Polarion MCP
Your Polarion work, one conversation away.
Find requirements, review documents and prepare test runs through your AI assistant.
An open-source Model Context Protocol server that exposes every Polarion REST operation (284 tools, generated from the current API definition).
Connect your assistant · Daily workflows · Tool catalog
On this page:
What the connector does for you
Your AI client → Polarion MCP → your Polarion REST API. Ask a question; the assistant chooses tools, reads the returned data and proposes an answer or change.
- Find answers: search requirements and defects, read LiveDocs and inspect traceability links.
- Prepare work: draft test cases, prepare runs and record the test outcomes your team supplies.
- Change data, safely: the assistant can create and update Polarion data, and every write can be previewed first (
dry_run: true shows the exact request without sending it). Prefer read access only? MCP_READ_ONLY=1 blocks all writes. Set approval rules in your AI client; previews do not create an approval lock.
- Inspect what you run: MIT source, build provenance and signed container images. See supply-chain verification.
| Domain | Outcome |
|---|
| Work items | Find requirements, triage defects, prepare field updates. |
| Documents and pages | Read LiveDocs, inspect parts, manage attachments and supported pages. |
| Test management | Prepare runs and record supplied results. |
| Plans and collections | Review release scope and document collections. |
| Projects, people and configuration | Discover accessible projects, users, allowed field values and metadata. |
The landing page shows counts by domain, computed from src/tools.ts. The 284 tools count covers generated REST operations; configured toolsets and additional helpers change the exposed catalog. Selected Work Item writes validate enumeration values, custom-field keys and user references. Features and limits describe the scope.
A day with Polarion MCP
These are illustrative conversations using real tools, not recorded outputs. Project types, link roles and permissions vary.
| Ask your assistant | Tools and result | Your control |
|---|
| “Which open defects could block this release?” | getWorkItems, getWorkItem: a scoped list of severity, owners and missing information. | Read-only triage; approve any later reassignment. |
| “Review this LiveDoc and propose clearer acceptance criteria for REQ-17.” | getDocument, getDocumentParts, getWorkItem, patchWorkItem: a rewrite of the requirement’s description. | Preview with dry_run: true; approve before saving. |
| “Draft tests from these requirements, then record the results I provide.” | getWorkItems, postWorkItems, postTestRuns, postTestRecords: proposed cases and a run, then supplied outcomes. | Check existing tests, preview each write and approve. The connector does not execute product tests. |
| “Summarize this release plan and its latest test runs.” | getPlan, getWorkItems, getTestRuns: a draft status update with source IDs and missing data. | You decide release readiness. |
| “Find requirements without a verifies link to a test case.” | getWorkItems, getLinkedWorkItems: a scoped gap list and existing candidate tests. | Confirm link roles and scope before creating anything. |
Explore the chat-style walkthroughs.
Get connected
Two setups, pick by where your client runs. You need a REST-enabled Polarion instance and a PAT. Every guide starts from nothing and ends with a check.
| Setup | Use it when | Guide |
|---|
| Local (npm / npx) | Your desktop or coding client runs on your computer and starts MCP servers. | Local setup |
| Server (Docker) | Your client runs in the cloud (claude.ai, ChatGPT) or your team shares one server. | Server setup |
Then open the guide for your client:
For OpenAPI clients, Custom GPT Actions and n8n, run the separate REST wrapper (see the client guides). Keep credentials out of Git. There is no public Polarion relay. See also the client index and deployment.
FAQ
Local: your client starts the server on your computer with npx. Server: you host the server with Docker and the client connects by URL; claude.ai and ChatGPT need it. Custom GPT Actions and n8n use the REST wrapper on a server.
Polarion user page > Personal Access Token > name and expiry > Create Token. Copy it at once, it is shown only once. If the page says token generation is not allowed, your administrator must enable com.siemens.polarion.rest.security.restApiToken.enabled=true.
Polarion enforces the permissions of the token owner. Server mode uses each caller's own token and the server stores none. Tool results go to your AI provider, so your organization's data policies apply.
Yes: set MCP_READ_ONLY=1 and restart. Only read tools are exposed. In write-enabled sessions every write tool can preview with dry_run: true.
Local: run npx -y polarion-mcp in a terminal with the same values to see the real error (Node older than 22 and JSON typos are common). Server: open https://YOUR-SERVER/health, then read docker logs polarion-mcp.
More answers: docs/clients.md.
Feedback and community
Feedback and questions: open an issue. Include what you tried, your client and server mode, and what you expected. Leave credentials out.
Nothing documented for your case? Open an issue or PR on the repo and go wild. A clearer example, a small fix or a new integration can help the next team. Read Contributing for source builds and checks. Report vulnerabilities through the security policy.
Built by Phillip Bösger, building on @Jonasdero.
Documentation
Docs index · Configuration · Deployment · Security · Usage · Architecture · Extensions · Releases
License
MIT © Phillip Bösger
