Skip to main content
Glama
deenesjakoruzh
genxevo

genxevo-selenium

by genxevo
OverviewSchemaRelated ServersScoreDiscussions
Python
Local

GenXEvo AI Automation Agent — Python Selenium

An MCP server that gives an AI coding agent reliable eyes and hands for Python + Selenium UI automation engineering — deterministic capabilities, structured evidence, enforced safety boundaries and verifiable results.

Build License: MIT Python 3.11 | 3.12 | 3.13 Status: alpha

The problem

Ask any language model to fix a failing Selenium test and it will produce a confident, plausible, wrong XPath.

It has to. It cannot see the page, it cannot see the test output, and it usually cannot even see the project's real shape — which interpreter the suite runs on, which runner collects it, where the page objects actually live. It fills the gap with fluency.

GenXEvo exists to remove the gap, so the model has something true to reason about.

Related MCP server: self-healing-browser-mcp

The principle

Evidence before modification. Evidence before success.

The agent never invents a locator; it observes one. It never declares a fix; it proves one with a run correlated by identifier to the failure it claims to have repaired. Every capability returns evidence with an explicit trust level, every conclusion carries the signals that produced it, and every result says in a machine-readable field whether it succeeded — because an agent that cannot tell success from failure will confidently report a repair it never verified, and that outcome is worse than not helping at all.

What this is, and what it is not

Is

An MCP capability layer around the UI automation engineering workflow you already run

Is not

A test framework, a Selenium wrapper, a replacement for pytest, or an AI of its own

There is no model inside this server. The AI model reasons. GenXEvo is deterministic: it reads what is actually on disk, and later drives a real browser and executes real tests, and returns structured facts. When it does not know something, it says so, with a confidence level attached.

Status — honestly

This is phase 1A: the foundation and exactly two genuinely working capabilities.

Built and tested

Result contract, error vocabulary, evidence model, untrusted-content framing, configuration, path containment, secret redaction, test-selection validation, run model, capability catalogue, capability invoker, MCP adapter

Working MCP tools

genxevo_agent_status, genxevo_discover_project

Designed, catalogued, NOT callable

15 further capabilities, each published with its delivery phase

Not built

Browser control, test execution, repair, verification

There are no stubs in this repository. A planned capability is visible in genxevo_agent_status so an agent can plan around it, and is not registered as a tool, so an agent can never call one. A fake implementation is worse than an honest absence, because it teaches the agent something false.

See docs/roadmap.md for what each phase delivers and its exit criteria.

Quick start

Requirements

  • Python 3.11, 3.12 or 3.13

  • A Python automation project you want the agent to work on

The 3.11 floor is an engineering decision, not a fashion one: tomllib entered the standard library in 3.11, and it is what lets project discovery parse pyproject.toml without a third-party parser in the core. On 3.10 that would require tomli. See ADR-001.

Install

python -m venv .venv
# Windows
.venv\Scripts\activate
# macOS / Linux
source .venv/bin/activate

pip install -e .

Verify it starts — note that the banner goes to stderr, because stdout belongs to the MCP transport:

genxevo-selenium-agent --version

Connect it to an MCP client

Copy .mcp.json.example and point --workspace at your automation project:

{
  "mcpServers": {
    "genxevo-selenium": {
      "command": "C:\\path\\to\\your\\.venv\\Scripts\\python.exe",
      "args": [
        "-m", "genxevo_selenium_agent",
        "--workspace", "C:\\path\\to\\your\\automation-project"
      ]
    }
  }
}

Naming the interpreter explicitly is the reliable form on every platform: a console script lives inside one virtual environment, and an MCP client does not inherit your activated shell.

Full instructions for Claude Code, VS Code and PyCharm: docs/installation.md.

Configure it (optional)

A missing configuration file is not an error — the defaults are the safe configuration. When you want to change something, drop genxevo.config.toml in the workspace root:

version = 1

[execution]
enabled = false          # test execution is off until you turn it on
require_selection = true # never run the whole suite by accident

[security]
redact_secrets = true

Every setting, its default and its rationale: docs/configuration.md.

Architecture

                     AI MODEL   (all reasoning lives here)
                         │  MCP · JSON-RPC over stdio
                         ▼
   ┌──────────────────────────────────────────────────────────┐
   │ genxevo_selenium_agent.mcp_server      THIN ADAPTER        │
   │ tool names · descriptions · annotations · stderr logging   │
   │ every tool function holds no logic                         │
   └──────────────────────────────────────────────────────────┘
                         │
   ┌──────────────────────────────────────────────────────────┐
   │ genxevo_selenium_agent.core            THE PRODUCT         │
   │ standard library + one typing-only shim, and nothing else  │
   │                                                            │
   │  capabilities   runtime · invoker · catalog · 2 built      │
   │  discovery      manifests · runners · venvs · page objects │
   │  security       paths · redaction · selection · globs      │
   │  contracts      ToolResult · AgentError · Evidence         │
   │  runs           RunId · RunOutcome · FileRunRegistry       │
   └──────────────────────────────────────────────────────────┘
              │                  │                  │
              ▼                  ▼                  ▼
        real project      real browser (1C)   real test runs (1D)

Layer rule: behaviour never lives in the adapter. A tool function cannot be unit tested through an MCP client, so nothing that could be wrong is allowed in one.

The result contract

Every capability returns the same envelope, and an agent branches on status, never on prose:

{
  "contractVersion": "1.0",
  "status": "partialSuccess",     // one of nine values — see below
  "operation": "project.discover",
  "summary": "…one sentence for a human…",
  "data": { },                    // shape documented per capability
  "warnings": [ { "code": "…", "message": "…", "detail": "…" } ],
  "error": null,                  // present whenever status is not succeeding
  "evidence": [ { "id": "…", "kind": "…", "trust": "trusted|untrusted", … } ],
  "nextActions": [ { "tool": "…", "reason": "…" } ],
  "durationMs": 41,
  "startedAt": "2026-08-22T09:15:00Z",
  "safeToRetry": true
}

The nine statuses: success · partialSuccess · failure · validationError · configurationError · blocked · timeout · cancelled · skipped

Each is a distinct decision an agent has to make. Nothing else is in the list.

Because the tools are annotated with a TypedDict, this whole contract — including the status enum — is published in tools/list as each tool's outputSchema. An agent learns how to read a result before it calls anything.

Invariants are enforced in code, not by convention: a succeeding status never carries an error, a failing one always does, status is derived from the error's category so the two cannot disagree, and a partialSuccess cannot be constructed without a warning explaining it.

Security posture

GenXEvo reads untrusted content, hands it to a language model, and will later give that model file-write and code-execution capabilities. The design assumption is that the model will eventually be persuaded to ask for something it should not have, and that the server, not the model, refuses.

Control

What it does

Explicit workspace roots

Never inferred. Unconfigured means refuse, with the remedy

Path containment

Reject structurally → canonicalise → then contain → deny list → intent. Capabilities take a ResolvedPath, not a str, so unvalidated I/O does not type-check

Symlink resolution

Path.resolve() follows symlinks before containment is tested, so a link out of the workspace is refused

Deny list

Python-aware: .pypirc, pip.conf, local_settings.py, secrets.py alongside .env, *.pem, ~/.ssh

Secret redaction

Key-name and value-shape detection, including Python source assignments like PASSWORD = "…"

No project code is ever executed

setup.py is recorded and never run; conftest.py is read as text and never imported; installed packages are read from dist-info directory names

Untrusted framing

Escape-proof — a payload cannot forge either delimiter

Selection validation

A selection starting with - is refused outright: pytest -p some.module is arbitrary code execution

Safe defaults

Execution off, redaction on, selection required

Bounded everything

Timeouts, cooperative cancellation, scan limits, repair-cycle ceiling

Run correlation

Stale artefacts cannot be read as proof of a fix

Error hygiene

No traceback ever reaches the agent; refusals never echo the absolute workspace path

Residual risks are documented, not hidden — see SECURITY.md and docs/security.md. Framing does not prevent influence, test execution is arbitrary code by design, stdio MCP has no authentication, and redaction is heuristic.

The GenXEvo family

This is the second product in a family of independent agents. Each is separately cloneable and installable; what they share is a contract, not a build.

Selenium

Playwright

C#

shipped

planned

Python

this repository

planned

Java · JavaScript · TypeScript

planned

planned

What ports across languages is the JSON shape, the nine-status vocabulary, the error codes, the run identifier format, the evidence model and the safety classes. An agent that has learned one GenXEvo server should recognise the next one on first contact.

What is not shared is implementation. This product is Python-native by design: TypedDict output schemas, tomllib configuration, dataclasses instead of a serialisation framework, cooperative cancellation across asyncio.to_thread, and a discovery model built around pyproject.toml, pyvenv.cfg and pytest's own collection rules.

Documentation

Document

Contents

docs/architecture.md

Packages, layers, domain model, contract, evidence, runs, concurrency

docs/installation.md

Claude Code, VS Code, PyCharm; the interpreter trap

docs/configuration.md

Every setting, default and rationale; precedence; validation

docs/mcp-tools.md

Full contract — 2 implemented in detail, 15 planned with their guarantees

docs/agent-workflows.md

The engineering loop, rules for agents, a worked example, anti-patterns

docs/security.md

Threat model, controls with rationale, residual risks

docs/decisions.md

Architecture decision records, each tied to the defect that motivated it

docs/roadmap.md

Phases 1A–3 with exit criteria and what is out of scope

docs/troubleshooting.md

Concrete failure modes and their fixes

prompts/

How to talk to the agent, with complete worked prompts

examples/

Working configuration files

Development

pip install -e ".[dev]"

ruff check .          # lint
ruff format --check . # format
mypy                  # strict type checking
pytest                # the full suite

These checks also run in CI (Build) on every push and pull request — ruff · ruff format · mypy · pytest across Python 3.11–3.13 on Linux & Windows, plus stdout-purity and package-build checks.

The standard, written into CONTRIBUTING.md: every security control ships with tests that assert the attack, not only the happy path, and genxevo_selenium_agent.core imports the standard library and exactly one typing-only shim — enforced by a test that parses every module with ast, not by convention. The one exception is typing_extensions, and ADR-002 explains why the alternative is a server that will not start on Python 3.11.

Author

Rajeshkumar Muthu — Senior QA Automation Agentic AI Engineer.

Licensed under the MIT License.

Available Tools

2 tools
genxevo_agent_statusGenXEvo agent statusA
Read-onlyIdempotent

Report what the GenXEvo agent currently is: whether it is configured, which workspace roots it may read, what its security policy is, which Python interpreter is hosting the server, whether test execution is permitted, and exactly which capabilities this build provides versus which are planned for a later phase. Call this FIRST in any session, and again whenever a capability behaves unexpectedly. Note that the interpreter reported here runs GenXEvo itself and is usually NOT the interpreter the automation project's tests run on -- use genxevo_discover_project for that. Returns the GenXEvo ToolResult envelope: branch on the 'status' field, never on the prose in 'summary'. Read-only and always safe to repeat.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataNo
errorNo
runIdNo
statusYes
summaryYes
evidenceYes
warningsYes
operationYes
startedAtYes
durationMsYes
nextActionsYes
safeToRetryYes
contractVersionYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, and the description reinforces this with 'Read-only and always safe to repeat.' It adds meaningful behavioral context beyond annotations: returns the GenXEvo ToolResult envelope, instructs branching on the 'status' field rather than prose in 'summary', and clarifies that the interpreter reported is for GenXEvo itself, not the test project's interpreter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than minimal, but every sentence adds useful operational guidance: what is reported, when to call it, the interpreter caveat, sibling routing, and response-handling instructions. It is front-loaded with the primary purpose and organized logically, though the final sentence about read-only safety partially restates annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a parameterless status tool: it defines the tool's scope, usage timing, the sibling alternative, the interpreter caveat, and how to interpret the returned envelope. Since an output schema exists, the return-value contract is additionally covered structurally, and the description goes further by warning against relying on prose in 'summary'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema has 100% coverage by having no properties, so there is nothing the description must explain. The description still clarifies that this is a status query with no arguments required. A score of 4 reflects the baseline for a parameterless tool; there is no room for additional semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Report') and a specific resource (the GenXEvo agent's current status), and enumerates the exact dimensions reported: configuration, workspace roots, security policy, interpreter, test execution permission, and implemented vs planned capabilities. It also distinguishes itself from its sibling genxevo_discover_project by explicitly directing interpreter-related project queries there.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit timing guidance: 'Call this FIRST in any session, and again whenever a capability behaves unexpectedly.' It also provides an exclusion and alternative by noting the reported interpreter is usually not the project test interpreter and that genxevo_discover_project should be used for that purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

genxevo_discover_projectDiscover the Python automation projectA
Read-onlyIdempotent

Scan the configured workspace and report the Python automation project that is actually there: pyproject.toml, requirements files, setup.cfg and lock files with their declared dependencies; the test runner the project itself states it uses (pytest or unittest, or 'unknown' -- never assumed); the test roots, established from files matching the project's own collection patterns rather than from any folder being called 'tests'; virtual environments with the interpreter version read from pyvenv.cfg; the browser automation library in use (Selenium, Playwright, Appium); candidate page-object directories, identified because their modules drive a browser and are not collected as tests; and CI configuration. Every conclusion carries the signals that produced it and an explicit confidence level, so you can tell a fact from a guess. GenXEvo never imports or executes anything in the project to obtain this -- setup.py and conftest.py are read as text only. Call this before reasoning about any test, locator or run. Read-only, makes no assumption about folder layout, and always safe to repeat. If 'status' is 'partialSuccess' the scan hit a limit or could not read something, and 'not found' may mean 'not looked at'.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataNo
errorNo
runIdNo
statusYes
summaryYes
evidenceYes
warningsYes
operationYes
startedAtYes
durationMsYes
nextActionsYes
safeToRetryYes
contractVersionYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, idempotentHint, and destructiveHint false, and the description enriches this substantially: it promises no execution or imports, reads config files as text, exposes the partialSuccess status semantics ('not found' may mean 'not looked at'), and states that every conclusion carries signals and an explicit confidence level. It also says it makes no folder-layout assumptions and is 'always safe to repeat,' which is consistent with the idempotent annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well structured and front-loaded with the main purpose. Each listed artifact and caveat adds meaningful guidance, and the critical call-time directive is placed near the end. It is slightly dense and has minor redundancy around read-only/safe-to-repeat, but every sentence contributes to agent understanding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given this is a zero-parameter tool with a rich output schema, the description is complete: it explains what will be discovered, how conclusions are evidenced, the no-execution guarantee, the partialSuccess edge case, when to call it, and its safety profile. Nothing an agent needs to decide whether and when to invoke this tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema coverage is 100%, so there are no parameter semantics for the description to clarify. Per the rubric, zero params yields a baseline of 4. The description instead focuses on behavior and outputs, which is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Scan the configured workspace and report the Python automation project that is actually there.' It enumerates concrete artifacts and properties (pyproject.toml, lock files, test runner, virtual environments, browser library, page-object directories, CI config) and clearly separates this discovery tool from the only sibling, genxevo_agent_status, by adding a directive: 'Call this before reasoning about any test, locator or run.'

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit invocation point: 'Call this before reasoning about any test, locator or run.' It also states what the tool will not do, e.g., it never imports or executes project code, and it reads setup.py/conftest.py as text only. It does not name exclusions or explicitly compare against genxevo_agent_status, but for a zero-parameter discovery tool the guidance is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 2 tool updatesv0.1.0
    • First observedgenxevo_agent_status
    • First observedgenxevo_discover_project
Install Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.3/5.0
Disambiguation5/5

genxevo_agent_status reports on the agent/server itself, while genxevo_discover_project inspects the workspace project. Their purposes and targets are completely distinct, so an agent should never confuse them.

Naming Consistency4/5

Both tools share the genxevo_ prefix and use snake_case, which is good, but genxevo_agent_status is a noun-phrase while genxevo_discover_project is verb+noun. This is a minor stylistic inconsistency rather than a serious problem.

Tool Count3/5

Two tools is on the thin side and feels borderline, but both are substantial read-only capabilities that form a coherent project-reconnaissance pair. The count is not excessive, but it is minimal.

Completeness2/5

The descriptions repeatedly mention tests, locators, and runs, but no tool actually executes tests, inspects locators, or interacts with the Selenium project. After discovery, an agent has no way to act on the project, which is a significant gap for a Selenium-oriented server.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • self-healing-browser-mcp

    RAJUSHANIGARAPU
    A
    license
    B
    quality
    C
    maintenance
    Enables AI agents to control a browser with self-healing locators that automatically recover when selectors change, allowing reliable web automation through natural language.
    7
    MIT
  • QualityMax QA MCP by Quality-Max

    QualityMax QA MCPofficial

    Quality-Max
    A
    license
    A
    quality
    A
    maintenance
    Enables coding agents to independently verify web changes by scanning pages, inspecting UI structure, generating Playwright reproductions, and executing tests with structured QA evidence.
    4
    1,224
    2
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/genxevo/genxevo-ai-automation-agent-python-selenium'

If you have feedback or need assistance with the MCP directory API, please join our Discord server