diff --git a/qa/CMakeLists.txt b/qa/CMakeLists.txt
index fd95d83833b3c..884c41e4bbafe 100644
--- a/qa/CMakeLists.txt
+++ b/qa/CMakeLists.txt
@@ -5,5 +5,5 @@ endif()
 
 if(WITH_TESTS)
   include(AddCephTest)
-  add_tox_test(qa TOX_ENVS py3 flake8)
+  add_tox_test(qa TOX_ENVS py3 flake8 mypy)
 endif()
diff --git a/qa/tasks/vstart_runner.py b/qa/tasks/vstart_runner.py
index 55d8af8beea76..851816b2c3df5 100644
--- a/qa/tasks/vstart_runner.py
+++ b/qa/tasks/vstart_runner.py
@@ -659,12 +659,16 @@ def _asok_path(self):
         path = "{0}/client.{1}.*.asok".format(d, self.client_id)
         return path
 
-    def _run_python(self, pyscript, py_version='python'):
+    def _run_python(self, pyscript, py_version='python', sudo=False):
         """
         Override this to remove the daemon-helper prefix that is used otherwise
         to make the process killable.
         """
-        return self.client_remote.run(args=[py_version, '-c', pyscript],
+        args = []
+        if sudo:
+            args.append('sudo')
+        args += [py_version, '-c', pyscript]
+        return self.client_remote.run(args=args,
                                       wait=False, stdout=StringIO())
 
     def setup_netns(self):