Patch Project Test Case

Description

Patches an existing AttackForge project test case - the per-project state only: status, assigned_to, project_scope_ids, vulnerability_ids and custom fields. The descriptive fields (title, details, code, tags) live on the parent library test case and are patched with patch_testcase instead.

This is a write operation. The shape of args is declared inline (see Building args for Write Tools), so no preparatory call is needed. Only the fields supplied in args are changed; omitted fields are left untouched.

Preconditions: the caller must have Edit access to the project and access to its test cases, and the test case must not be locked. This tool cannot change the lock - use update_project_testcase_lock. On success the patched project test case id is returned.

How To Enable

1. Go to Users

2. Select the user you would like to provide access to this tool

3. Click on Access > MCP

4. Click on Add Tools

5. Select the tool patch_project_testcase and click Add

Example Prompts

• Mark this test case as Tested.

• Assign the SQL injection test case in project X to me.

• Set the remaining test cases in project X to Not Applicable.

• Link vulnerability Y to this test case.

• Which scope items does this test case cover? Update it to cover the API host too.

• Unassign this test case.

Parameters

Parameter	Type	Required	Description
args	object	Yes	The project-test-case-patch payload - see the keys below.

args keys:

Key	Type	Required	Description
project_id	string	Yes	Id (24-hex) of the project the test case is allocated to. Source: find_projects.
project_testcase_id	string	Yes	Id (24-hex) of the project test case to patch - the per-project instance, NOT the parent library test case. Source: find_project_testcases (its id field).
status	string	No	Testing status within the project: 'Tested', 'Not Tested', 'Testing In Progress' or 'Not Applicable'. Setting this also records the caller as the user who last updated the test case.
assigned_to	string or null	No	Id (24-hex) of the user to assign the test case to. The user must be on the project team with Edit access. Pass null to clear the assignment; omit to leave it unchanged.
project_scope_ids	array	No	Ids of the Project Scope items this test case covers. Source: find_project_scope. Replaces the existing assignment; pass an empty array to clear it. Ids that do not belong to this project are ignored.
vulnerability_ids	array	No	Ids of the vulnerabilities this test case uncovered. Source: find_vulnerabilities, or the vulnerability_ids field of find_project_testcases. Replaces the existing links; pass an empty array to clear them.
custom_fields	array	No	Custom field values, each { key, value }. Supplying a custom field replaces its current value; supplying an empty value clears it. Discover keys via get_field_structure(model="project-testcase").

vulnerability_ids replaces rather than appends - pass the complete intended set, since any vulnerability currently linked but absent from the list is unlinked.

The two array parameters behave differently on bad input: unknown project_scope_ids are silently ignored, but if any vulnerability_ids entry is unknown, deleted, or belongs to another project, the whole call is refused and nothing is patched.

Example Response

{
  "id": "656168055d7035a12ade4cb3"
}