qmax-mcp 0.8.0

Highlights

• scan_url recognises the request shapes common telemetry SDKs use for their own transport — Sentry, PostHog, GA, Datadog RUM, Amplitude, Mixpanel — and names the SDK instead of reporting an anonymous console error. When the credential is a placeholder it names the fix that actually works: an empty DSN or token, which these SDKs treat as disabled, rather than a fake-but-present value that makes them initialize and retry on every page load.
• scan_url accepts a baseline — a previous result, or a path to one — and reports which findings are new, fixed, and unchanged. qmax-mcp scan --baseline … --fail-on-new lets CI gate on "nothing new since the last green run" instead of findingCount > 0, which stops working the moment a page has one known-benign finding.
• inspect_page ranks recommendedLocator by how durable its source is and reports a stability verdict per control. A control with no handle at all now says so, and offers the least brittle scoped fallback plus the durable fix.
• scan_url accepts format: "issue", rendering each finding as a self-contained ticket block ready to paste into a tracker.
• The README documents how to produce the Playwright storage-state file authenticated scans need.

Upgrading from 0.7.0

Two changes are visible on an unchanged page.

Locators moved. A control carrying a test id or an id is now addressed by that rather than by its role and accessible name, so a spec generated from 0.7.0 output and one generated now may locate the same control differently — the new one survives a copy edit and a translation. Two recommendations that silently matched nothing are also fixed: data-test/data-qa values were emitted as [data-testid=…], and a name attribute was passed off as an accessible name. A spec that quietly found zero elements will now find the control.

Telemetry findings replaced generic ones. A failing telemetry request is now one telemetry finding rather than several console and network findings, so a page with a stubbed SDK scores differently than it did on 0.7.0.

Everything else — baseline, format: "issue", minSeverity, --baseline, --fail-on-new, --allow-private-network — is additive and opt-in.

Install

npx -y @qualitymax/qmax-mcp@0.8.0

Published with npm provenance (SLSA v1) from tag v0.8.0, commit 8ee1134.

Full details: CHANGELOG.md

Merged work: #88, #89, #90, #91, #92, release candidate #94. This release completes the #84 evaluation batch.