MCP server

IA-QA Security — 30 tools

io.github.JcJamet/ia-qa-security

Checked 26 Oct 2026, 08:29 UTC · Connected to it and listed its tools

Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.

Source

At a glance

Type

MCP server

Publisher

Not verified

Status

Working at last check

Tools

30

Token cost

About 8,184 tokens per request

Sets up in

Claude Code, Claude Desktop, Codex, Gemini CLI, Cursor, VS Code, Antigravity, ChatGPT, OpenAI API, Grok

Last checked

26 Oct 2026, 08:29 UTC

Connect it to your agent

Add to CursorAdd to VS CodeVS Code Insiders

Opens the app, which shows the server and asks you to confirm. For other apps, copy the setup below.

Claude Code

claude mcp add --transport http ia-qa-security https://www.ia-qa.com/mcp/security

Claude Desktop

Settings → Connectors → Add custom connector, and paste the URL.

Codex (config.toml)

[mcp_servers.ia-qa-security]
url = "https://www.ia-qa.com/mcp/security"

Gemini CLI

{"mcpServers":{"ia-qa-security":{"httpUrl":"https://www.ia-qa.com/mcp/security"}}}

Cursor

{"mcpServers":{"ia-qa-security":{"url":"https://www.ia-qa.com/mcp/security"}}}

VS Code

{"servers":{"ia-qa-security":{"type":"http","url":"https://www.ia-qa.com/mcp/security"}}}

Antigravity

agy mcp add ia-qa-security https://www.ia-qa.com/mcp/security

ChatGPT

Settings → Apps & Connectors → Advanced settings: turn on Developer mode, then Create a connector and paste the URL. Which plans can do this varies.

OpenAI API (Responses tools)

{"type":"mcp","server_label":"ia-qa-security","server_url":"https://www.ia-qa.com/mcp/security","require_approval":"always"}

Grok (xAI API tools)

{"type":"mcp","server_label":"ia-qa-security","server_url":"https://www.ia-qa.com/mcp/security"}

Tools

• bias_detect ~233 tokens
  Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score (0-100), sentiment analysis per variant, pairwise Jaccard similarity, and a human-readable verdict. No API key needed — runs entirely local
• cookie_security_audit ~228 tokens
  Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path scope, Max-Age/Expires, __Host-/__Secure- prefixes. Flags insecure patterns: missing HttpOnly on session cookies, missing Secure flag, Same
• cors_checker ~183 tokens
  Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the preflight OPTIONS response. Use this for direct CORS debugging, not just security auditing.
• cors_test ~264 tokens
  Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin reflection (echoing any origin), null origin acceptance, subdomain wildcard bypass, and missing Vary headers. Returns risk level (safe/low/medium
• detect_secrets ~153 tokens
  Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and generic passwords. Returns findings with severity. Run before every commit.
• function_call_validate ~231 tokens
  Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args. For OpenAI function calling & MCP tool_use testing.
• generate_hmac ~187 tokens
  Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verification (GitHub, Stripe, Twilio), and JWT validation.
• generate_password ~188 tokens
  Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when resetting user passwords, seeding test accounts, or generating API secrets.
• guardrail_test ~250 tokens
  Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex. Returns pass/fail per rule.
• http_status_lookup ~185 tokens
  Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code in the IANA HTTP Status Code Registry (1xx-5xx, including 226, 425, 451, 508, 511 and the WebDAV codes) with its defining RFC; anything outs
• latency_benchmark ~293 tokens
  Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarking.
• mcp_schema_lint ~130 tokens
  Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. Returns actionable warnings.
• mcp_server_evaluate ~426 tokens
  Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Session-Id carried afterwards), notifications/initialized (202), tools/list with pagination, the spec's tool-definition rules, ping, an unknown
• mcp_server_health_check ~396 tokens
  Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw JSON-RPC or its result), a bare array of tools, one tool definition, or a manifest carrying name/description; input_shape says which one was
• parse_http_headers ~149 tokens
  Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing security headers (HSTS, CSP, X-Frame-Options, etc.).
• prompt_injection_scan ~329 tokens
  Scan user input or prompts for common prompt injection patterns. Detects system prompt overrides, jailbreak attempts, role manipulation, encoding tricks, delimiter attacks (chat-template tags `<|im_start|>`/`[INST]`/`<<SYS>>` AND fake role headers imitating markdown or chat separators: "### System:"
• redact_pii ~197 tokens
  Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, credit cards, IP addresses, and JWT tokens with [REDACTED_TYPE] placeholders. Safe to use before logging or sending to an LLM.
• secret_scan ~302 tokens
  Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line
• security_headers_check ~342 tokens
  Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cro
• shield_analyze ~533 tokens
  Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel: hallucination detection (grounding score), prompt injection scan on BOTH the response and the original prompt (reported separately as check
• ssl_certificate_check ~186 tokens
  Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key exchange info, and an overall grade (A+, A, B, C, F). Detects expired, self-signed, and weak certificates. Use this to audit TLS posture befo
• toxicity_scan ~209 tokens
  Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term + predicate), not a semantic classifier — returns per-category risk plus the named rules that fired, so every finding can be checked. Usefu
• validate_agent_trajectory ~933 tokens
  Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). No LLM call — deterministic. Assertion types: order (tool A before B), must_call, must_not_call, max_calls, min_calls, no_error, recovery (a
• validate_mcp_response ~368 tokens
  Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSON result and a set of checks to perform.
• validate_url ~86 tokens
  Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.
• web_security_audit ~286 tokens
  Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrates security_headers_check + ssl_certificate_check + cors_test + cookie_security_audit in parallel, merges all findings, then asks an AI model

Browse

• GitHub tools
• Stripe tools
• Website monitoring
• Converting to Markdown
• Email
• Team chat

Related MCP servers

• ContrastAPI
  55 tools, 7 Resources, Sigma rules, email SPF/DMARC, MITRE, CVE/KEV, risk_score. No key.
• Claude Skill Validator
  Cloudflare Workers MCP server: claude-skill-validator
• TrustScan
  Security scanner for MCP servers and skills: Unicode injection, patterns, secrets.
• IA-QA Eval & RAG — 38 tools
  LLM & RAG evals: hallucination, eval contracts, semantic tests, tokens & model info. Free, no key.
• Tech Risk
  MCP security scanner: tool-poisoning & prompt-injection audit (OWASP LLM01/08) + Base data
• Tanod Security
  Contract and agent-package scans, phishing URL and OFAC checks, domain and header checks.
• X402 Endpoints
  x402 paid API tools for AI agents on Base: EU/global registries, crypto, wallet & agent trust.
• AgentAegis
  Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.

Badge for your README

[![AptLynx](https://aptlynx.net/badge/io.github.JcJamet/ia-qa-security.svg)](https://aptlynx.net/servers/io.github.JcJamet/ia-qa-security)

Listing text is written by the maker; AptLynx lists tools and does not vouch for them. Find another tool · Browse by topic · For agents