Skip to content
anlyon.devby Anlyon

IA-QA Security — 30 tools

io.github.JcJamet/ia-qa-securityJcJametstreamable-httpv1.0.1Scanned

Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.

30 tools: 23 change things and 7 only read.

Tools: 0 delete, 0 irreversible, 23 write, 7 read.

Anlyon alternative

23 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →
Compare with similar serversMarkdownJSONReport this listing

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

30 tools

Changes things 23Claude Code: ask
  • cors_checkerCheck the CORS configuration of a URL the same way a browser would.Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the preflight OPTIONS response. Use this for direct CORS debugging, not just security auditing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • cors_testTest a URL for CORS misconfigurations.Reads text others writeCan send data out1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...eaders to detect: wildcard origins with credentials, origin reflection (echoing any origin)..."

      What this check looks for
    Description, as the server wrote it
    Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin reflection (echoing any origin), null origin acceptance, subdomain wildcard bypass, and missing Vary headers. Returns risk level (safe/low/medium/high/critical) plus per-origin results. "unknown" means nothing was actually tested — every origin either failed to connect or answered 5xx, so the target returned no CORS decision; never read it as "safe". A 4xx preflight IS a real result (the server refused it and a browser would fail closed).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • decode_jwtDecode a JWT (JSON Web Token) and return its header and payload without verifying the signature.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry date. Use to inspect claims (sub, iss, exp, roles) during debugging or when integrating with an auth provider.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • detect_secretsScan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and generic passwords.1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • High

      The input schema at properties.filename.description refers to ".env".

      Matched text

      inputSchema.properties.filename.description: "Optional filename for context (e.g. ".env", "config.js")"

      What this check looks for
    Description, as the server wrote it
    Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and generic passwords. Returns findings with severity. Run before every commit.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • function_call_validateValidate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args.1 finding

    Why it is in this group

    • The name "function_call_validate" says "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "function_call_validate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "function_call_validate" says "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args. For OpenAI function calling & MCP tool_use testing.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_hmacCompute an HMAC signature for a message using a secret key.1 finding

    Why it is in this group

    • The name "generate_hmac" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_hmac" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_hmac" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verification (GitHub, Stripe, Twilio), and JWT validation.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • generate_passwordGenerate a cryptographically secure random password using crypto.randomBytes.1 finding

    Why it is in this group

    • The name "generate_password" says "generate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "generate_password" says "generate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when resetting user passwords, seeding test accounts, or generating API secrets.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • guardrail_testTest an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex. Returns pass/fail per rule.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • hash_textCompute a cryptographic hash of a text string.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or produce a fixed-length digest of any input. Supports SHA-256 (default), SHA-512, SHA-1, and MD5.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • latency_benchmarkMeasure response time of one or more HTTP endpoints (GET/POST).Reads text others writeCan send data outNo findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.endpoints): a request to a URL can carry data to whoever runs it.
    Description, as the server wrote it
    Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarking.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • mcp_schema_lintLint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. Returns actionable warnings.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • mcp_server_evaluateRun a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it.Reads text others writeCan send data out2 findings

    Why it is in this group

    • The name "mcp_server_evaluate" says "evaluate": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Info

      The description mentions "credentials".

      Matched text

      description: "...server requires authorization, since no credentials are sent. A 301/302 on POST caps the ve..."

      What this check looks for
    • Warn

      The server marks "mcp_server_evaluate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "mcp_server_evaluate" says "evaluate": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Session-Id carried afterwards), notifications/initialized (202), tools/list with pagination, the spec's tool-definition rules, ping, an unknown method (-32601), one tools/call, GET on the endpoint (SSE or 405), and P50/P95 latency over pings. JSON and SSE answers are both read. Only a tool you name in test_tool_name, or one the server annotates readOnlyHint: true, is called — otherwise the call is skipped and not scored. Returns PASS/FIX/BLOCK with a 0-100 score and per-check details; INCONCLUSIVE (score null) when the server requires authorization, since no credentials are sent. A 301/302 on POST caps the verdict at FIX. The call runs from ia-qa.com: private and local addresses are refused, and stdio servers cannot be reached — for those, paste their tools/list answer into mcp_server_health_check. structuredContent is checked for presence, not validated against outputSchema.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • mcp_server_health_checkCheck an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw JSON-RPC or its result), a bare array of tools, one tool definition, or a manifest carrying name/description; input_shape says which one was read. Validates every tool against the MCP spec (name 1-128 chars of A-Z a-z 0-9 _ - .; camelCase and a tool with no parameters are valid; inputSchema of type object; required fields listed in properties) and, with strict, documentation (description ≥ 20 chars, every parameter with a description and a type). verdict: FAIL when a tool breaks a rule or no tool is found, WARN when only a manifest's server name/description is missing, PASS otherwise. A tools/list carries no server name, so those two checks are not scored on it (the name comes from initialize). Gate on verdict or on checks[tool_quality].pass.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • parse_http_headersParse a raw HTTP headers block into a structured JSON object.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing security headers (HSTS, CSP, X-Frame-Options, etc.).

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • prompt_injection_scanScan user input or prompts for common prompt injection patterns.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scan user input or prompts for common prompt injection patterns. Detects system prompt overrides, jailbreak attempts, role manipulation, encoding tricks, delimiter attacks (chat-template tags `<|im_start|>`/`[INST]`/`<<SYS>>` AND fake role headers imitating markdown or chat separators: "### System:", "--- SYSTEM ---", "---BEGIN SYSTEM OVERRIDE---", "--- SYSTEM:"), template/interpolation injection ({{...}}, ${...}), and context-exfiltration attempts ("repeat everything above"). A match inside quoted or fenced text (documentation citing a payload) is reported one severity level lower and marked `quoted` — never suppressed, since an LLM reading the document as data can still follow a quoted instruction. A quote preceded by a live imperative ("output the following: ...") keeps its full severity.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rate_toolGive honest usage feedback on an IA-QA MCP tool.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high (4-5) only if it genuinely solved your need. Ratings are aggregated on a public dashboard at /devtools/mcp-ratings. Skip rating routine successes — we want signal, not praise. Example: rate_tool({ tool_name: "format_json", score: 2, comment: "Tried to pretty-print a JSON5 file, it rejected trailing commas — not usable for my case." })

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: false
  • redact_piiAutomatically detect and redact Personally Identifiable Information (PII) from text.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, credit cards, IP addresses, and JWT tokens with [REDACTED_TYPE] placeholders. Safe to use before logging or sending to an LLM.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • secret_scanScan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, …No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line number, and a redacted preview. Use before committing code, sharing logs, or sending text to an LLM. 100% regex-based, zero network calls.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • shield_analyzeRun a comprehensive AI guardrail analysis on an LLM response.Reads text others write1 finding

    Why it is in this group

    • The name "shield_analyze" says "analyze": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.

    Findings

    • Warn

      The server marks "shield_analyze" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "shield_analyze" says "analyze": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel: hallucination detection (grounding score), prompt injection scan on BOTH the response and the original prompt (reported separately as checks.injection / checks.injection_prompt, scored once at the worse of the two), toxicity scan, output validation (PII/safety), guardrail rules, response quality scoring, and AI verdict (via Qwen, Gemma, Llama, etc.). Returns a unified PASS/FIX/BLOCK verdict with a 0-100 safety score, per-check results, and actionable fix recommendations. PII gates the verdict: an SSN or credit card in the response forces BLOCK, an email forces FIX, phone/IP matches are flagged only (their regexes also match dates and version strings). Use this as a single-call safety gate before surfacing any LLM output to users.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • toxicity_scanScan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term + predicate), not a semantic classifier — returns per-category risk plus the named rules that fired, so every finding can be checked. Useful for LLM safety guardrail testing and triage; signal-only, not a calibrated CI gate.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • validate_agent_trajectoryRun declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs).1 finding

    Why it is in this group

    • The name "validate_agent_trajectory" says "validate": a word for reading.
    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "validate_agent_trajectory" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "validate_agent_trajectory" says "validate": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). No LLM call — deterministic. Assertion types: order (tool A before B), must_call, must_not_call, max_calls, min_calls, no_error, recovery (agent completes a successful step after its last error). A step counts as errored when the trace says so — is_error/isError, status/state in {error,failed,exception,…}, an error field, a JSON body with error/success:false — or when its text payload STARTS with an error marker (Error:, Traceback, TypeError:). Model prose is never scanned for keywords, and every errored step reports error_signal naming what flagged it. Returns per-assertion PASS/FAIL, parsed steps, warnings (a trace parsing to 0 steps is flagged — assertions passing on emptiness prove nothing), and an overall verdict. Use this to gate CI/CD on agent behavior correctness.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • web_security_auditRun a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan.Reads text others writeCan send data out1 finding

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Findings

    • Warn

      The server marks "web_security_audit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "run": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrates security_headers_check + ssl_certificate_check + cors_test + cookie_security_audit in parallel, merges all findings, then asks an AI model to: (1) rank vulnerabilities by real-world exploitability, (2) generate a remediation roadmap, (3) produce fix code snippets for the detected stack. Returns both raw audit data and the AI analysis. Use this as a one-click security posture assessment.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
Only reads 7Show 7 read-only tools
  • bias_detectAnalyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone).No findings

    Why it is in this group

    • The description's first verb is "analyse": a word for reading.
    Description, as the server wrote it
    Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score (0-100), sentiment analysis per variant, pairwise Jaccard similarity, and a human-readable verdict. No API key needed — runs entirely locally.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • find_toolSearch available MCP tools by keyword or category before calling them.No findings

    Why it is in this group

    • The name "find_tool" says "find": a word for reading.
    Description, as the server wrote it
    Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this when you are unsure which tool to use or want to explore the catalogue. Categories: data, encoding, text, llm, qa, rag, dev, security, web.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • http_status_lookupLook up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices.Reads text others writeNo findings

    Why it is in this group

    • The name "http_status_lookup" says "status": a word for reading.

    What it can reach

    • untrusted-inputThe name "http_status_lookup" says "status" and "http": it reads web pages, which anyone can write.
    • untrusted-inputThe description's first sentence says "http": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code in the IANA HTTP Status Code Registry (1xx-5xx, including 226, 425, 451, 508, 511 and the WebDAV codes) with its defining RFC; anything outside the registry is reported as `registered: false` rather than described. `cacheable` means heuristically cacheable by default per RFC 9110 §15.1.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • security_headers_checkAnalyse the HTTP security headers of a public URL OR of raw response headers you paste in.Reads text others writeCan send data outNo findings

    Why it is in this group

    • The description's first verb is "analyse": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "analyse" and "http": it reads web pages, which anyone can write.
    • untrusted-inputThe input takes a URL (input.url), and the tool reads it: it reads web pages, which anyone can write.
    • outboundThe input takes a URL (input.url): a request to a URL can carry data to whoever runs it.

    Claude Code: ask, because it is tagged outbound.

    Description, as the server wrote it
    Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • ssl_certificate_checkAnalyse the SSL/TLS certificate of any HTTPS host.Reads text others writeNo findings

    Why it is in this group

    • The description's first verb is "analyse": a word for reading.

    What it can reach

    • untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
    • untrusted-inputThe description's first sentence says "analyse" and "http": it reads web pages, which anyone can write.
    Description, as the server wrote it
    Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key exchange info, and an overall grade (A+, A, B, C, F). Detects expired, self-signed, and weak certificates. Use this to audit TLS posture before production deployment or during security reviews.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: false
    • openWorldHint: true
  • validate_mcp_responseValidate that an MCP tool response conforms to expected format, schema, and content rules.No findings

    Why it is in this group

    • The name "validate_mcp_response" says "validate": a word for reading.
    Description, as the server wrote it
    Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSON result and a set of checks to perform.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • validate_urlParse and validate a URL.No findings

    Why it is in this group

    • The name "validate_url" says "validate": a word for reading.
    Description, as the server wrote it
    Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data.

Reads private data0
Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write10
Brings in text someone else can write: web pages, inbound email, messages, issues and comments.
Can send data out7
Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 high7 warn2 info
  • Highdetect_secrets

    The input schema at properties.filename.description refers to ".env".

    Matched text

    inputSchema.properties.filename.description: "Optional filename for context (e.g. ".env", "config.js")"

    What this check looks for
  • Warnvalidate_agent_trajectory

    The server marks "validate_agent_trajectory" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "validate_agent_trajectory" says "validate": a word for reading.

    What this check looks for
  • Warnmcp_server_evaluate

    The server marks "mcp_server_evaluate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "mcp_server_evaluate" says "evaluate": a word for a change.

    What this check looks for
  • Warnfunction_call_validate

    The server marks "function_call_validate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "function_call_validate" says "call": a word for a change.

    What this check looks for
  • Warnshield_analyze

    The server marks "shield_analyze" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The name "shield_analyze" says "analyze": a word for reading.

    What this check looks for
  • Warnweb_security_audit

    The server marks "web_security_audit" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":true}; The description's first verb is "run": a word for a change.

    What this check looks for
Show 4 more findings
  • Warngenerate_password

    The server marks "generate_password" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "generate_password" says "generate": a word for a change.

    What this check looks for
  • Warngenerate_hmac

    The server marks "generate_hmac" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "generate_hmac" says "generate": a word for a change.

    What this check looks for
  • Infomcp_server_evaluate

    The description mentions "credentials".

    Matched text

    description: "...server requires authorization, since no credentials are sent. A 301/302 on POST caps the ve..."

    What this check looks for
  • Infocors_test

    The description mentions "credentials".

    Matched text

    description: "...eaders to detect: wildcard origins with credentials, origin reflection (echoing any origin)..."

    What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http ia-qa-security https://www.ia-qa.com/mcp/security
claude mcp add --transport http ia-qa-security https://www.ia-qa.com/mcp/security

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__ia-qa-security__find_tool",
      "mcp__ia-qa-security__validate_mcp_response",
      "mcp__ia-qa-security__bias_detect",
      "mcp__ia-qa-security__ssl_certificate_check",
      "mcp__ia-qa-security__validate_url",
      "mcp__ia-qa-security__http_status_lookup"
    ],
    "ask": [
      "mcp__ia-qa-security__prompt_injection_scan",
      "mcp__ia-qa-security__guardrail_test",
      "mcp__ia-qa-security__redact_pii",
      "mcp__ia-qa-security__secret_scan",
      "mcp__ia-qa-security__validate_agent_trajectory",
      "mcp__ia-qa-security__mcp_server_health_check",
      "mcp__ia-qa-security__mcp_server_evaluate",
      "mcp__ia-qa-security__toxicity_scan",
      "mcp__ia-qa-security__function_call_validate",
      "mcp__ia-qa-security__mcp_schema_lint",
      "mcp__ia-qa-security__shield_analyze",
      "mcp__ia-qa-security__security_headers_check",
      "mcp__ia-qa-security__cors_test",
      "mcp__ia-qa-security__cors_checker",
      "mcp__ia-qa-security__cookie_security_audit",
      "mcp__ia-qa-security__web_security_audit",
      "mcp__ia-qa-security__rate_tool",
      "mcp__ia-qa-security__decode_jwt",
      "mcp__ia-qa-security__parse_http_headers",
      "mcp__ia-qa-security__detect_secrets",
      "mcp__ia-qa-security__latency_benchmark",
      "mcp__ia-qa-security__hash_text",
      "mcp__ia-qa-security__generate_password",
      "mcp__ia-qa-security__generate_hmac"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as ia-qa-security. Review it before you use it.

Capability tags behind 10 rules
  • mcp__ia-qa-security__mcp_server_evaluate untrusted-input, outbound
  • mcp__ia-qa-security__shield_analyze untrusted-input
  • mcp__ia-qa-security__security_headers_check untrusted-input, outbound
  • mcp__ia-qa-security__ssl_certificate_check untrusted-input
  • mcp__ia-qa-security__cors_test untrusted-input, outbound
  • mcp__ia-qa-security__cors_checker untrusted-input, outbound
  • mcp__ia-qa-security__cookie_security_audit untrusted-input, outbound
  • mcp__ia-qa-security__web_security_audit untrusted-input, outbound
  • mcp__ia-qa-security__http_status_lookup untrusted-input
  • mcp__ia-qa-security__latency_benchmark untrusted-input, outbound

Pin

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.JcJamet/ia-qa-security/verify?hash=858e04b36ba0b9a3c169478a0e90fb2fe3078ef7fd18bc9862d639831daec0ea" | jq -e '.changed == false'

Pinned hash 858e04b36ba0, from Oct 26, 2026, 21:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.JcJamet/ia-qa-security/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

anlyon.dev badge for io.github.JcJamet/ia-qa-security
[![anlyon.dev](https://anlyon.dev/badge/io.github.JcJamet/ia-qa-security.svg)](https://anlyon.dev/servers/io.github.JcJamet/ia-qa-security)

Source: MCP Registry · repository. Synced Oct 26, 2026, 22:17 UTC.