Create Abuse Case

Description

Creates a new AttackForge abuse case in an existing project. An abuse case is a test case belonging to one project only - it lives in that project's own abuse-case testsuite rather than in the reusable methodology library, so it is created against a project rather than a testsuite. To create a reusable library test case instead, use create_testcase.

This is a write operation: it persists a new abuse case against the project, creating the project's abuse-case testsuite if it does not have one yet, and allocates it to the project so it appears in find_project_testcases.

The shape of args is declared inline (see Building args for Write Tools), so no preparatory call is needed. Rich-text fields must use the AttackForge richtext format described in the richtext_format block returned by get_args_schema_for_tool.

Preconditions: the caller must have Edit access to the project and access to its test cases. On success both ids are returned: testcase_id for the abuse case itself (patch it with patch_testcase) and project_testcase_id for its per-project instance (patch that with patch_project_testcase).

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool create_abuse_case and click Add

Example Prompts

• Add an abuse case to project X for a business logic bypass on the checkout flow.

• Create a project-specific test case for abusing the password reset flow.

• Add an abuse case to the ACME project with these execution steps.

Parameters

Parameter	Type	Required	Description
args	object	Yes	The abuse-case-creation payload - see the keys below.

args keys:

Key	Type	Required	Description
project_id	string	Yes	Id (24-hex) of the project to create the abuse case in. Source: find_projects. The abuse case is placed in that project's abuse-case testsuite, which is created on first use.
title	string	Yes	Title of the abuse case.
details	string	No	Details / description. Rich-text - use the AttackForge richtext format.
code	string	No	Arbitrary code associated with this abuse case.
tags	array	No	String tags attached to this abuse case.
sort_order	integer	No	Default sort order within the AttackForge UI. Omit to append at the end of the project's abuse-case testsuite.
execution_flow	array	No	Ordered execution-flow steps, each { title, details }. details is rich-text.
custom_fields	array	No	Custom field values set on the project test case created for this abuse case - discover keys via get_field_structure(model="project-testcase"). These are distinct from the custom fields on the abuse case itself, which are set with patch_testcase using the returned testcase_id.

Example Response

{
  "testcase_id": "6987c31b8e7d46a8089d9b53",
  "project_testcase_id": "6987c31b8e7d46a8089d9b54"
}