Polarion Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Polarion Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A comprehensive Model Context Protocol (MCP) server for Siemens Polarion ALM integration, with full support for test case management, test runs, and result reporting.
pip install fastmcp requests openpyxl xmltodictcd ~/Documents/GitHub
git clone <repo-url> polarion-mcp-server
cd polarion-mcp-serverpip install -r requirements.txtexport POLARION_TOKEN="your-personal-access-token"
export POLARION_URL="https://polarion.engineering.redhat.com"
export POLARION_PROJECT="OSE"
# Optional: For SOAP API support (updating existing test steps)
export POLARION_USERNAME="your-username"
export POLARION_PASSWORD="your-password"Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"polarion": {
"command": "python3",
"args": [
"/path/to/polarion-mcp-server/server.py"
],
"env": {
"POLARION_TOKEN": "${POLARION_TOKEN}",
"POLARION_URL": "https://polarion.engineering.redhat.com",
"POLARION_PROJECT": "OSE"
}
}
}
}python3 server.py# Using the MCP tool
create_polarion_test_case(
title="Verify certificate validation",
description="Test that certificates are read from controllerConfig",
test_steps="1. Check config\n2. Verify certs\n3. Validate",
severity="should_have",
status="draft"
)add_test_steps_to_testcase(
test_case_id="PROJECT-123",
test_steps=[
{
"step": "Run command: oc get nodes",
"expectedResult": "All nodes are Ready"
},
{
"step": "Check certificate: Get-Item C:\\k\\cert.crt",
"expectedResult": "File exists"
}
]
)create_test_run(
title="Sprint 123 - Certificate Tests",
template="Release Test",
test_case_ids=["PROJECT-123", "PROJECT-456"],
query="type:testcase AND title:certificate"
)update_test_run_result(
test_run_id="OSE-TR-12345",
test_case_id="PROJECT-123",
result="passed",
comment="All certificates validated successfully",
executed_by="[email protected]",
duration=120 # seconds
)import_junit_results(
junit_file="/tmp/junit-results.xml",
test_run_id="OSE-TR-12345",
map_test_ids={
"com.example.CertTest.testKubeletCA": "PROJECT-123",
"com.example.CertTest.testCloudCA": "PROJECT-456"
}
)export_test_cases_to_spreadsheet(
query="type:testcase AND author:username",
output_file="/tmp/my-tests.xlsx",
include_test_steps=True
)import_test_cases_from_spreadsheet(
spreadsheet_file="/tmp/test-cases.xlsx",
project_id="OSE"
)The server uses a delete-then-create strategy via the REST API to add or replace test steps on any test case, whether new or existing.
# Works for both new and existing test cases
add_test_steps_to_testcase(
test_case_id="PROJECT-123",
test_steps=[
{"step": "Run command: oc get nodes", "expectedResult": "All nodes Ready"},
{"step": "Verify certificate", "expectedResult": "Certificate valid"}
]
)When a test case already has steps, the server automatically deletes the existing steps and creates the new ones. No manual cleanup or SOAP credentials are needed.
For environments where the REST delete endpoint is unavailable, the SOAP API can be used as a fallback with force_soap=True. This requires username/password credentials:
export POLARION_USERNAME="your-username"
export POLARION_PASSWORD="your-password"add_test_steps_to_testcase(
test_case_id="PROJECT-123",
test_steps=[...],
force_soap=True
)#### create_polarion_test_case Create a new test case in Polarion.
Parameters:
title (str): Test case titledescription (str): Detailed descriptionproject_id (str): Project ID (default: from env)test_steps (str, optional): Test steps (newline-separated)severity (str): must_have, should_have, nice_to_have, will_not_havestatus (str): draft, approved, etc.Returns: JSON with test case ID and URL
#### add_test_steps_to_testcase Add or replace test steps for a test case.
Parameters:
test_case_id (str): Test case ID (e.g., "PROJECT-123")test_steps (List[Dict]): List of {"step": "...", "expectedResult": "..."}project_id (str): Project IDReturns: JSON with success status and steps count
#### search_polarion_test_cases Search for test cases using Polarion query language.
Parameters:
query (str): Polarion query (e.g., "type:testcase AND title:Windows")project_id (str): Project IDlimit (int): Max results to returnReturns: JSON with matching test cases
#### create_test_run Create a new test run.
Parameters:
title (str): Test run titletemplate (str): Template name (e.g., "Release Test")project_id (str): Project IDtest_case_ids (List[str], optional): Test case IDs to includequery (str, optional): Query to select test casesReturns: JSON with test run ID and URL
#### update_test_run_result Update the result of a test case within a test run.
Parameters:
test_run_id (str): Test run IDtest_case_id (str): Test case IDresult (str): passed, failed, blockedcomment (str, optional): Comment about the resultexecuted_by (str, optional): Who executed the testduration (int, optional): Duration in secondsReturns: JSON with update status
#### import_junit_results Import test results from JUnit XML file.
Parameters:
junit_file (str): Path to JUnit XML filetest_run_id (str): Test run ID to updatemap_test_ids (Dict[str, str]): Map JUnit test names to Polarion IDsauto_create_test_run (bool): Create test run if it doesn't existReturns: JSON with import summary
#### export_test_cases_to_spreadsheet Export test cases to Excel/CSV.
Parameters:
query (str): Query to select test casesoutput_file (str): Output file path (.xlsx or .csv)include_test_steps (bool): Include test stepsformat (str): xlsx or csvReturns: JSON with export summary
#### import_test_cases_from_spreadsheet Bulk import test cases from spreadsheet.
Parameters:
spreadsheet_file (str): Input spreadsheet pathproject_id (str): Project IDupdate_existing (bool): Update if test case existsReturns: JSON with import summary
| Title | Description | Severity | Status | Test Steps | Expected Results |
|---|---|---|---|---|---|
| Test case 1 | Description here | should_have | draft | Step 1\nStep 2 | Result 1\nResult 2 |
| Test case 2 | Description here | must_have | approved | Step 1\nStep 2 | Result 1\nResult 2 |
| Test Case ID | Result | Comment | Executed By | Duration (s) |
|---|---|---|---|---|
| PROJECT-123 | passed | All checks OK | [email protected] | 120 |
| PROJECT-456 | failed | Certificate mismatch | [email protected] | 45 |
The server automatically maps JUnit test results to Polarion test cases:
<testsuite name="Certificate Tests">
<testcase classname="com.example.CertTest" name="testKubeletCA" time="1.234">
<system-out>Test output here</system-out>
</testcase>
<testcase classname="com.example.CertTest" name="testCloudCA" time="0.567">
<failure message="Certificate not found">Stack trace...</failure>
</testcase>
</testsuite>Maps to Polarion test cases via map_test_ids parameter.
polarion-mcp-server/
├── server.py # Main MCP server
├── polarion_client.py # Polarion REST API client
├── test_runs.py # Test run management
├── integrations/
│ ├── junit_import.py # JUnit XML parser
│ ├── spreadsheet.py # Excel/CSV integration
│ └── webhooks.py # CI/CD webhooks
├── examples/
│ ├── create_test_case.py
│ ├── create_test_run.py
│ ├── import_junit.py
│ └── export_to_excel.py
├── tests/
│ ├── test_client.py
│ └── test_integrations.py
├── requirements.txt
├── .env.example
└── README.mdThis server uses several Polarion REST API endpoints, including some undocumented ones:
| Endpoint | Method | Purpose | Documented? |
|---|---|---|---|
/projects/{id}/workitems | POST | Create workitem | Yes |
/projects/{id}/workitems/{id} | PATCH | Update workitem | Yes |
/projects/{id}/workitems/{id}/teststeps | POST | Add test steps | No - Discovered! |
/projects/{id}/workitems/{id}/teststeps | DELETE | Bulk delete test steps | No - Discovered! |
/projects/{id}/workitems/{id}/teststeps/{index} | GET | Get test step | No - Discovered! |
/projects/{id}/workitems/{id}/teststeps/{index} | DELETE | Delete test step | No - Discovered! |
/projects/{id}/testruns | POST | Create test run | Yes |
/projects/{id}/testruns/{id}/records | PATCH | Update test result | Yes |
The server uses Personal Access Tokens (PAT) for authentication. Get your token from:
POLARION_TOKEN environment variablePOLARION_TOKEN to version controlSSL verification is enabled by default for security. If you encounter certificate errors with self-signed certificates or internal servers:
Option 1: Install the CA certificate (recommended)
export POLARION_CA_CERT="/path/to/ca-cert.pem"Option 2: Disable SSL verification (development only)
export POLARION_VERIFY_SSL="false"Note: Disabling SSL verification should only be used in trusted development environments, never in production.
curl -H "Authorization: Bearer $POLARION_TOKEN" \
"https://polarion.engineering.redhat.com/polarion/rest/v1/projects/OSE"/teststeps endpoint (not /relationships/testSteps)["step", "expectedResult"]Contributions welcome! Areas for improvement:
MIT License - See LICENSE file
Developed for Red Hat OpenShift Windows Container testing.
Discovered and documented undocumented Polarion REST API test steps endpoints.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.