# zephyr_create_test_case_steps

Create steps for a Test Case in Zephyr. Supports inline step definitions or delegating execution to another test case (also known as 'call to test' via UI). Requires a mode: APPEND adds steps to the end of the existing list, OVERWRITE deletes all existing steps and replaces them with the provided ones. Always ask the user to choose between OVERWRITE or APPEND before calling this tool. Examples: 1. To the Test Case SA-T1, add steps that will test a login page. json { "testCaseKey": "SA-T1", "mode": "APPEND", "items": [ { "inline": { "description": "Navigate to the login page", "expectedResult": "Login page is displayed" } }, { "inline": { "description": "Enter valid credentials and click Submit", "expectedResult": "User is redirected to the dashboard" } } ] } Expected Output: The ID of the Test Steps resource and the API self URL to fetch it 2. To the Test Case MM2-T15, replace all existing steps with new ones that test the settings page for an Admin user. json { "testCaseKey": "MM2-T15", "mode": "OVERWRITE", "items": [ { "inline": { "description": "Open the settings page", "testData": "User role: Admin", "expectedResult": "Settings page is accessible" } }, { "inline": { "description": "Change the notification preference", "testData": "Preference: Email only", "expectedResult": "Notification preference is updated successfully" } } ] } Expected Output: The ID of the Test Steps resource and the API self URL to fetch it 3. To the Test Case SA-T1, add a step that reuses the steps from the Test Case PRJ-T42 json { "testCaseKey": "SA-T1", "mode": "APPEND", "items": [ { "testCase": { "testCaseKey": "PRJ-T42" } } ] } Expected Output: The ID of the Test Steps resource and the API self URL to fetch it

Agent View of the PolicyLayer registry record for `zephyr_create_test_case_steps`. HTML page: https://policylayer.com/tools/smartbear-mcp/zephyr-create-test-case-steps

## Facts

- Tool: `zephyr_create_test_case_steps`
- Server: SmartBear MCP (`SmartBear/smartbear-mcp`) — https://policylayer.com/tools/smartbear-mcp.md
- Homepage: https://github.com/SmartBear/smartbear-mcp
- Risk category: Write (Medium risk)
- Registry record: grade F, identity unverified
- Server rate-limited: no
- Parameters: 3 (3 required)
- Recommended policy verdict: Rate-limited

## Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `mode` | string | yes | Valid values: `"APPEND"`, `"OVERWRITE"`. <br> `OVERWRITE` deletes and recreates the test steps and associated custom field values using the provided input. Atta |
| `items` | array | yes | The list of test steps. Each step should be an object containing `inline` or `testCase`. **They should only include one of these fields at a time**. |
| `testCaseKey` | string | yes | The key of the test case. Test case keys are of the format [A-Z]+-T[0-9]+ |

Parameters from the server's own tool schema.

## Example call (MCP tools/call, JSON-RPC 2.0)

```json
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "zephyr_create_test_case_steps",
    "arguments": {
      "mode": "<mode>",
      "items": [],
      "testCaseKey": "<testCaseKey>"
    }
  }
}
```

## Why zephyr_create_test_case_steps is rated Medium

This tool modifies test case definitions within Zephyr, a test management system. While OVERWRITE can delete existing steps, the operation is reversible (steps can be re-added), and the blast radius is limited to test case metadata rather than production data or financial systems.

From the tool's own definition: "Tool description explicitly states it 'Create steps for a Test Case' and includes modes 'APPEND' (adds to existing) and 'OVERWRITE' (deletes all existing steps and replaces them). These are reversible modifications to test case data."

Risk signals: High parameter count (16 properties) · Admin/system-level operation

## Use case

AI agents use zephyr_create_test_case_steps to create or update resources in SmartBear MCP, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your SmartBear MCP environment.

## Recommended policy (PolicyLayer)

Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches SmartBear MCP:

```json
{
  "version": "1",
  "default": "deny",
  "tools": {
    "zephyr_create_test_case_steps": {
      "limits": [
        {
          "counter": "zephyr_create_test_case_steps_rate",
          "window": "minute",
          "max": 30,
          "scope": "grant"
        }
      ]
    }
  }
}
```

## Other tools on SmartBear MCP (239)

- `collaborator_delete_collaborator_remote_system_configuration` — Destructive — https://policylayer.com/tools/smartbear-mcp/collaborator-delete-collaborator-remote-system-configuration.md
- `contract-testing_admin_delete_role` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-role.md
- `contract-testing_admin_delete_team` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-team.md
- `contract-testing_admin_delete_user` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-delete-user.md
- `contract-testing_admin_remove_role_from_user` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-remove-role-from-user.md
- `contract-testing_admin_remove_user_from_team` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-remove-user-from-team.md
- `contract-testing_admin_reset_roles` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-admin-reset-roles.md
- `contract-testing_delete_all_integrations` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-all-integrations.md
- `contract-testing_delete_branch` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-branch.md
- `contract-testing_delete_environment` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-environment.md
- `contract-testing_delete_integration` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-integration.md
- `contract-testing_delete_pacticipant` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-pacticipant.md
- `contract-testing_delete_secret` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-secret.md
- `contract-testing_delete_webhook` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-delete-webhook.md
- `contract-testing_regenerate_api_token` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-regenerate-api-token.md
- `contract-testing_remove_label_from_pacticipant` — Destructive — https://policylayer.com/tools/smartbear-mcp/contract-testing-remove-label-from-pacticipant.md
- `reflect_cancel_suite_execution` — Destructive — https://policylayer.com/tools/smartbear-mcp/reflect-cancel-suite-execution.md
- `reflect_delete_previous_step` — Destructive — https://policylayer.com/tools/smartbear-mcp/reflect-delete-previous-step.md
- `swagger_delete_portal_product` — Destructive — https://policylayer.com/tools/smartbear-mcp/swagger-delete-portal-product.md
- `swagger_delete_table_of_contents` — Destructive — https://policylayer.com/tools/smartbear-mcp/swagger-delete-table-of-contents.md
- `collaborator_reviewservice_action` — Execute — https://policylayer.com/tools/smartbear-mcp/collaborator-reviewservice-action.md
- `collaborator_test_collaborator_remote_system_configuration_connection` — Execute — https://policylayer.com/tools/smartbear-mcp/collaborator-test-collaborator-remote-system-configuration-connection.md
- `contract-testing_execute_webhook` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-execute-webhook.md
- `contract-testing_generate_pact_tests` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-generate-pact-tests.md
- `contract-testing_review_pact_tests` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-review-pact-tests.md
- `contract-testing_test_execute_webhooks` — Execute — https://policylayer.com/tools/smartbear-mcp/contract-testing-test-execute-webhooks.md
- `reflect_add_prompt_step` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-add-prompt-step.md
- `reflect_connect_to_session` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-connect-to-session.md
- `reflect_execute_suite` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-execute-suite.md
- `reflect_run_test` — Execute — https://policylayer.com/tools/smartbear-mcp/reflect-run-test.md
- …and 209 more: https://policylayer.com/tools/smartbear-mcp.md

## For agents

This record is a snapshot. Live verdicts and the full registry:

- Check every server in your MCP config at once: `npx -y policylayer stack`
- Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md)
- Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events`

---

Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=smartbear-mcp · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/smartbear-mcp