io.github.JcJamet/ia-qa-security

up checked 2026-11-11T01:38:45.203Z

Unclaimed · Unverified

Agent searches it appeared in, last 30 days: 0. Run this server? Claim the listing: verified label, uptime alerts and analytics.

Publisher-provided title

IA-QA Security — 30 tools

Publisher-provided description

Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.

Summary by lookupd

Runs security checks: prompt injection, PII and secret scanning, TLS, header, CORS and cookie audits, and MCP server validation.

Install

Claude Code, remote (streamable-http)

claude mcp add --transport http ia-qa-security https://www.ia-qa.com/mcp/security

Codex, remote (streamable-http)

codex mcp add ia-qa-security --url https://www.ia-qa.com/mcp/security

Cursor, remote (streamable-http) → .cursor/mcp.json

{
  "mcpServers": {
    "ia-qa-security": {
      "url": "https://www.ia-qa.com/mcp/security"
    }
  }
}

Other clients: docs. Or tell your agent: Set up lookupd for me: read https://lookupd.com/agent.md and follow it.

Tools (30 tools)

Publisher-provided text

find_tool Search available MCP tools by keyword or category before calling them. Returns names, descriptions and, on request, inputSchemas. Queries are logged 90 days, sc
prompt_injection_scan Scan user input or prompts for prompt injection patterns. Pattern-based: it recognises known phrasings and structures, not intent — an uncovered paraphrase or l
guardrail_test Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom reg
redact_pii Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, IBANs, credit cards, IP addresses, an
secret_scan Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), Slack / Teams
validate_agent_trajectory Run declarative assertions on an agent trace (OpenAI tool calls, Anthropic tool_use, LangChain run trees, ReAct logs). Deterministic, no LLM. Assertions: order
validate_mcp_response Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSO
mcp_server_health_check Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw
mcp_server_evaluate Check that a live MCP server over Streamable HTTP speaks the protocol, 2026-07-28 or earlier: handshake or server/discover, tools/list and its definitions, erro
toxicity_scan Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term
function_call_validate Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema (types, enums, ranges), no extra/m
mcp_schema_lint Lint one MCP tool definition with the same rules as mcp_server_health_check: errors break the MCP spec (FAIL), documentation_issues are what its strict mode ref
bias_detect Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score
shield_analyze One-call safety gate for an LLM response: grounding (with source), prompt injection on the response AND the prompt (checks.injection / checks.injection_prompt),
security_headers_check Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Secu
ssl_certificate_check Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key e
cors_test Audit a URL for CORS misconfigurations across several origins: wildcard with credentials, reflected origin, null origin, subdomain bypass, missing Vary. Returns
cors_checker Would a browser on this origin be allowed to read this URL? Verdict allowed | blocked | unknown, the reason, and the header to add. Only GET and HEAD are really
cookie_security_audit Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path
web_security_audit Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrate
rate_tool Give honest usage feedback on an IA-QA MCP tool. Give a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high (4
decode_jwt Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry
validate_url Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.
http_status_lookup Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code
parse_http_headers Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing securit
detect_secrets Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, Slack/Teams/Discord webhook URLs, ses
latency_benchmark Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarkin
hash_text Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or p
generate_password Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when rese
generate_hmac Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verificat

Details

Version: 1.0.1
Transports: streamable-http
Uptime (7 days): 100%
Median latency: 668 ms
First indexed: 2026-11-01T09:10:57.649Z
Last seen in registry: 2026-11-01T09:10:57.658Z
Repository: https://github.com/ia-qa-com/mcp

Badge for your README

Shows this live status and links here; updates hourly.

[![lookupd status](https://lookupd.com/badge/io.github.JcJamet/ia-qa-security.svg)](https://lookupd.com/servers/io.github.JcJamet/ia-qa-security)

62071 servers
Last crawl: 2026-11-11T16:39:06.253Z
API base: https://api.lookupd.com
MCP URL: https://api.lookupd.com/mcp