Skip to content
anlyon.devby Anlyon

QuassLabs API

com.quasslabs/apiquasslabs.comstreamable-httpv0.1.0Scanned

30+ deterministic dev and delivery tools: linting, metrics, diagrams, model advice, AI-text checks.

29 tools: 25 change things and 4 only read.

Tools: 0 delete, 0 irreversible, 25 write, 4 read.
  • Reads private data · 1
  • Reads text others write · 0
  • Can send data out · 1
  • 1 finding

Anlyon alternative

25 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

29 tools

Changes things 25Claude Code: ask
  • acceptance_criteria_validatorQA advisor: validate acceptance criteria quality.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    QA advisor: validate acceptance criteria quality. POST a list of AC (or a story) and get per-AC problems (vague/untestable, non-atomic, no observable outcome) + a missing-coverage flag if there is no failure-path AC, plus a 0-100 score and pass/needs_work verdict. Tells you exactly what to fix. Deterministic, no LLM.
  • alignment_gateRun an AI system prompt (and optional agent config) through a 45-criterion alignment/safety rubric.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run an AI system prompt (and optional agent config) through a 45-criterion alignment/safety rubric. Returns a letter grade (A-F), numeric score, per-flag remediation, and a pass/fail verdict.
  • commit_hygieneDeterministic commit-message hygiene checker: conventional-commit format, vague-subject detection, subject-length limit, a same-message secret-pattern scan (AWS keys, private key h…1 finding

    Why it is in this group

    • The name "commit_hygiene" says "commit": a word for a change.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...tokens, inline password=/secret= style credentials - checked against the message text only..."

      What this check looks for
    Description, as the server wrote it
    Deterministic commit-message hygiene checker: conventional-commit format, vague-subject detection, subject-length limit, a same-message secret-pattern scan (AWS keys, private key headers, Slack/GitHub tokens, inline password=/secret= style credentials - checked against the message text only, never a diff), and an oversized-commit warning from caller-supplied insertions/deletions. POST one commit or a batch (max 200). Deterministic, no LLM, no network.
  • convert_diagramMake Mermaid diagrams portable.No findings

    Why it is in this group

    • The name "convert_diagram" says "convert": a word for a change.
    Description, as the server wrote it
    Make Mermaid diagrams portable. Takes HTML containing <div class="mermaid"> blocks (or a raw Mermaid source) and returns the same document with every diagram pre-rendered to inline SVG and the Mermaid CDN runtime stripped. A CDN-backed diagram only renders if the reader can fetch and run the runtime; inline SVG needs neither, so the output survives offline readers, email clients, Notion/Confluence (which strip <script>), and PDF export. Rendering happens on our infrastructure; diagram content is not sent to any third party.
  • coverage_checkScope-completeness advisor.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Scope-completeness advisor. POST a brief (or requirements[]) + your stories[] and get a coverage score + the gaps (requirements no story covers), orphan stories (possible scope creep), and missing structural buckets (auth/CRUD/error-states/tests). Tells you what the scope is missing. Deterministic, no LLM.
  • defect_triageBug-triage advisor.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Bug-triage advisor. POST one bug report (or a list) and get severity (critical/high/medium/low), category, whether it has repro steps, and what info is missing (no repro / no expected-vs-actual / no environment). For a list: priority ranking + likely-duplicate clusters. Deterministic, no LLM.
  • dependency_checkDependency-manifest hygiene check.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Dependency-manifest hygiene check. POST package manifests (package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, composer.json, pubspec.yaml, lockfiles) or an upload_id and get findings with severity + concrete fixes: wildcard/unbounded versions, missing lockfiles, unpinned installs, non-https indexes, install-script risks, dependency-confusion signals, and matches against a static snapshot of famously compromised packages. NOT a live CVE feed - pair with npm audit / pip-audit / osv-scanner for that. Deterministic, no network, no LLM.
  • diagram_contrastDiagram quality QA.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Diagram quality QA. Catch and fix the things that ruin diagrams: (1) unreadable label contrast - POST a mermaid/SVG or HTML diagram, get every WCAG-AA failure (incl. mermaid <style>-block label colors, with unresolvable fills flagged honestly, not false-passed) + auto-corrected colors; (2) harden a mermaid SOURCE before it renders - rewrites every fill/label pair and remaps fills no label color can rescue, which scanning cannot do because a per-node style line overrides the theme block; (3) HTML-looks-fine-but-prints-broken - checks for the print-color-adjust/page-break gotchas and returns the fix CSS; (4) arrows crossing objects - returns the ELK-renderer config + layout rules that minimize crossings. Pure deterministic - no AI, no rate limit.
  • estimate_sanityDeterministic classifier for story/task hour estimates against benchmarks: flags each estimate in_range, borderline, over, under, or unbenchmarked.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Deterministic classifier for story/task hour estimates against benchmarks: flags each estimate in_range, borderline, over, under, or unbenchmarked. Supply either an explicit {min, max} range per type (benchmarks) or a list of historical actual hours per type (historical) that this endpoint derives a mean/stdev variance band from - explicit ranges win when both are given for the same type. No benchmark numbers are built in; a type with neither input is reported unbenchmarked, never guessed at. POST one estimate or a batch (max 200). Deterministic, no LLM.
  • feedbackSubmit free-text feedback about the API - a bug, a feature request, a docs gap, a billing question, or anything else.Can send data outNo findings

    Why it is in this group

    • The description's first verb is "submit": a word for a change.

    What it can reach

    • outboundThe input takes a URL (input.endpoint): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Submit free-text feedback about the API - a bug, a feature request, a docs gap, a billing question, or anything else. Tied to your key so we can follow up, but not billed and not a support-ticket SLA. Auth required; not billed.
  • humanizeRewrite text to remove AI-writing tells.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Rewrite text to remove AI-writing tells. POST prose and get it back with the mechanical tells fixed (AI vocabulary swapped for plain words, filler phrases stripped, em-dash overuse reduced, significance inflation deflated) plus a change log, before/after ai-ness scores, and a residual list of tells that need human judgment (not auto-rewritten). Code fences, inline code, URLs, and quotes are never touched. Deterministic, no LLM. Sister to humanizer_score (the detector).
  • humanizer_scoreDetect AI-writing tells in text.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Detect AI-writing tells in text. POST prose and get a 0-1 ai_ness score + band (low/medium/high) + the EXACT patterns that fired (AI vocabulary, significance inflation, promotional language, filler phrases, negative parallelism, rule-of-three, em-dash overuse) with sample spans. Explainable, not an opaque classifier - every point is a named, located pattern. Deterministic, no LLM. The rewrite is a separate step.
  • log_audit_creatorGenerate a concrete audit-logging spec for an app.No findings

    Why it is in this group

    • The name "log_audit_creator" says "log": a word for reading.
    • The description's first verb is "generate": a word for a change.
    Description, as the server wrote it
    Generate a concrete audit-logging spec for an app. POST your feature list (and optional compliance targets: soc2/hipaa/gdpr/pci) and get a full audit-event catalog (namespaced event names, actor/target/required fields, PII flags, retention), a canonical event envelope schema, a storage plan (append-only, access control, alerting), and per-framework compliance notes. A dev team can implement it directly. Deterministic, no LLM. Retention/compliance figures are common-practice defaults to verify with counsel.
  • model_advisorLLM selection + cost advisor.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    LLM selection + cost advisor. POST a task description (+ optional volume/tokens/constraints like local-only or cheap) and get a recommended model + fallback chain + do-not-use (with reasons), the complexity tier, and per-run + monthly cost. A maintained model+price catalog. Deterministic, no LLM. Tells the AI/user which model to use and what it costs.
  • pr_description_lintDeterministic PR description quality linter: flags a missing/too-short body, absent test evidence, absent stated rationale, an unstructured long body, and - only for PRs that look …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Deterministic PR description quality linter: flags a missing/too-short body, absent test evidence, absent stated rationale, an unstructured long body, and - only for PRs that look like bugfixes (title prefix fix/bug/hotfix/patch, or an explicit is_bugfix flag) - missing repro steps. Optionally requires a linked issue/ticket reference. Single PR only, no batch. Deterministic, no LLM.
  • rate_callRate a specific prior metered call - thumbs up or down, plus an optional comment - keyed by the request_id that call's response reported.No findings

    Why it is in this group

    • The name "rate_call" says "call": a word for a change.
    Description, as the server wrote it
    Rate a specific prior metered call - thumbs up or down, plus an optional comment - keyed by the request_id that call's response reported. Scoped for now to rating compress calls, so you can tell us when a compression was too aggressive or dropped something it shouldn't have. Resubmitting the same request_id overwrites your previous rating rather than adding a second one. Auth required; not billed - rating a call you already paid for should not cost more.
  • readability_gradeDeterministic Flesch Reading Ease and Flesch-Kincaid Grade Level for a block of text, plus word/sentence/syllable counts and a plain-language reading-ease band (very_easy through v…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Deterministic Flesch Reading Ease and Flesch-Kincaid Grade Level for a block of text, plus word/sentence/syllable counts and a plain-language reading-ease band (very_easy through very_confusing). Syllable counting is the standard vowel-group heuristic (same approximation used by textstat and most open readability tools), not a dictionary lookup. Optionally pass target_grade to get an on_target flag (within +/-2.0 grade levels). Different metric family from humanizer_score - this is pure readability statistics, not AI-writing-tell detection. Deterministic, no LLM.
  • regex_lintStatic safety analysis of a regular expression plus an English explanation of what it matches.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Static safety analysis of a regular expression plus an English explanation of what it matches. Parses the pattern into an AST and flags the structures that cause catastrophic backtracking (ReDoS): nested unbounded quantifiers like (a+)+, repeated alternations whose branches can start with the same character like (a|ab)*, adjacent unbounded quantifiers over overlapping character sets like \d+\d+, and implausibly large bounded repeats. The pattern is COMPILED but never EXECUTED against input - running a caller-supplied regex is itself the denial-of-service vector. Detection is a structural heuristic, so a risk of "none" means no known dangerous shape was found, not a proof of safety. Deterministic, no LLM.
  • saas_metricsSaaS health advisor.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    SaaS health advisor. POST your MRR/customers (+ optional churn/CAC/margin/growth) and get ARR/ARPA/LTV/CAC/payback/Rule-of-40/NRR/GRR computed, each with a health tag, plus an overall grade + a ranked "what to fix first" focus list. Deterministic math + advisory, no LLM.
  • sprint_healthSprint/delivery health advisor.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Sprint/delivery health advisor. POST 1-24 sprints (committed/completed points, optional per-ticket estimate-vs-actual data) and get computed metrics each with a good/warn/bad health tag: velocity avg + trend + stability, commitment reliability, spillover rate, mid-sprint scope change, estimate accuracy (median + chronic-overrun pct), and WIP concentration per assignee. Plus an overall grade and a ranked what-to-fix-first focus list. Pure math + advisory, no LLM.
  • story_lintDeterministic structural quality linter for user stories - a sibling to ticket_lint but scoped to story-writing concepts any team recognizes: narrative completeness (As-a/I-want-to…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Deterministic structural quality linter for user stories - a sibling to ticket_lint but scoped to story-writing concepts any team recognizes: narrative completeness (As-a/I-want-to/So-that/Summary), acceptance criteria presence, duplicate/unknown dependency IDs, a "Manage X" story with no CRUD split, list stories missing a pagination mention. An OPTIONAL rate_config unlocks team-specific checks (screen-vs-narrative match, hour-rate-per-screen tolerance, required risk level by story type, milestone-code format, required companion story types per milestone) - omit it and only the universal checks run. No house rates or milestone conventions are hardcoded. POST one story or a batch (max 50). Deterministic, no LLM.
  • ticket_lintFull Jira-ticket quality linter (whole ticket, not just AC - use acceptance_criteria_validator for the deep AC pass).No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Full Jira-ticket quality linter (whole ticket, not just AC - use acceptance_criteria_validator for the deep AC pass). POST one ticket or a batch (max 50) and get per-ticket findings with severity + concrete fixes: missing/weak summary or description, missing AC or estimate, bugs without repro/expected-vs-actual/environment, missing epic link, points-vs-hours mismatch, oversized estimates to split, urgent-but-thin tickets. Returns score, grade, and a ready/needs_work verdict per ticket plus batch summary. Type-aware rules (story/bug/task/epic/subtask), strict profile available. Deterministic, no LLM.
  • tool_advisorWhich QL-API endpoint fits this task.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Which QL-API endpoint fits this task. POST a task description and get the ranked endpoint(s) that best match, each with a confidence label (high/medium/low). Deterministic keyword matching over this platform's own endpoint catalog, no LLM. Pairs with model_advisor (which itself is one of the recommendable endpoints, so a "which model" task surfaces it) - call them independently and chain the results yourself; optionally pass a prior model_advisor result's rationale in as `context` to bias matching.
  • uploadsGet a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id.No findings

    Why it is in this group

    • The name "uploads" says "upload": a word for a change.
    Description, as the server wrote it
    Get a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id. Two-step: call this, PUT your file to the returned url, then pass upload_id to the consuming endpoint. Uploads auto-expire in 1 day and are readable only by your key. Auth required; not billed.
  • worklog_guardrailWorklog/timesheet policy checker - run a batch of worklog entries through configurable guardrails BEFORE posting them to a time-tracking system.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Worklog/timesheet policy checker - run a batch of worklog entries through configurable guardrails BEFORE posting them to a time-tracking system. Checks: rounding increment (default 0.25h, float-safe), per-entry min/max, per-author daily totals, duplicates, over-estimate alerts (never suggests inflating hours or estimates - flags to PM instead), future dates, weekends, immutable-author edit protection, missing description/ticket. Returns pass/warnings/blocked verdict + per-entry violations with fixes + hour totals by author and date. Caller supplies the reference date - fully deterministic, no LLM.
Only reads 4Show 4 read-only tools
  • blm_land_lookupLook up Bureau of Land Management land status for a US coordinate: BLM ownership, jurisdiction, allowed activities (rockhounding, camping), permit requirements, and special designa…No findings

    Why it is in this group

    • The name "blm_land_lookup" says "lookup": a word for reading.
    Description, as the server wrote it
    Look up Bureau of Land Management land status for a US coordinate: BLM ownership, jurisdiction, allowed activities (rockhounding, camping), permit requirements, and special designations (ACEC, Wilderness, WSA, NM/NCA).
  • buy_creditsGet a Stripe Checkout link to top up the credits on the API key you are calling with.No findings

    Why it is in this group

    • The description's first verb is "get": a word for reading.
    Description, as the server wrote it
    Get a Stripe Checkout link to top up the credits on the API key you are calling with. Starter pack: $5 for 500 credits. Pro pack: $20 for 2500 credits. 1 credit = $0.01. Give the returned checkout_url to a human to complete payment in a browser; the credits are added to this key automatically once the payment succeeds, usually within seconds. Calling this tool does not charge anything and costs no credits.
  • describe_diagramTurn a plain-English description into Mermaid diagram source.No findings

    Why it is in this group

    • The name "describe_diagram" says "describe": a word for reading.
    Description, as the server wrote it
    Turn a plain-English description into Mermaid diagram source. Describe the flow, system, schema or timeline you want ("a login flow with an OAuth branch and a failure path") and get back complete, valid Mermaid - no need to know the syntax. The mermaid field of the response is directly usable as the mermaid_source input of convert_diagram, so describe -> render is a two-call pipeline. Generation runs on our infrastructure via AWS Bedrock; your description is not sent to any third-party service beyond that.
  • log_analyzerAnalyze a log file.Reads private dataNo findings

    Why it is in this group

    • The name "log_analyzer" says "log": a word for reading.

    What it can reach

    • private-dataThe description's first sentence says "analyze" and "file": it reads files.
    Description, as the server wrote it
    Analyze a log file. POST raw log text (or an upload_id from the uploads tool, up to 5MB) and get: level breakdown + time range, error clusters (messages normalized so variable ids/numbers collapse into one signature, with counts + first/last seen + a sample), a timeline, detected anomalies (error spikes, retry storms, new error signatures, log gaps/outages, level-ratio shifts) with evidence, and templated recommendations. Handles JSON-lines and plain formats (ISO8601/syslog/CLF/epoch timestamps). Deterministic, single-pass, no LLM.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged untrusted-input.

Reads private data1
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write0
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out1
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 info

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 0.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http api https://api.quasslabs.com/mcp
claude mcp add --transport http api https://api.quasslabs.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__api__blm_land_lookup",
      "mcp__api__log_analyzer",
      "mcp__api__buy_credits",
      "mcp__api__describe_diagram"
    ],
    "ask": [
      "mcp__api__alignment_gate",
      "mcp__api__diagram_contrast",
      "mcp__api__humanizer_score",
      "mcp__api__saas_metrics",
      "mcp__api__acceptance_criteria_validator",
      "mcp__api__coverage_check",
      "mcp__api__defect_triage",
      "mcp__api__model_advisor",
      "mcp__api__tool_advisor",
      "mcp__api__humanize",
      "mcp__api__dependency_check",
      "mcp__api__log_audit_creator",
      "mcp__api__ticket_lint",
      "mcp__api__story_lint",
      "mcp__api__estimate_sanity",
      "mcp__api__pr_description_lint",
      "mcp__api__commit_hygiene",
      "mcp__api__readability_grade",
      "mcp__api__regex_lint",
      "mcp__api__sprint_health",
      "mcp__api__worklog_guardrail",
      "mcp__api__uploads",
      "mcp__api__feedback",
      "mcp__api__rate_call",
      "mcp__api__convert_diagram"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as api. Review it before you use it.

Capability tags behind 2 rules
  • mcp__api__log_analyzer private-data
  • mcp__api__feedback outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/com.quasslabs/api/verify?hash=ca8da85f4d7db7b59a86d9778fc1b745e502c69d77a494466cbd03460078c53c" | jq -e '.changed == false'

Pinned hash ca8da85f4d7d, from Oct 29, 2026, 04:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/com.quasslabs/api/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for com.quasslabs/api
[![anlyon.dev](https://anlyon.dev/badge/com.quasslabs/api.svg)](https://anlyon.dev/servers/com.quasslabs/api)

Source: MCP Registry. Synced Oct 29, 2026, 04:17 UTC.