--- source_url: "https://totalshiftleft.ai/integrations" title: "CI/CD Integrations for API Testing | Total Shift Left" mirrored_at: 2026-09-02T13:01:46.703Z host: totalshiftleft.ai cited_in_42a: true mirror_canonical: "https://index.42a.ai/totalshiftleft.ai/integrations" --- > **Original source:** https://totalshiftleft.ai/integrations CI/CD plugins · REST API ## Enterprise CI/CD integrations for API testing A first-party GitHub Action, Jenkins plugin and Azure DevOps task, plus a public REST API for any other pipeline that can make an HTTP call. Quality gates, JSON summaries and JUnit XML — with on-prem and air-gapped support throughout. ## Why integrate Total Shift Left with your pipeline? Move API quality checks earlier in your delivery process. Catch failures before they merge — automatically. ### Quality gates in every build Set pass-rate thresholds and error-test policies so broken APIs never reach production. Gate results map directly to your pipeline step status. ### Structured results, everywhere A JSON summary and JUnit XML from every packaged integration, written to your workspace automatically and ready for your CI’s native test-results tab. The REST API returns the same JSON. ### One runner, identical behaviour The GitHub Action, Azure DevOps task, CircleCI orb, Bitbucket pipe and GitLab component are thin adapters over a single shared implementation — so the same inputs produce the same gate decision on every platform. ## Available integrations Install the GitHub Action, Jenkins plugin or Azure DevOps task today. The CircleCI orb, Bitbucket pipe and GitLab component are public in source but not yet on their registries — those platforms use the REST API pattern below for now. The MCP server is still in development. [ ### Jenkins Available Add Total Shift Left into Jenkins Freestyle jobs with minimal setup. - Build step for Freestyle projects with full UI configuration - One-click Test Connection to verify credentials - Configurable quality gate with pass threshold and error-test checks - JUnit XML and JSON summary workspace artifacts - Full Java plugin source is public; build the HPI yourself or take a release View integration details ](https://totalshiftleft.ai/integrations/jenkins)[ ### GitHub Actions Available One step in your workflow — the first-party action runs a pack and gates the build. - Add it with uses: Total-Shift-Left/Shift-Left-API-Integrations/github-actions@v1 - Runs on node20 from a pre-built bundle — no install or build step in your workflow - Quality gate exits non-zero, so branch protection blocks the PR merge - JSON summary and JUnit XML written to the workspace on every run - decision, success\_rate and execution\_id exposed as step outputs View integration details ](https://totalshiftleft.ai/integrations/github-actions)[ ### Azure DevOps Available Run Total Shift Left test packs directly inside Azure Pipelines. - Installed from the Visual Studio Marketplace, then added as a pipeline task - Quality gates with configurable pass thresholds - JUnit XML and JSON summary artifact output - Output variables for downstream pipeline steps - Multi-tenant support with optional Tenant ID View integration details ](https://totalshiftleft.ai/integrations/azure-devops)[ ### GitLab CI Source available CI/CD component written and public — not in the GitLab catalog yet. Use the REST API today. - Component source is public and wraps the same runner as every other integration - Not yet in the GitLab CI/CD Catalog, so an include: component: reference will not resolve - Today: call the public REST API from a \`.gitlab-ci.yml\` job with curl or any HTTP client - Protected, masked CI/CD variables keep credentials out of job logs - Works with self-managed GitLab + self-hosted Shift-Left in air-gapped environments View integration details ](https://totalshiftleft.ai/integrations/gitlab-ci)[ ### CircleCI Source available Orb written and public — not on the CircleCI registry yet. Use the REST API today. - Orb source is public and wraps the same runner as every other integration - Not yet on the CircleCI registry, so totalshiftleft/shiftleft@1.0.0 will not resolve - Today: call the public REST API from a \`run\` step with curl or any HTTP client - CircleCI Context-secured credentials for org-wide scoping - Self-hosted runner support for firewalled Shift-Left deployments View integration details ](https://totalshiftleft.ai/integrations/circleci)[ ### Bitbucket Pipelines Source available Pipe written and public — image not on Docker Hub yet. Use the REST API today. - Pipe source is public and wraps the same runner as every other integration - Image not yet on Docker Hub, so a pipe: totalshiftleft/... reference will not resolve - Today: call the public REST API from a pipeline step with curl or any HTTP client - Secured workspace and repository variables for credential scoping - Self-hosted runner support for air-gapped environments View integration details ](https://totalshiftleft.ai/integrations/bitbucket-pipelines)[ ### MCP Server (Claude, Cursor, AI Agents) In development Model Context Protocol server — in development, not shipped yet. - Planned: tool calls for generating tests, explaining coverage gaps, and validating results - Planned: resources exposing coverage, gaps, schema, and output data to the agent - Intended to work with Claude Desktop, Cursor, and other MCP-compatible clients - No legacy enterprise platform (ReadyAPI, Tosca, Parasoft) ships an MCP server today either - Use the public REST API from your agent today — see below for a working example View integration details ](https://totalshiftleft.ai/integrations/mcp)[ ### Self-Hosted LLM (Ollama, LM Studio, vLLM) Available Point AI test generation at a model you run — nothing leaves your perimeter. - Quick-fill base URLs for Ollama, LM Studio, and vLLM in AI Settings - Any OpenAI-compatible endpoint works — not limited to these three - Optional embedding model for offline RAG / semantic search - Test Connection verifies the model before you save - Enterprise plan capability View integration details ](https://totalshiftleft.ai/integrations/self-hosted-llm) Public REST API ## No native plugin? Use the REST API from any CI/CD tool Everything the packaged integrations do is available as a public REST endpoint. If your pipeline can make an HTTP call, it can trigger test packs, apply quality gates, and fetch results — GitLab CI, CircleCI, Bitbucket Pipelines, Bamboo, TeamCity, AWS CodeBuild, Buildkite, Drone, Harness, Tekton, Argo, or any custom runner. - Authenticate with email and password to obtain a bearer token - Trigger a test run pack and receive an execution ID - Poll execution status and retrieve full results - Download JSON results for your pipeline (packaged integrations also write JUnit XML) - Apply your own quality gate logic with pass-rate thresholds ## Get started in three steps 1 ### Add the integration A one-line uses: step on GitHub Actions. The Marketplace extension on Azure DevOps, or the HPI on Jenkins. For GitLab CI, CircleCI and Bitbucket Pipelines, call the public REST API from a pipeline step until the packaged versions publish. 2 ### Configure credentials Add your Total Shift Left email and password as scoped secrets — encrypted GitHub Secrets, protected GitLab CI/CD variables, CircleCI Contexts, or Bitbucket secured variables. Never inline them in pipeline YAML. 3 ### Run in your pipeline Pick a test pack, set your pass-rate threshold, and let CI handle the rest. The packaged integrations write JUnit XML and a JSON summary into the workspace and exit non-zero when the gate fails; the REST API returns the same JSON. - Which CI/CD integrations does Total Shift Left support? Three you can install today: a GitHub Action, the Jenkins plugin (Java/Maven HPI) and the Azure DevOps task (VSTS task/VSIX, on the Visual Studio Marketplace). Each runs the full test-run lifecycle — trigger, poll, quality gate, JUnit and JSON artifacts. A CircleCI orb, a Bitbucket pipe and a GitLab CI/CD component are written and public in source, but have not been pushed to their registries yet, so those platforms use the public REST API for now. So does anything else that can make an HTTP call — Bamboo, TeamCity, AWS CodeBuild, Buildkite, Drone, Harness, Tekton, Argo. See the REST API section below for the pattern. - Do I need a Total Shift Left account to use the plugins? Yes. The plugins authenticate against your Total Shift Left instance using the public REST API. You need a user account with permission to call the CI/CD API endpoints. For production use, create a dedicated service account with project-scoped permissions. - Can I run tests against private or internal APIs? Yes. As long as the CI/CD agent or runner has network access to your Total Shift Left server URL, tests will execute normally. For self-hosted Shift-Left deployments behind a corporate firewall, run the CI/CD job on a self-hosted runner inside the same network. The same pattern applies whether you use the Jenkins/Azure DevOps plugins or call the REST API directly. - What happens when a quality gate fails? You control the outcome. Every integration exposes a pass-rate threshold and an ERROR-test policy — either failing causes the pipeline step to exit non-zero, which fails the job. Set gate-failure-result to succeeded-with-issues if you would rather warn than block. Combine with branch protection rules in your VCS to block PR/MR merges on quality regressions. The gate decision is also available as an output variable for downstream logic, as one of PASSED, GATE\_FAIL\_THRESHOLD, GATE\_FAIL\_ERROR\_TESTS, FAILED, COMPLETED\_WITH\_ISSUES, OK, TIMEOUT or TRIGGER\_ONLY. - Do the integrations behave the same on every CI platform? Yes, by construction. The GitHub Action, Azure DevOps task, CircleCI orb, Bitbucket pipe and GitLab component are thin adapters over one shared runner package — each supplies a small object for reading inputs and writing outputs, and nothing else. The same inputs produce the same gate decision and the same artifacts everywhere. The Jenkins plugin is the one exception: it is an independent Java implementation of the same documented contract. - Why not just call the REST API with a curl script? You can, and it is a perfectly good option. One caveat worth knowing: the status endpoint reports a test pack’s most recent execution, and the run endpoint returns before the scheduler has claimed the pack — so a script that polls immediately can read the previous run’s result and pass a build whose new run has not started. The packaged integrations record the execution id before triggering and only grade the run once that id changes. If you roll your own, guard against that case. - What is the MCP server, and why does it matter? The Model Context Protocol is an open standard introduced by Anthropic in late 2024 that lets AI agents drive external systems through a tool/resource interface. A native MCP server for Total Shift Left is in development — it is not available today, and we don’t have a public ship date yet. The goal is to let Claude Desktop, Cursor, and other MCP-compatible agents drive test generation, coverage analysis, and execution from inside the conversation. In the meantime, the public REST API can be wired into any agent framework that supports custom HTTP tool calls. See the dedicated MCP page for details on what’s planned. - Is there a cost for the CI/CD plugins and MCP server? Every integration is free to install and MIT-licensed; you need an active Total Shift Left subscription to run tests. The REST API is included with your subscription — no separate plugin cost for GitLab CI, CircleCI, Bitbucket Pipelines, or any other tool. The MCP server hasn’t shipped yet, so pricing and tier gating for it haven’t been decided. - Can I use Shift-Left from a CI/CD tool that's not on the list? Yes. Every action the plugins perform is available via the public /api/v1 REST API. Bamboo, TeamCity, AWS CodeBuild, Buildkite, Drone, custom runners — anything that can make HTTP calls can trigger test packs, apply quality gates, and fetch results. See the public REST API section below for code examples. ## Ready to automate API testing in your pipeline? Start your free 15-day trial. Install a plugin and run your first test pack in minutes.