API & MCP | Docs

Authentication

Teste.no uses API tokensfor programmatic access. Tokens are team-scoped — all queries filter by the token's team.

Creating a Token

Go to Settings → API Keys
Click Create API Key
Name your token and select scopes (Read, Write, Admin)
Copy the token immediately — it's shown only once

Tokens look like: tno_<hex string>

Using Tokens

Authorization: Bearer tno_abc123def456...

Scope	Permissions
Read	List/get targets, findings, incidents, runs, stats
Write	Trigger runs, manage incidents, record deployments, maintenance windows
Admin	Create/delete targets, muting rules, system health

REST API (tRPC over HTTP)

All API endpoints are mounted at /api/trpc/*. The API uses tRPC over HTTP.

Base URL

https://api.teste.no/api/trpc

Query (GET)

GET /api/trpc/target.list?input={}
Authorization: Bearer tno_xxx

Mutation (POST)

POST /api/trpc/run.triggerAll
Authorization: Bearer tno_xxx
Content-Type: application/json

{"targetId": "clx..."}

Key Endpoints

Targets

Procedure	Type	Description
target.list	query	List all targets in your team
target.get	query	Get target details by ID
target.create	mutation	Add a new target (URL required)
target.update	mutation	Update target name, URL, type, uptime settings
target.delete	mutation	Permanently delete a target
target.analyze	query	Fingerprint a target and get test recommendations
target.importBulk	mutation	Import up to 100 URLs at once

Runs & Scanning

Procedure	Type	Description
run.triggerAll	mutation	Trigger all enabled tests for a target (fan-out scan)
run.triggerBatch	mutation	Trigger specific tests by slug for a target
run.list	query	List runs with status/test filters + cursor pagination
run.get	query	Get run details including metrics and findings
run.upcoming	query	Get next scheduled run times for a target

Findings

Procedure	Type	Description
finding.list	query	List findings (filter by status, severity, target)
finding.get	query	Full finding detail with evidence and AI analysis
finding.forPortal	query	Simplified findings for the owner portal view
mutingRule.create	mutation	Mute findings by fingerprint, test, or target

Incidents

Procedure	Type	Description
incident.list	query	List incidents (filter by status, target)
incident.get	query	Incident detail with linked findings and deploy correlation
incident.acknowledge	mutation	Mark incident as acknowledged
incident.resolve	mutation	Manually resolve an incident
incident.enrichWithAI	mutation	Trigger AI analysis of an incident

Stats & Scores

Procedure	Type	Description
stats.teamOverview	query	Team-wide stats (runs, findings, pass rate)
stats.dailyTrend	query	Daily time-series for charts (runs, findings, incidents)
compositeScore.forTarget	query	Category scores (Security, SEO, Performance, Accessibility)
target.uptimeHistoryExtended	query	Uptime data (raw checks + daily aggregates, up to 90 days)

Uptime & Maintenance

Procedure	Type	Description
target.uptimeHistoryBatch	query	Batch uptime check history for all targets (24h)
maintenance.create	mutation	Create a maintenance window (one-time/daily/weekly)
maintenance.list	query	List maintenance windows for a target
maintenance.delete	mutation	Delete a maintenance window

Non-tRPC Endpoints

Method	Path	Auth	Description
GET/POST/DELETE	/api/mcp	Optional Bearer (tno_… / OAuth); omit for guest	MCP Streamable HTTP — ChatGPT, Cursor, agents
GET	/.well-known/oauth-protected-resource	None	RFC 9728 OAuth discovery for MCP clients
GET	/.well-known/mcp-server-card.json	None	MCP server card (name, transport, docs links)
ALL	/auth/*	Mixed	Better Auth OAuth AS (DCR, authorize, token) for ChatGPT
POST	/api/deploy/:token	Token in URL	Record a deployment (auto-correlates with incidents)
GET	/api/artifacts/:id	Session/Bearer	Download an artifact file (screenshots, videos)
GET	/api/targets/:id/screenshot	Session/Bearer	Target page screenshot
GET	/api/health	None	Health check (returns status, version, sha)
POST	/api/tts	Session	Text-to-speech for voice alerts

Deploy Webhook

Record deployments from your CI/CD pipeline to correlate with incidents:

curl -X POST https://api.teste.no/api/deploy/<TOKEN> \
  -H "Content-Type: application/json" \
  -d '{"version": "v1.2.3", "commit": "abc123", "environment": "production"}'

The deploy token is shown in Target → Settings → Deployments. Incidents auto-correlate with deployments within 20 minutes.

CLI Tool

The teste CLI lets you run scans and check results from your terminal or CI/CD pipeline.

Installation

npm install -g @teste-no/teste-cli

Commands

# Guest scan (no auth, 6 HTTP tests)
teste scan https://example.com

# Authenticated full scan (all enabled tests)
teste scan https://example.com --token tno_xxx

# JSON output for CI/CD
teste scan https://example.com --json

# List your monitored targets
teste targets --token tno_xxx

# Recent test results for a target
teste status <targetId> --token tno_xxx

# Store your token
teste config set api-key tno_xxx

Exit Codes

Code	Meaning
0	All tests passed
1	Warnings found
2	Failures found

CI/CD Example (GitHub Actions)

- name: Run Teste.no scan
  run: |
    npx @teste-no/teste-cli scan ${{ vars.SITE_URL }} \
      --token ${{ secrets.TESTE_TOKEN }} --json

MCP (Model Context Protocol)

MCP lets AI tools (Cursor, Claude Desktop, etc.) interact with Teste.no directly from your IDE.

Setup

Add to your MCP settings (~/.cursor/mcp.json):

{
  "mcpServers": {
    "teste-no": {
      "command": "npx",
      "args": ["-y", "teste-no-mcp"],
      "env": {
        "TESTE_NO_API_URL": "https://api.teste.no",
        "TESTE_NO_API_KEY": "tno_<your-api-key>"
      }
    }
  }
}

Available Tools (74 total)

Category	Tools
Guest (2, no key)	guest_start_scan, guest_get_scan — free 6-test HTTP scan, rate-limited
Read (16)	list_targets, get_target, get_target_scores, list_findings, get_finding, list_incidents, get_incident, list_runs, get_run, active_runs, team_stats, target_stats, daily_trends, get_site_map, list_maintenance_windows, list_tests
Write (46)	analyze_target, create_target, trigger_test, trigger_all_tests, acknowledge_incident, resolve_incident, mute_finding, automation/journeys/reports/keywords/…
Admin (10)	update_target, delete_target, import_targets, create_muting_rule, update_test, enable_all_tests, disable_all_tests, system_health

Note: Agents: omit Authorization to use guest tools, or sign up Free and create an API key. Self-docs: teste-no://docs/quickstart, prompt get-started.
ChatGPT: OAuth at https://api.teste.no/api/mcp (Developer Mode).
WordPress: optional inside-out plugin — Site Monitor & Health Checks – Teste.no.

Note: With MCP configured, you can ask your AI assistant questions like:
"Which of my sites have critical findings?" or "Run a full scan on example.com"

WebSocket (Real-time Events)

Connect to the Socket.IO server for real-time updates. Events are broadcast globally and to specific rooms (target:<id>, scan:<id>).

Event	Description
run:queued	Test run has been queued
run:started	Test run started executing
run:progress	Progress update with message and optional data
run:completed	Test run finished (includes status, findings count)
finding:created	New finding discovered
finding:resolved	Finding auto-resolved
target:down	Uptime confirms site is down
target:up	Site recovered from downtime
incident:opened	New incident created
incident:closed	Incident auto-resolved

Rate Limits

Endpoint	Limit
Global	100 requests/min/IP
Auth endpoints	10 requests/min/IP
Guest scan	6 requests/min/IP