Find Test Cases

Description

Lists AttackForge library test cases matching the optional filter. A library test case is a reusable, taggable unit of testing methodology that belongs to a testsuite - it is NOT a per-project test case (see find_project_testcases for those). It carries the descriptive fields: title, details, code, tags, sort_order and execution_flow.

There are two ways to use this tool:

• Search - scope with testsuite_ids and narrow with filter.

• Resolve by id - pass testcase_ids. Use this whenever you already hold test case ids from another tool, notably the testcase_id on a project test case from find_project_testcases. Unlike a search, this also resolves records a search will never return: deleted test cases, test cases whose testsuite has been deleted, and project abuse cases.

Results are paginated (default 10 per page, max 50). See Test Cases and Methodology.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool find_testcases and click Add

Example Prompts

• Show me the test cases in the web application testsuite.

• Find test cases about injection and show me their details.

• What are the execution flow steps for this test case?

• Show me the titles of the test cases allocated to project X.

• List test cases tagged OWASP Top 10.

• Which test cases in this testsuite have been retired?

Parameters

Parameter	Type	Required	Description
testcase_ids	array	No	Resolve these specific test cases by id (array of 24-hex ids) rather than searching. Also resolves deleted test cases and project abuse cases. Ids that do not exist, or that the caller cannot see, are silently omitted.
testsuite_ids	array	No	Restrict a search to test cases belonging to these testsuites (array of 24-hex ids). Source: find_testsuites. Omit to search across every testsuite the caller can access.
filter	object	No	A MongoDB-style filter. Supported fields are listed below.
fields	array	No	System fields to include (id is always returned). Supported values are listed below.
custom_field_keys	array	No	Custom field keys to include (discover via get_field_structure(model="testcase")).
limit	integer	No	Maximum records to return in this page. Default 10, max 50.
skip	integer	No	Number of records to skip (offset). Default 0.

Supported filter fields:

Field	Type / Values
id	ObjectId('<24 hex>')
created, modified	ISO-8601 datetime
title	string
code	string
tags	array of string
sort_order	integer
custom_fields	array of { key: string, value: string or array }
library_id	string
template_testcase_id	ObjectId('<24 hex>')
user_id	ObjectId('<24 hex>')

Do NOT filter on testsuite membership via filter - testsuite_id is disallowed there. Use the testsuite_ids parameter.

Filtering on id performs a search, and a search never returns deleted test cases. To resolve test cases you already have ids for - including retired ones - use testcase_ids instead, and request the is_deleted field to tell retired methodology apart from current.

Supported fields values:

Field	Type
id	string
created, modified	ISO-8601 datetime
title	string
details	string (AttackForge richtext)
code	string
tags	array of string
sort_order	integer
execution_flow	array of { title: string, details: string }
files	array of { id, created, modified, name, mimeType, hash, size, storage_name, storage_location }
library_id	string
template_testcase_id	string
testsuite_id	string
user_id	string
is_deleted	boolean

Example Response

{
  "data": [
    {
      "id": "65a440c08cade68ca7bc71a4",
      "created": "2024-01-14T22:41:04.118Z",
      "modified": "2026-02-02T11:07:35.902Z",
      "title": "Test for SQL Injection",
      "details": "<p>Verify that user-controlled input reaching a database query is correctly parameterised.</p>",
      "code": "WEB-INJ-01",
      "tags": [
        "owasp-top-10",
        "injection"
      ],
      "sort_order": 12,
      "execution_flow": [
        {
          "title": "Identify injection points",
          "details": "<p>Enumerate all parameters that reach a data store.</p>"
        },
        {
          "title": "Probe with payloads",
          "details": "<p>Submit boolean, error-based and time-based payloads and observe the responses.</p>"
        }
      ],
      "testsuite_id": "65a440c08cade68ca7bc7192",
      "user_id": "5ad737d6e576e6290aff1808",
      "is_deleted": false,
      "custom_fields": [
        {
          "key": "cwe",
          "value": "CWE-89",
          "label": "CWE"
        }
      ]
    }
  ],
  "count": 1,
  "total": 38
}