Release Radar Ep01: Seven Vendors Shipped MCP Servers in One Quarter

Seven vendors shipped MCP servers in a single quarter and none of them coordinated it. Spira, Checkmarx One, BlazeMeter, Tosca Cloud, NeoLoad, Delphix and Perfecto all did the same thing inside the same few months, and that pattern is the thread running underneath this episode.

Release Radar reads through enterprise release notes every two weeks, so nobody on your team has to dig through 30 sets of them looking for the one line that matters. Episode 01 covers July 17 to August 3, 2026: 14 releases, on screen, one page at a time.

The other thread is evidence. Perfecto 26.8 attaches the AI's own context to your execution report as a file you can download and keep with the run. Panaya Test Automation 26.08.105 puts an indicator on any test step that only passed because self healing stepped in. BlazeMeter 3.1 gave Service Virtualization an audit log. Three vendors, three separate weeks, all answering the same question that is coming for everyone: prove what your AI actually did.

The one to act on today is Black Duck Detect 11.5.1. A Gradle regression meant container modules with no build file of their own, where dependencies are declared up in the root, could report zero components on a clean, green, successful scan. If you approved a release against a Gradle SBOM in that window, rerun it and diff the component counts before you assume you are fine.

Also covered: TestRail 10.6.0 and 10.6.1 finishing run creation on projects carrying 25 million tests, a beta import path off Worksoft, Checkmarx SCA making the pnpm lockfile the authoritative dependency source, OpenText Functional Testing taking Python scripting out of beta, and Tricentis qTest switching everyone onto the new Manager experience, where opting out quietly freezes those users out of every future improvement.

Every release covered in this episode is written up in full under product release updates. New episodes publish on the first and third Tuesday of each month.

Three vendors, three weeks, and nobody coordinated it (0:00)

Three different vendors, three separate weeks, and none of them are talking to each other. Perfecto now hands you a file that shows what the AI was working on when it made the call. Panaya puts a flag on any test step that went green because self-healing stepped in. and BlazeMeter started writing down who touched a virtual service and when. Nobody sat in a room and agreed to do all of that. They did it because somebody is about to ask us to prove what our AI did.

And right now, most of us can't answer that question. That's the common thread throughout this entire batch. So, let's get into all of them. There are 14. I'm Chris Carpenter with Merito.

What Release Radar is (0:46)

Every two weeks, we'll read the release notes for the tools that our customers actually use. We do it so no one on your team has to dig through 30 sets. Hopefully they don't have to go through all the PDFs and look for that one line that matters to them. What you're looking at right now is a list of our own product release pages. Everything I cover is written down on merito.com.

So all of these releases have notes and we've aggregated them for you. They're all linked below. We also have chapter links as well. So, those are down there, too. Grouped by vendor.

So, jump straight to the stack that's relevant to you. If that's what you came for, by all means, it won't hurt my feelings. But, this entire stack covers July 17th through August 3rd. And we're going to start with Perforce.

Perforce Perfecto 26.8 (1:34)

Perfecto 26.8. The headline here is small enough that you might have actually scrolled past it. When a test leans on global knowledge in one of the AI flows, the execution report now has a plain text file called AI.txt that shows you exactly what knowledge was used and you can preview it and download it and keep it tied to that specific execution run. And here's why that lands a little harder than what the size of that announcement suggests. Up until now, when they asked in a release review why the AI actually clicked on what it clicked, we always got kind of like a pass off.

It was always a shrug and maybe a promise to go look into it and then no one ever follows up. But that answer won't survive an audit. And the reasoning now sits at that same that same record in your execution and that same record that you already signed off on. So it's all aggregated in one spot. A test that never touched global knowledge, by the way, it'll give you nothing at all.

So if you go look at your results and it didn't touch global knowledge, then that feature is actually working correctly. So that text file will only live on that execution when global knowledge was actually accessed. So here we've got we've got DevTunnel. So there's some updates here. Two operational items.

And if you skip these, you're probably going to have a bad day. So, it'd be good to write these down. The certificates behind DevTunnel got renewed. For those of you that have been working with SDLC tools or you run the infrastructure for any tools really, anytime the certificates get updated, it can be a little bit of a nightmare. So, you definitely want to write this down.

January 9th, 2024 is you're going to need a full reinstall if that's a certificate that you have. An old install will carry that old certificate and if it does then it just won't connect and that covers developer machines and CI agents equally. So this is across your entire infrastructure. If things do not connect do check your DevTunnel. The second item, upload heavy API calls now have a ceiling request of 20 per minute.

If you go past that, you start getting a HTTP 429 with a retry after header. So, it's the artifact upload tooling that you're going to want to check. And if your pipeline retries the second something fails, you're about to make your problem much worse. So definitely go check to make sure that your that your pipelines and your artifacts that are getting uploaded won't be affected by this rate limit. Again, that's 20 requests a minute.

So Quantum 3.2.5 that lets you decide what happens when a visual comparison fails and out of the box it just carries as on. So if your visual comparison is a release gate for you, go and switch that to abort. Very important. And if you're somewhere near iOS 27 simulators, if you've got iOS 27 on your on your road map to for support, you actually have to name Appium 3.3 explicitly on those configs. And anything compiled Intel only needs a specific ARM 64 build.

All right. And now staying with Perforce, we move to BlazeMeter 3.1.

Perforce BlazeMeter 3.1 (5:17)

This came out, I think it was July 19th, but service virtualization finally got an audit log and it searches across workspaces by date range, event type, workspace, and keyword. So if you've ever lost a morning to why a virtual service started answering differently after a deploy then your me your mornings now they should only last about 4 minutes of filtering. So this is a huge update very welcoming update. One caveat first because with any log a log that no one reads is just a log. It's a bunch of text.

So decide who follows up on which events. Now the bigger item is the new assertion type that reads for meaning instead of exact characters. This gives a semantic type of flare to the different logs. So you give it the response that you expected and it decides whether the real one says the same thing and that there's no regular expression or custom script. This is very specifically built for LLM endpoints and anything else where the wording might move while the answer stays.

Right. Now, the part that I keep repeating until people stop doing it. Use that assertion where the wording is supposed to move and keep exact matching on amounts, identifiers, entitlements, and anything that has a contract that hangs off of it. a semantic check sitting on a payment field is it's going to be how you actually ship a bug that costs real money and passes that on every test on the way out. So, make sure that you scope that accordingly. This last one, it's small, but you can now pin the monitoring buckets that you actually watch.

I the big fan of these types of features. So it's per user and it survives a session which sounds like nothing until it's 2 in the morning during an incident. Third Perforce item is Delphix 2027.4 continuous data and hyperscale compliance.

Perforce Delphix 2027.4 (7:32)

It all now runs out of one place on one user interface, one API and one CLI behind all of it. masking jobs, orchestration flows, they're all included with live execution status. If your data provisioning and your masking grew up as two operations with two different owners, this is the release to address that and fix it. So, we'll do the boring part first and settle who's allowed to start a job, who approves an exception, and what evidence you keep. Centralizing is very important. It's very important to identify who has the ownership because if that stays unresolved, it just moves the argument to a brand new screen and we just want to we want to get that settled and buttoned up.

And there's an MCP server in here now. So an AI client can provision and refresh data under role-based access. But hold that thought for a second because we're going to come back to it at the end. It's probably the most interesting thing in this entire episode. Panaya next. And there are three updates for Panaya to get through starting with July 17th with TestDynamix and Seemore where multi-approver signoff is the feature to look at.

Panaya TestDynamix and Seemore, July 2026 (8:44)

So now we can ret we can require up to six approvals in sequence before execution starts and again on the results as well each one completed in order. So, that's a very different artifact from four people replying on an email thread that everything looks good. And this will sit very well with your compliance package, especially with electronic signatures. We've got two admin items in here, and both matter more than more than some of the other features in these notes. Deactivation notices can now go to whoever actually needs them.

So security and service management here about an offboarding directly and if there's a systems integrator entity working in here as your as your partner implementation partner or if they're just if they if they have access to this system then they might be working across several customer accounts. But we now can have offboarding signals be routed based off of various different business needs. So, if you run offshore delivery or you use a system integrator, go look at that because most of these shops run today as a shared login. And when we're talking about compliance, a promise is a promise is just a promise that can be broken.

Panaya TestDynamix and Seemore, August 2026 (10:21)

Then on August 3rd, for the same product line, if July and August look similar on screen, then you're reading that right. The approvals in the video summaries carry forward and what's actually new in August sits on mostly on the SAP side. AI assisted code corrections went generally available across the S4 code project and impact analysis picked up unit test guidance. The recorder now writes up what happened in a recorded manual run. And the key there is that it ties in the steps and then also the overall results.

So your test lead can now triage evidence without sitting through 40 minutes of screen capture. And if you think about it that the real time saver is on the triage, but when you also have the regulated signoff now all you have to do is watch the tape. The one that I wouldn't skip is Fiori. So S4 Accelerate now picks up on business catalog, business group and business role changes and it raises them as their own corrections all with unit tests linked to them. Kind of a big deal.

So the Fiori authorization changes move who can see what all without a single line of code changing. that walks straight past a code focused impact review and it shows up six months later as an access finding. That does that make sense? So because of those system level configuration changes, it does not get caught in a code review because there's no code changing. And so those would have normally found been found in an access finding when you're actually triaging postmortem. So now that's no longer a problem. A third item from Panaya is their test automation tool 26.08.105.

Panaya Test Automation 26.08.105 (12:18)

If you are working with Worksoft, stop scrolling because there's a beta import that turns Worksoft SAP GUI exports into runnable executable scripts. Yep, you heard that right. You can finally get rid of Worksoft. They're locatorbased, flat or componentized, single or bulk. And it's in beta right now, but this is only available through Panaya support and through Merito as well.

So if you want to get access to see how you can import your Worksoft SAP GUI scripts into Panaya to you run in Panaya test automation 26.08.105. Please let me know. You can comment in the comment section below or fill out our book consultation form and put a note in there. Let me talk to Chris and I will make it happen. The migration export is for me it's going to be awesome because our customers have wanted to get off of Worksoft but it's such a big investment that they've had over with their legacy automation and that really changes the migration conversation from rewrite everything to just a simple convert and validate.

And of course I say I say simple but I shouldn't say that. It's just a convert and validate. And those have very different budgets when you sit down and try to scope the effort. Treat whatever comes out of the other side as a candidate rather than a finished asset. Whenever we do any type of migration, we want to we know that there's going to be some work.

The these migration assistants, we've been doing them for almost 20 years now. And there's no perfect migration, but when you come back through, you actually understand the tool. you're very good at scripting whether it's low code no code if you actually have scripts if you're taking a programmatic approach if you know what you're doing then there are some accelerators and some things you can do to increase the increase the output the high quality output one recommendation is to compare the converted coverage against the source I would baseline it against a real SAP environment and I take a very hard look at the locator behavior. And of course with any migration, you want to keep your approval evidence before anything legacy actually gets retired. So there's a couple nuances, but again, let me know if you want to hear more about this and I can make it happen. This is something that I mentioned already, but there's two more items for this specific release.

The first is the indicator that I mentioned on any instruction that had some difficulty being identified. And if it only passed because there was a self-healing that stepped in, then that's the receipts we talked about because now you can finally tell when a green run was actually a rescue. Whether you take that quietly or escalate it depends on what the test is trying to protect. But now you actually get to make the call and you can go back and edit if you so choose. Run skipped for blowing past the 24-hour agent time limit can now be rerun on their own without having to restart the whole execution.

But if you are hitting that regularly, it's telling you something about your agent capacity. So I probably want to listen to it and make some changes if you're seeing it over and over again. two smaller ones. Because the test list now shows the last 10 runs as the a bar strip that will tell you if you have any flaky test cases. It'll essentially announce itself. And then also draft executions are labeled everywhere now, which stops somebody from passing off a draft status as a release evidence item. All right, we've got Tricentis next.

Tricentis SeaLights, July 2026 (16:33)

Tricentis with SeaLights from July where coverage analysis is new. If you sit in go no-go meetings, this is probably the most useful thing in this entire batch of updates from Tricentis. It pulls coverage across services, test stages as well as teams, and it aggregates them all in one shared view. And that refreshes every 15 minutes. I highly recommend you pin it to the start of a sprint.

You lock it into a release window or you roll running periods like I every last the last seven days. The part that actually matters here is the change coverage sitting next to failing tests in the same view. overall coverage can look completely healthy while the code your team touched last week has almost nothing on it. So those two numbers living in separate reports is exactly why these things get missed and it happens all the time. You can now scope by lab application branch or code label. Lab scoping is the one to reach for if your service [landscape] is complicated, but whoever is reviewing your code coverage no longer needs to know which 12 services are involved. One piece of advice before you turn this into an actual gate itself. agree your labs, your application ownership in your release window definitions first because otherwise you're gating on a view that nobody will ever trust and people will route around this inside all of your sprints.

Tricentis qTest, August 2026 (18:26)

Still on Tricentis, we have qTest from August. This has a refreshed manager experience and it's switched on for everybody. Now read this. I'm going to read this next part carefully because anyone who stays on the older experience stops receiving future interface improvements. So that is a fork in the road rather than a soft gentle nudge from the product team.

It is highly recommended that you manage the adoption and you do it meaningfully and purposefully and you write down who's actually opted out, why, and when they're coming back. The people who do opt out are the ones who are going to end up stranded and you find out about this 6 months later in a meeting. Someone's going to be describing a feature and it's going to be one that doesn't exist on their screen. All right, moving to Black Duck.

Black Duck Detect 11.5.1 (19:22)

Black Duck Detect 11.5.1. This is a patch release. Normally, I'd skip past a patch release, but not this one. This one had a bug in the Gradle scanner. And that one hit a very specific kind of module.

These were container modules with no build file of their own where the dependencies all get declared up at the root. Those modules came back empty. So the scan reported zero components. That was with no error and a clean successful scan with nothing in it. That's close to the worst possible type of failure mode a bill of materials has because a green pipeline reads as proof that everything is covered.

So your policy engine, your license review, your vulnerability gates, they were all deciding on partial evidence and nothing anywhere in any logs or any interface told you otherwise. If you approved releases off Gradle scans themselves during this window, then I would highly recommend you go rerun them now and then diff the component counts because you assume that you're fine, but it would be good to rerun those. So expect the count to move and there's going to be a jump most likely probably going to be a jump and a jump usually means that the fix is doing its job but somebody still needs to go look at it before anyone touches a policy threshold. Also fixed in here is an index out-of- bounds exception during component location analysis when a version string has spaces in it. You're going to want to schedule it.

It's if you react to it, you might have some issues with your Java 8 because Java 8 support goes away in Detect 12.0.0 and that's not expected until Q3. CentOS support in the Docker Inspector also goes with it. So you're going to want to inventory your runners now while it's still relatively cheap. Moving on to Checkmarx.

Checkmarx SCA, July 2026 (21:42)

Here we go. Checkmarx SCA specifically SCA from July. This one's a shorter one. The pnpm lock file is now the authoritative source for resolving direct and transitive dependencies. So if you're a pnpm shop, your dependency graph just got more accurate, which also means it's it also probably got bigger. Expect a delta, but also don't panic at it.

Resolver 2.4.1 is it's expanded the deployment and artifact coverage. So it now picks up the ARM 64 installers which has a wider archive extraction and the SBOM generation you can now scope to packages and binaries only. So, one smaller item here is that it's probably going to catch somebody is the SBOM output field casing has changed. So, if anything downstream parses those fields, test it before you roll out because that failure is going to show up. It's going to be a silent mismatch and you probably won't get an error. OpenText now has functional testing 26.3.

OpenText Functional Testing 26.3 (22:57)

There are a couple releases in this wave, but we're going to talk about 26.3 first. Python scripting is properly supported now. Previous versions were beta, and people have been asking for this for years. I've got a YouTube video on it. Merito actually has a converter, so you can convert your VB script to Python at the click of a button.

It's a lot of clicks. It's a lot of buttons, but yeah, we do have a conversion utility and it's not yet announced. This is not a formal announcement. I'm just telling you that it is in the works and it is being piloted now by a select few customers. So if you want access to it, please do reach out, click on the book consultation button and or send me a private message.

In terms of back to Python, there's an already made GitHub action for running tests. There's an Azure DevOps extension that you can also use as a specific use Windows user or you can use Jenkins which can order ALM tests by ID. GitHub actions is probably the practical place to start because functional test execution moves into the same pipeline definition as everything else. That's that one's a little less special case for your platform team to maintain and explain. But the next one is the smart verify.

This is the one to govern because it builds checkpoints with a plain language description and it runs that through Aviator. If you don't know what Aviator is, reach out, let me know. But you it runs Aviator against your own model connection and that connection is configurable through the object model. So it earns the same change control as any other pipeline integration you might implement. All right, moving on to SDP.

OpenText SDP 26.3 (25:00)

SDP 26.3 landed alongside with functional testing and advanced requirements adds versioning reuse variance and traceability end to end. The CI and code lets you store UFT tests in the platform itself and allows you to run them on a schedule. And both of those, keep in mind, are licensed separately. So if you want to implement those features, just know that there's an added price and to plan around it. And if your traceability story runs through three different exports into a spreadsheet which one person owns, then this release is aimed specifically for that persona.

All right, moving on to stronger workflow controls. I think this one's important. Two things to catch in here. Business rules can now lock finalized manual run steps through the API as well as the interface and that closes a in my opinion a real gap. The interface validated and the bulk path quietly did not.

So you would you would be uploading a bunch of results via API and it didn't actually show that it was that it was actually validated and the predefined cross-release cycle time widgets were all deprecated as well. So if those sit on any of your dashboards, you'll want to wait. You want to be sure that you replace them before somebody tries to go pulling in a metric and then they don't get it. They don't have access to it.

Inflectra Spira MCP Server (26:42)

Moving on to Inflectra. Inflectra has shipped an update to their Spira MCP server and assistants could already read project data, but now they can create work items, update them, organize them, even collaborate on them. And they can all do that from Claude Code, from Cursor, Copilot, even VS Code. So the assistant that just wrote the code can now also move the ticket forward. And this is something that we at Merito use.

We use Spira for our development and this is a feature that we absolutely love. We do want to remind you that this is either the future or a potential governance problem. So you do want to put some governance and guidelines in place. We've got a whole AI implementation development framework that would help you deploy this and make use of it and also protect your organization. So, this is this is actually a huge update for Spira and I would love to show it to you. All right, we have a couple updates for the TestRail.

TestRail 10.6.0 and 10.6.1 (27:44)

You'll notice that we actually have a product release update for TestRail 10.6.0. 10.6.0 was a substantial release, I'd say. And the performance work is probably the story. So, case pages themselves load roughly 80% faster on any of your large AI enabled projects and their API calls, against an archived run. Those ones are all 30 to 50% quicker.

So, your run creation now finishes on projects carrying 25 million tests where it used to run out of memory and now it doesn't. So, bulk assignment works on runs over 30,000. It's substantial. 10.6.1 came in right behind as a hotfix for 10.6.0. So, if you're planning on upgrading a version, pin to the later one, 10.6.1, which by the time you see this, I think 10.6.2 is going to be out and we might actually have a blog for it already. But one of the one of the features scroll down to the update was this 10.6.0.

Let's go look at this. So the admins can choose up to they can index up to five custom fields and that'll speed up filtering and reporting. So, the only thing to call out there is specifically picking those five on purpose, meaning the fields that you want to choose are going to be for your release filters and your compliance reports, the ones that those actually use, and revisit that list when reporting patterns change because the indexing does have a cost to it. It has a storage cost and it does have a little bit of write performance as well. Cool. All right. the thing I said I'd come back to.

Seven vendors shipped MCP servers in one quarter (29:46)

So count them up. Spira has an MCP server. Checkmarx one added a native MCP server. BlazeMeter put in MCP search. And you can do that across all your tests and your executions.

Tosca cloud is generating API messages through it. NeoLoad added MCP connectivity. Delphix has one now and Perfecto runs AI scriptless through it as well. So again, that is seven vendors in one quarter and none of them none of them talked to each other. None of them coordinated any of it and they're all updating their MCP servers and making those available.

What that means for your governance model (30:27)

Here's what that means practically because inside of a year, your AI assistant is going to reach across test management, performance tooling, your security scanning, and also your data platform. It's all going to happen in one conversation with that AI assistant. And that's while that's useful. That's great. It also means that the blast radius is going to be crazy.

It could be scoped so badly where one prompt just got a lot wider than anyone's threat model could possibly account for. Nobody's really written the governance model for that much AI in your software development life cycle. I know we've got a couple a couple really good frameworks, but we're still working on it's a living breathing document. So we'd love to help expedite that for you if you'd like to talk through some of the nuances and some of the things that we've seen. But if that's a problem that you're already thinking about, put it in the comments and I'd rather help you build it and have a deep dive around real questions than try to guess what you all are looking for. I'd like to thank you for watching and go ahead and like, comment, subscribe, and hopefully we'll see you on the next one.

Close (31:39)