Official MCP RegistryListed
IA-QA Security — 30 tools
Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.
First seen 26 Oct 2026. Evidence as of 5 Nov 2026.
30
Tools
From an anonymous probe
1
Source listings
Each with its own history
50
Recorded changes
Since first seen
Tools
| Tool | Description | Behaviour |
|---|---|---|
| bias_detect | Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score (0-100), sentiment analysis per variant, pairwise Jaccard similarity, and a human-readable verdict. No API key needed — runs entirely locally. | Read-only |
| cookie_security_audit | Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path scope, Max-Age/Expires, __Host-/__Secure- prefixes. Flags insecure patterns: missing HttpOnly on session cookies, missing Secure flag, SameSite=None without Secure, overly broad Domain, and excessive TTL. Returns per-cookie grades and an overall security score (0–100) — the score is the WEAKEST cookie, not the average, so one leaking session cookie cannot be averaged into a green result (average_score is reported separately). | Read-only |
| cors_checker | Would a browser on this origin be allowed to read this URL? Verdict allowed | blocked | unknown, the reason, and the header to add. Only GET and HEAD are really sent: other methods measure the preflight alone. To audit many origins use cors_test. | Read-only |
| cors_test | Audit a URL for CORS misconfigurations across several origins: wildcard with credentials, reflected origin, null origin, subdomain bypass, missing Vary. Returns risk level (safe/low/medium/high/critical) plus per-origin results. "unknown" means nothing was tested: every origin failed to connect, answered 5xx, or was refused with no CORS header (a 404, a firewall); never read it as "safe". | Read-only |
| decode_jwt | Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry date. Use to inspect claims (sub, iss, exp, roles) during debugging or when integrating with an auth provider. | Read-only |
| detect_secrets | Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, Slack/Teams/Discord webhook URLs, session cookies, database connection strings, and generic passwords. Returns findings with severity. Run before every commit. | Read-only |
| find_tool | Search available MCP tools by keyword or category before calling them. Returns names, descriptions and, on request, inputSchemas. Queries are logged 90 days, screened for credentials and personal data. Categories: data, dev, encoding, eval, integrations, llm, meta, qa, rag, security, text, web. | Read-only |
| function_call_validate | Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/missing args. Reads the definitions as OpenAI (`parameters`), MCP (`inputSchema`) or Anthropic (`input_schema`) write them, or as plain `required_args`/`optional_args`; reads the call as `arguments` (object or JSON string), `input` (Anthropic tool_use) or an OpenAI `{function:{…}}` wrapper. | Read-only |
| generate_hmac | Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verification (GitHub, Stripe, Twilio), and JWT validation. | Read-only |
| generate_password | Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when resetting user passwords, seeding test accounts, or generating API secrets. | Read-only |
| guardrail_test | Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex. Returns pass/fail per rule. | Read-only |
| hash_text | Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or produce a fixed-length digest of any input. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. | Read-only |
| http_status_lookup | Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code in the IANA HTTP Status Code Registry (1xx-5xx, including 226, 425, 451, 508, 511 and the WebDAV codes) with its defining RFC; anything outside the registry is reported as `registered: false` rather than described. `cacheable` means heuristically cacheable by default per RFC 9110 §15.1. | Read-only |
| latency_benchmark | Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarking. | Read-only |
| mcp_schema_lint | Lint one MCP tool definition with the same rules as mcp_server_health_check: errors break the MCP spec (FAIL), documentation_issues are what its strict mode refuses — a parameter without description or type (FIX, never an A) — and suggestions are style only (snake_case) and change nothing. | Read-only |
| mcp_server_evaluate | Check that a live MCP server over Streamable HTTP speaks the protocol, 2026-07-28 or earlier: handshake or server/discover, tools/list and its definitions, error codes, one tools/call, structuredContent against outputSchema, latency. Returns PASS/FIX/BLOCK with a 0-100 score, or INCONCLUSIVE (score null) when authorization is required. The verdict covers the PROTOCOL, never whether tools answer correctly: what_this_does_not_prove lists what was not measured. Called: only test_tool_name, or a tool annotated readOnlyHint: true. A refusal of invented arguments is not scored (tool_behaviour: refused_placeholder); pass test_tool_args to exercise the tool. Private addresses and stdio are out of reach: paste tools/list into mcp_server_health_check. | Read-only |
| mcp_server_health_check | Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw JSON-RPC or its result), a bare array of tools, one tool definition, or a manifest carrying name/description; input_shape says which one was read. Validates every tool against the MCP spec (name 1-128 chars of A-Z a-z 0-9 _ - .; camelCase and a tool with no parameters are valid; inputSchema of type object; required fields listed in properties) and, with strict, documentation (description ≥ 20 chars, every parameter with a description and a type). verdict: FAIL when a tool breaks a rule or no tool is found, WARN when only a manifest's server name/description is missing, PASS otherwise. A tools/list carries no server name, so those two checks are not scored on it (the name comes from initialize). Gate on verdict or on checks[tool_quality].pass. | Read-only |
| parse_http_headers | Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing security headers (HSTS, CSP, X-Frame-Options, etc.). | Read-only |
| prompt_injection_scan | Scan user input or prompts for prompt injection patterns. Pattern-based: it recognises known phrasings and structures, not intent — an uncovered paraphrase or language reads clean, so clean is not proof of safety. Instruction overrides are covered in 11 languages (EN, FR, ES, DE, IT, PT, NL, RU, ZH, JA, AR), also after removing invisible characters, lookalike letters, spacing and leetspeak (marked `obfuscated`). Detects overrides, jailbreaks, role manipulation, encoding tricks, chat-template delimiters and fake role headers, template injection ({{…}}, ${…}) and requests to repeat the preceding context. A match inside quoted or fenced text is reported one level lower and marked `quoted`, never suppressed; a quote introduced by a live imperative keeps its severity. | Read-only |
| rate_tool | Give honest usage feedback on an IA-QA MCP tool. Give a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high (4-5) only if it genuinely solved your need. Maintainers read ratings, one vote per agent and tool a month: comments and per-tool scores are not published, only the overall average and vote count. Comments are screened: one carrying a credential is not stored, personal data becomes placeholders — describe what happened, not what a model should do. Skip routine successes: signal, not praise. Example: rate_tool({ tool_name: "format_json", score: 2, comment: "Tried to pretty-print a JSON5 file, it rejected trailing commas — not usable for my case." }) | Changes data |
| redact_pii | Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, and JWT tokens with [REDACTED_TYPE] placeholders. Safe to use before logging or sending to an LLM. | Read-only |
| secret_scan | Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), Slack / Teams / Discord webhook URLs, private keys, JWTs, database connection strings, Bearer and Basic auth headers, and hard-coded values assigned to password/secret/token names (a value read at run time — Cypress.env(), os.getenv() — is not flagged). Returns findings with type, severity, line and a redacted preview. Regex-based, no network. | Read-only |
| security_headers_check | Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`. | Read-only |
| shield_analyze | One-call safety gate for an LLM response: grounding (with source), prompt injection on the response AND the prompt (checks.injection / checks.injection_prompt), toxicity, PII, guardrail rules, quality, plus an LLM review on Groq (server key; model "none" skips it and sends nothing out). Returns PASS/FIX/BLOCK, a 0-100 safety score, per-check results and fixes. PII gates the verdict: SSN or card → BLOCK, email → FIX, phone/IP flagged only. | Read-only |
| ssl_certificate_check | Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key exchange info, and an overall grade (A+, A, B, C, F). Detects expired, self-signed, and weak certificates. Use this to audit TLS posture before production deployment or during security reviews. | Read-only |
| toxicity_scan | Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term + predicate), not a semantic classifier — returns per-category risk plus the named rules that fired, so every finding can be checked. Languages: English for every category; French for insults, coarse language, direct threats and self-harm intent; anything else reads clean, so clean is not proof of safety. Text is also matched after undoing leetspeak and lookalike letters. Self-harm is critical only on a first-person intent — a mention ("call 988 if you have suicidal thoughts") is medium. Useful for LLM safety guardrail testing and triage; signal-only, not a calibrated CI gate. | Read-only |
| validate_agent_trajectory | Run declarative assertions on an agent trace (OpenAI tool calls, Anthropic tool_use, LangChain run trees, ReAct logs). Deterministic, no LLM. Assertions: order (tool A before B), must_call, must_not_call, max/min calls, no_error, recovery (a successful step after the last error), no_injection, no_pii. A step is errored when the trace marks it (is_error, status error/failed, success:false) or its text starts with Error:/Traceback — prose is never keyword-scanned. Verdict PASS / FAIL / INCONCLUSIVE (0 steps parsed, never PASS). | Read-only |
| validate_mcp_response | Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSON result and a set of checks to perform. | Read-only |
| validate_url | Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin. | Read-only |
| web_security_audit | Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrates security_headers_check + ssl_certificate_check + cors_test + cookie_security_audit in parallel, merges all findings, then asks an AI model to: (1) rank vulnerabilities by real-world exploitability, (2) generate a remediation roadmap, (3) produce fix code snippets for the detected stack. Returns both raw audit data and the AI analysis. Use this as a one-click security posture assessment. | Read-only |
Change history
- find_tool: input schema changed
- find_tool: description changed (+"descriptions and, on request," +"dev," +"eval, integrations,")
- cors_test: description changed (+"Audit" +"misconfigurations across several origins:" +"reflected origin,")
- cors_checker: input schema changed (+credentials, +request_headers)
- cors_checker: description changed (+"Would" +"on this origin be allowed to read this URL? Verdict allowed | blocked | unknown," +"reason, and")
- mcp_server_evaluate: input schema changed (+test_tool_args)
- mcp_server_evaluate: description changed (+"Check that" +"HTTP speaks" +"protocol, 2026-07-28 or earlier: handshake or server/discover,")
- cors_test: description changed (+"tested:" +"connect," +"or was refused on both requests with")
- server instructions changed (+"These tools" +"operated" +"Report a verdict as a careful tester would: gate review means it could not decide, so say that and never round it to a pass; relay what a result says it did not prove, and explain why it matters to the person you work for.")
- shield_analyze: input schema changed
- rate_tool: description changed (+"Give" +"Maintainers" +"ratings,")
- find_tool: description changed (+"Queries" +"logged 90 days, screened for credentials and personal data." -"Call this when you")
- web_security_audit: input schema changed
- validate_url: input schema changed
- validate_mcp_response: input schema changed
- validate_agent_trajectory: input schema changed
- validate_agent_trajectory: description changed (+"tool calls," +"tool_use," +"Deterministic, no LLM. Assertions:")
- toxicity_scan: input schema changed
- ssl_certificate_check: input schema changed
- shield_analyze: input schema changed
- shield_analyze: description changed (+"One-call safety gate for" +"response: grounding (with source)," +"AND")
- security_headers_check: input schema changed
- secret_scan: input schema changed
- secret_scan: description changed (+"Slack / Teams / Discord webhook URLs," +"keys," +"headers, and hard-coded values assigned to password/secret/token names (a value read at run time — Cypress.env(), os.getenv() — is not flagged).")
- redact_pii: input schema changed
- rate_tool: input schema changed
- prompt_injection_scan: input schema changed
- prompt_injection_scan: description changed (+"structures," +"an uncovered" +"Instruction overrides are")
- parse_http_headers: input schema changed
- mcp_server_health_check: input schema changed
- mcp_server_evaluate: input schema changed
- mcp_schema_lint: input schema changed
- mcp_schema_lint: description changed (+"one" +"with the same rules as mcp_server_health_check: errors break the MCP spec (FAIL), documentation_issues are what its strict mode refuses — a parameter without" +"or type (FIX, never an A) — and suggestions are style only (snake_case) and change nothing.")
- latency_benchmark: input schema changed
- http_status_lookup: input schema changed
- hash_text: input schema changed
- guardrail_test: input schema changed
- generate_password: input schema changed
- generate_hmac: input schema changed
- function_call_validate: input schema changed
- find_tool: input schema changed
- detect_secrets: input schema changed
- detect_secrets: description changed (+"Slack/Teams/Discord webhook URLs, session cookies,")
- decode_jwt: input schema changed
- cors_test: input schema changed
- cors_checker: input schema changed
- cookie_security_audit: input schema changed
- bias_detect: input schema changed
- server instructions changed (+"diff) — the testing tools also return gate: pass | review | fail, the one field to branch a CI step on;" +"https://www.ia-qa.com/devtools/pal/tutorial, and to the step-by-step method at" -"diff);")
- validate_agent_trajectory: description changed (+"warnings, and an overall verdict: PASS, FAIL, or INCONCLUSIVE when the" +"parsed" +"(assertions")
| Source | Listing | First seen | Last seen | Versions |
|---|---|---|---|---|
| Official MCP Registry | io.github.JcJamet/ia-qa-security | 26 Oct 2026 | 5 Nov 2026 | 2 |