IA-QA Security — 30 tools

Name: IA-QA Security — 30 tools
Author: JcJamet

MCP serverMCP

Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.

by JcJametrepository ↗v1.0.1

Is this yours?

This record is unclaimed

Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.

Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"ia-qa-security-30-tools","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.

Claim this record

Observed by Wellknown

Evidence

Everything here was measured by our prober or read from a registry. Nothing is self-reported.

30-day availability9/9 checks ok

30 days ago

Endpoints

https://www.ia-qa.com/mcp/securitymcp streamable http · checked on a schedule

Registry facts

Not distributed through a package registry we index.

when	check	result	http	latency	detail
7 h ago	mcp initialize	ok	200	19 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
15 h ago	mcp initialize	ok	200	18 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
23 h ago	mcp initialize	ok	200	58 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
30 h ago	mcp initialize	ok	200	52 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
2 d ago	mcp initialize	ok	200	81 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
2 d ago	mcp initialize	ok	200	18 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
2 d ago	mcp initialize	ok	200	18 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
3 d ago	mcp initialize	ok	200	177 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools
3 d ago	mcp initialize	ok	200	19 ms	server ia-qa-toolbox-security 1.0.0 · protocol 2025-06-18 · 30 tools

Tools observed via MCP handshake

find_tool — Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w
prompt_injection_scan — Scan user input or prompts for prompt injection patterns. Pattern-based: it recognises known phrasings and structures, not intent — an uncovered paraphrase or l
guardrail_test — Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg
redact_pii — Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an
secret_scan — Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), Slack / Teams
validate_agent_trajectory — Run declarative assertions on an agent trace (OpenAI tool calls, Anthropic tool_use, LangChain run trees, ReAct logs). Deterministic, no LLM. Assertions: order
validate_mcp_response — Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO
mcp_server_health_check — Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw
mcp_server_evaluate — Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses
toxicity_scan — Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term
function_call_validate — Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m
mcp_schema_lint — Lint one MCP tool definition with the same rules as mcp_server_health_check: errors break the MCP spec (FAIL), documentation_issues are what its strict mode ref
bias_detect — Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score
shield_analyze — One-call safety gate for an LLM response: grounding (with source), prompt injection on the response AND the prompt (checks.injection / checks.injection_prompt),
security_headers_check — Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu
ssl_certificate_check — Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e
cors_test — Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle
cors_checker — Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p
cookie_security_audit — Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path
web_security_audit — Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate
rate_tool — Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high
decode_jwt — Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry
validate_url — Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.
http_status_lookup — Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code
parse_http_headers — Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit
detect_secrets — Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, Slack/Teams/Discord webhook URLs, ses
latency_benchmark — Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin
hash_text — Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p
generate_password — Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese
generate_hmac — Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat

Declared by sources

What the publisher says

Attributed to the source that supplied each field. Treated as claims, not facts.

No long description beyond the summary.

kind Official MCP Registry

name Official MCP Registry

repoUrl Official MCP Registry

summary Official MCP Registry

version Official MCP Registry

description Official MCP Registry

publisherName Official MCP Registry

Provenance

Where this record came from

Every source is kept verbatim. Field changes are logged as events.

Official MCP Registryio.github.JcJamet/ia-qa-security

first seen 3 d ago · fetched 3 d agoopen ↗

Field history (6 recent events)

3 d ago · declared · summary → "Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free."
3 d ago · declared · description → "Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free."
3 d ago · declared · publisherName → "JcJamet"
3 d ago · declared · repoUrl → "https://github.com/ia-qa-com/mcp"
3 d ago · declared · version → "1.0.1"
3 d ago · declared · protocols → ["mcp"]

This record is unclaimed

Evidence

What the publisher says

Capabilities

Where this record came from