{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_tgdfct9yb9dv","handle":"ia-qa-security-30-tools","url":"https://wellknown.network/agents/ia-qa-security-30-tools","links":{"self":"https://wellknown.network/agents/ia-qa-security-30-tools/record.json","html":"https://wellknown.network/agents/ia-qa-security-30-tools","markdown":"https://wellknown.network/agents/ia-qa-security-30-tools/record.md","api":"https://wellknown.network/api/v1/agents/ia-qa-security-30-tools","status":"https://wellknown.network/api/v1/agents/ia-qa-security-30-tools/status","claim":"https://wellknown.network/agents/ia-qa-security-30-tools/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/ia-qa-security-30-tools/claim.json","badge":"https://wellknown.network/agents/ia-qa-security-30-tools/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/ia-qa-security-30-tools/history","tools":"https://wellknown.network/api/v1/agents/ia-qa-security-30-tools/tools"},"ard":{"identifier":"urn:air:www.ia-qa.com:server:ia-qa-security-30-tools","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"IA-QA Security — 30 tools","summary":"Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.","description":"Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.","publisher":{"name":"JcJamet","url":null},"homepage":null,"repository":"https://github.com/ia-qa-com/mcp","version":"1.0.1","license":null,"protocols":["mcp"],"tags":[],"pricing":null,"endpoints":[{"url":"https://www.ia-qa.com/mcp/security","type":"mcp_streamable_http","auth":null,"probeable":true}],"skills":null,"tools":null,"extra":{"updatedAt":"2026-10-26T21:30:38.781898Z","publishedAt":"2026-10-26T21:30:38.781898Z","registryName":"io.github.JcJamet/ia-qa-security"},"attribution":{"kind":"mcp_registry","name":"mcp_registry","repoUrl":"mcp_registry","summary":"mcp_registry","version":"mcp_registry","description":"mcp_registry","publisherName":"mcp_registry"}},"derived":{"capabilities":[{"slug":"code.testing","name":"Testing","confidence":1,"provenance":"derived"},{"slug":"dev.version-control","name":"Version Control","confidence":1,"provenance":"derived"},{"slug":"communication.chat","name":"Team Chat","confidence":1,"provenance":"derived"},{"slug":"infra.cloud","name":"Cloud Platforms","confidence":1,"provenance":"derived"},{"slug":"security.scanning","name":"Security Scanning","confidence":1,"provenance":"derived"},{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"derived"},{"slug":"security.secrets","name":"Secrets Management","confidence":1,"provenance":"derived"},{"slug":"ai.model-access","name":"Model Access","confidence":1,"provenance":"derived"}],"categories":["ai","code","communication","dev","infra","security"],"language":"en"},"observed":{"status":"live","statusReason":"Responded 8h ago.","lastOkAt":"2026-11-01T01:31:41.969Z","lastProbedAt":"2026-11-01T01:31:41.969Z","statusComputedAt":"2026-11-01T01:34:34.558Z","reliability30d":{"probes":9,"successRate":1,"p50Ms":47,"basis":"service","measures":{"availability":"availability","latency":"response time","tools":"tool surface observed","summary":"Checks reached the service itself."},"checks":{"total":9,"ok":9,"authBoundaryOk":0,"serviceOk":9,"note":"Counted from the observation rows for the window, checks of the server only (HTTP, A2A card, MCP initialize). ok = authBoundaryOk + serviceOk. `probes` is the sum of daily rollups and includes registry checks, so it can differ from `total`."}},"latestObservations":[{"at":"2026-11-01T01:31:41.969Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":19,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for prompt injection patterns. Pattern-based: it recognises known phrasings and structures, not intent — an uncovered paraphrase or l"},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), Slack / Teams"},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool calls, Anthropic tool_use, LangChain run trees, ReAct logs). Deterministic, no LLM. Assertions: order "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint one MCP tool definition with the same rules as mcp_server_health_check: errors break the MCP spec (FAIL), documentation_issues are what its strict mode ref"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"One-call safety gate for an LLM response: grounding (with source), prompt injection on the response AND the prompt (checks.injection / checks.injection_prompt),"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, Slack/Teams/Discord webhook URLs, ses"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"8dca2eb1e382a84556a04feac86139d72eeccbc2e6ee008223bffb1ece66b2c8","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-31T17:31:53.697Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":18,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for prompt injection patterns. Pattern-based: it recognises known phrasings and structures, not intent — an uncovered paraphrase or l"},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), Slack / Teams"},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool calls, Anthropic tool_use, LangChain run trees, ReAct logs). Deterministic, no LLM. Assertions: order "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint one MCP tool definition with the same rules as mcp_server_health_check: errors break the MCP spec (FAIL), documentation_issues are what its strict mode ref"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"One-call safety gate for an LLM response: grounding (with source), prompt injection on the response AND the prompt (checks.injection / checks.injection_prompt),"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, Slack/Teams/Discord webhook URLs, ses"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"8dca2eb1e382a84556a04feac86139d72eeccbc2e6ee008223bffb1ece66b2c8","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-31T09:31:38.782Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":58,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for common prompt injection patterns. Pattern-based: it recognises known phrasings and structural markers, not intent — a paraphrase "},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys "},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. R"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel:"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and gene"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"48d0a93987ab2c04f667105fd1496719d0f8bf7e92df134899301226e52af5d7","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-31T02:25:03.877Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":52,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for common prompt injection patterns. Pattern-based: it recognises known phrasings and structural markers, not intent — a paraphrase "},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys "},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. R"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel:"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and gene"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"48d0a93987ab2c04f667105fd1496719d0f8bf7e92df134899301226e52af5d7","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-30T18:29:13.695Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":81,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for common prompt injection patterns. Pattern-based: it recognises known phrasings and structural markers, not intent — a paraphrase "},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys "},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. R"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel:"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and gene"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"48d0a93987ab2c04f667105fd1496719d0f8bf7e92df134899301226e52af5d7","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-30T11:22:16.310Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":18,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for common prompt injection patterns. Pattern-based: it recognises known phrasings and structural markers, not intent — a paraphrase "},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys "},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. R"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel:"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and gene"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"48d0a93987ab2c04f667105fd1496719d0f8bf7e92df134899301226e52af5d7","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-30T03:22:57.057Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":18,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for common prompt injection patterns. Pattern-based: it recognises known phrasings and structural markers, not intent — a paraphrase "},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys "},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. R"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel:"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and gene"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"48d0a93987ab2c04f667105fd1496719d0f8bf7e92df134899301226e52af5d7","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-29T19:31:11.314Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":177,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for common prompt injection patterns. Pattern-based: it recognises known phrasings and structural markers, not intent — a paraphrase "},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys "},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. R"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel:"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and gene"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"48d0a93987ab2c04f667105fd1496719d0f8bf7e92df134899301226e52af5d7","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}},{"at":"2026-10-29T11:25:19.817Z","kind":"mcp_initialize","ok":true,"httpStatus":200,"latencyMs":19,"error":null,"detail":{"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for common prompt injection patterns. Pattern-based: it recognises known phrasings and structural markers, not intent — a paraphrase "},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys "},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. R"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel:"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and gene"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"toolCount":30,"toolsHash":"48d0a93987ab2c04f667105fd1496719d0f8bf7e92df134899301226e52af5d7","serverName":"ia-qa-toolbox-security","capabilities":["tools"],"serverVersion":"1.0.0","protocolVersion":"2025-06-18"}}],"tools":[{"name":"find_tool","description":"Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this w"},{"name":"prompt_injection_scan","description":"Scan user input or prompts for prompt injection patterns. Pattern-based: it recognises known phrasings and structures, not intent — an uncovered paraphrase or l"},{"name":"guardrail_test","description":"Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg"},{"name":"redact_pii","description":"Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an"},{"name":"secret_scan","description":"Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), Slack / Teams"},{"name":"validate_agent_trajectory","description":"Run declarative assertions on an agent trace (OpenAI tool calls, Anthropic tool_use, LangChain run trees, ReAct logs). Deterministic, no LLM. Assertions: order "},{"name":"validate_mcp_response","description":"Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO"},{"name":"mcp_server_health_check","description":"Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw "},{"name":"mcp_server_evaluate","description":"Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Ses"},{"name":"toxicity_scan","description":"Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term"},{"name":"function_call_validate","description":"Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m"},{"name":"mcp_schema_lint","description":"Lint one MCP tool definition with the same rules as mcp_server_health_check: errors break the MCP spec (FAIL), documentation_issues are what its strict mode ref"},{"name":"bias_detect","description":"Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score"},{"name":"shield_analyze","description":"One-call safety gate for an LLM response: grounding (with source), prompt injection on the response AND the prompt (checks.injection / checks.injection_prompt),"},{"name":"security_headers_check","description":"Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu"},{"name":"ssl_certificate_check","description":"Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e"},{"name":"cors_test","description":"Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin refle"},{"name":"cors_checker","description":"Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the p"},{"name":"cookie_security_audit","description":"Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path"},{"name":"web_security_audit","description":"Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate"},{"name":"rate_tool","description":"Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high"},{"name":"decode_jwt","description":"Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry "},{"name":"validate_url","description":"Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin."},{"name":"http_status_lookup","description":"Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code "},{"name":"parse_http_headers","description":"Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit"},{"name":"detect_secrets","description":"Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, Slack/Teams/Discord webhook URLs, ses"},{"name":"latency_benchmark","description":"Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin"},{"name":"hash_text","description":"Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p"},{"name":"generate_password","description":"Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese"},{"name":"generate_hmac","description":"Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat"}],"package":null,"toolSurface":{"id":"ts_ybx6rz99z2ha","endpointId":"ep_9xk7csq6fuen","hash":"8dca2eb1e382a84556a04feac86139d72eeccbc2e6ee008223bffb1ece66b2c8","toolCount":30,"serverName":"ia-qa-toolbox-security","serverVersion":"1.0.0","protocolVersion":"2025-06-18","firstSeenAt":"2026-10-31T17:31:53.705Z","lastSeenAt":"2026-11-01T01:31:41.980Z","observations":2,"toolNames":["find_tool","prompt_injection_scan","guardrail_test","redact_pii","secret_scan","validate_agent_trajectory","validate_mcp_response","mcp_server_health_check","mcp_server_evaluate","toxicity_scan","function_call_validate","mcp_schema_lint","bias_detect","shield_analyze","security_headers_check","ssl_certificate_check","cors_test","cors_checker","cookie_security_audit","web_security_audit","rate_tool","decode_jwt","validate_url","http_status_lookup","parse_http_headers","detect_secrets","latency_benchmark","hash_text","generate_password","generate_hmac"],"distinctSurfaces":2},"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"mcp_registry","key":"io.github.JcJamet/ia-qa-security","url":"https://registry.modelcontextprotocol.io/v0/servers/io.github.JcJamet%2Fia-qa-security","firstSeenAt":"2026-10-29T10:20:53.900Z","fetchedAt":"2026-10-29T10:20:53.900Z","normalizedAt":"2026-10-29T10:20:53.900Z"}]},"firstSeenAt":"2026-10-29T10:20:53.900Z","updatedAt":"2026-11-01T01:35:37.540Z"}