from ideal (e.g., extra whitespace, ordering) |
| FAIL | Response doesn't match expected behavior — includes cases where the tool rejects schema-valid input. Never look up source code to explain away a failure. |
| ERROR | Tool threw an unexpected exception or timed out |
| SKIP | Test couldn't run due to missing prerequisites (document why) |
If a planned test case cannot execute as designed (e.g., the target element has no label in the UI tree, or a required window state cannot be achieved), decide:
locinstead of label, use a different target app). Update the test case description and note the adaptation in the report. Adapting is preferred over skipping when the test intent is still achievable.
For each test case, record response time (ms) via PowerShell timestamps and response size (character count of the raw response text).
Warm-up effect: The first 1-2 tool calls in a session are typically slower due to MCP connection warm-up, UI tree cache initialization, and window focus acquisition. If warm-up calls were performed in Pre-Test, note this in the report. If not, flag the first test case's timing as potentially inflated and exclude it from aggregate statistics (average, median, P95) or mark it separately.
Localization: If the user specified a language, write the entire report in that language (headings, tables, commentary, recommendations). Keep test case IDs (e.g., TC-Move-01) in English. The template below is a structural reference — translate all prose while preserving the markdown structure.
# Windows-MCP Tool Test Report: {ToolName}
**Date:** {timestamp}
**Tool:** {ToolName}
**Total Test Cases:** {N}
**PASS:** {P} | **SOFT PASS:** {SP} | **FAIL:** {F} | **ERROR:** {E} | **SKIP:** {S}
**Overall Pass Rate:** {(P+SP)/N * 100}%
---
## 1. Test Environment
{Record the environment to aid reproducibility. Data gathered in Pre-Test step.}
| Item | Value |
|--------------------------|----------------------------------------------------------|
| OS Version | {e.g., Windows 11 Pro 10.0.26200} |
| Display Resolution | {e.g., 2560x1440} |
| Screenshot Original Size | {e.g., 3840x2160 — this is resolution x scale factor} |
| Display Count | {e.g., 1} |
| Active Virtual Desktop | {e.g., Desktop 1} |
| MCP Transport | {e.g., SSE via http://localhost:8088/sse} |
| Scale Factor | {e.g., 150% (AppliedDPI=144)} |
---
## 2. Executive Summary
{2-3 sentences summarizing the overall health of the tool. Highlight critical failures if any.
Note any patterns — e.g., "all error-handling tests failed" or "basic functionality is solid
but Unicode support is incomplete." Also assess these dimensions when relevant:}
- **Error message quality**: descriptive and actionable, or cryptic?
- **Input validation**: does the tool validate params before executing, or fail deep with confusing errors?
- **Consistency**: do repeated calls with same params return consistent results?
- **Graceful degradation**: when prerequisites are missing, does the tool explain what's needed?
---
## 3. Failed & Error Test Cases
{For each non-passing test case, provide:}
### TC-{ID}: {Description}
- **Category:** {category}
- **Parameters:** `{params}`
- **Expected:** {what should have happened}
- **Actual:** {what actually happened}
- **Side-Effect Verification:** {what the independent verification revealed, if applicable}
- **Root Cause Analysis:** {your best assessment of why it failed}
- **Suggested Fix:** {actionable recommendation for the developer}
{If all tests passed, write: "All test cases passed. No issues to report."}
---
## 4. Performance Analysis
> **Note:** All times are end-to-end measurements including MCP transport overhead
> (serialization, network round-trip, SSE/stdio latency). They do NOT represent pure tool
> execution time. Use these numbers for **relative comparison** and outlier detection — not
> as absolute benchmarks. For pure execution time, check server-side logs with
> `WINDOWS_MCP_PROFILE_SNAPSHOT=1`.
### Response Time
| Test Case | Time (ms) | Assessment |
|-----------|-----------|------------|
| TC-XXX-01 | 6500 | Normal |
| TC-XXX-02 | 15200 | Slow |
| ... | ... | ... |
**Average:** {avg} ms | **Median:** {median} ms | **P95:** {p95} ms | **Max:** {max} ms
**Assessment thresholds (end-to-end including MCP overhead):**
- Fast: < 5000ms
- Normal: 5000ms – 10000ms
- Slow: 10000ms – 20000ms
- Very Slow: > 20000ms
{Commentary on any outliers or concerning patterns. When a test case is significantly slower
than peers, note possible causes: app launch wait, UI tree traversal, screenshot capture, etc.}
### Response Size
| Test Case | Response Size (chars) |
|-----------|-----------------------|
| TC-XXX-01 | 245 |
| ... | ... |
{Note any unexpectedly large or empty responses.}
---
## 5. Environmental Interference & Notes
{List any environmental factors that affected test execution but are not bugs in the tool itself.
These factors help future testers reproduce results and avoid false failures.}
| # | Factor | Impact | Mitigation |
|---|--------|--------|------------|
| 1 | {e.g., IME in Chinese mode} | {e.g., TC-Type-01 typed wrong characters} | {e.g., Switched IME to English before retesting} |
| ... | ... | ... | ... |
**Common environmental factors:**
- **IME state**: Active non-English input methods intercept keystrokes (affects Type, Shortcut)
- **Notification popups**: System or app notifications may steal focus mid-test
- **Background app focus changes**: Chat apps, update dialogs may overlay the test window
- **Screen lock / screensaver**: Can interrupt long-running test sessions
- **Clipboard managers**: Third-party clipboard tools may interfere with Clipboard tests
{If no environmental interference occurred, write: "No environmental interference observed."}
---
## 6. Documentation & Schema Gaps
{List any discrepancies between the tool's MCP parameter schema / description and its actual
behavior or environmental interactions. These are not necessarily bugs — they are places where
the documentation or schema could be improved to set correct expectations for callers.}
| # | Gap Type | Description | Recommendation |
|-----|-----------------------------------|-------------|----------------|
| 1 | {schema / description / behavior} | {desc} | {rec} |
| ... | ... | ... | ... |
**Gap Types:**
- **schema**: parameter schema (types, required/optional, allowed values) does not match actual behavior
- **description**: tool description is silent or ambiguous about a behavior that testing revealed
- **behavior**: tool behaves inconsistently with what the schema + description together imply
{If no gaps were found, write: "No documentation or schema gaps identified."}
---
## 7. All Test Cases
| ID | Category | Description | Result | Time (ms) | Response Size |
|------------|------------|-------------|--------|-----------|---------------|
| TC-XXX-01 | A - Basic | {desc} | PASS | 6500 | 245 |
| TC-XXX-02 | B - Params | {desc} | FAIL | 8200 | 310 |
| ... | ... | ... | ... | ... | ... |To avoid polluting the system or interfering with user state:
%TEMP%\wmcp-test-{timestamp}\).Clean up after all tests complete.
HKCU:\Software\WMCP-Test-{timestamp}.Delete the entire key after testing.
sacrificial process first (e.g., notepad.exe) and record its PID.
spawned during testing (use (Start-Process notepad -PassThru).Id or query process list before/after launch). In teardown, only kill processes by PID — NEVER by name (e.g., Stop-Process -Id $pid, not Stop-Process -Name notepad), because the user may have their own instances of the same application running.
multiple tabs. Diff the process list before/after each launch to detect new PIDs. Only kill PIDs that did not exist before testing began.
(e.g., Notepad) to receive input. Don't interact with user's active work. See also Pre-Test Step 2 for IME state handling — switch to English input mode before testing and restore the original state in final teardown.
notifications. Prefer a single clearly labeled test notification per test case.
Hints per tool. Always read the actual schema to discover additional scenarios beyond these.
echo "hello", Get-Date, Get-Process | Select-Object -First 3Get-Item nonexistent)keystroke simulation rather than Unicode input). This is a high-value edge case because many Windows machines have non-English IMEs installed.
Plane (e.g., 🌍, 😀) to verify supplementary plane Unicode support.
text="" — this is a common edge case that may crash if theimplementation indexes into the string without a length check.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.