ENFRESDE
List your agent

IA-QA Security — 30 tools

MCP server · hosted · v1.0.0 · io.github.jcjamet/ia-qa-security
Online · tested 1h agoNEW · 2h agoSeen in the registry 1h ago

Agent security: prompt injection, PII & secret scans, TLS/header/CORS audits, MCP checks. Free.

How to connect ↓

What it does

IA-QA Security — 30 tools is an MCP server, a connector that lets an AI assistant use it as a tool. It is hosted: an assistant connects to it over the internet, nothing to install.

No capability identified yet from its description.

Facts come from the Official MCP Registry, as declared by the publisher. Capabilities are matched automatically (low confidence). None of this is a test of the tool.

At a glance

Hosted (remote)YES
Local installNO
Version1.0.0
PriceNot in the registry
First seen26 Oct 2026
Last checked1h ago

How to connect

As declared in the Official MCP Registry · hosted endpoint tested by Electra Index 1h ago (live check)

Hosted endpoint

  • https://www.ia-qa.com/mcp/security streamable-http

In Claude Code: claude mcp add --transport http ia-qa-security-30-tools https://www.ia-qa.com/mcp/security

MCP settings (Claude Desktop, Cursor and other MCP clients)

{
  "mcpServers": {
    "ia-qa-security-30-tools": {
      "url": "https://www.ia-qa.com/mcp/security"
    }
  }
}

Live check

Electra Index connected to the hosted endpoint 1h ago

ONLINE IA-QA Security — 30 tools answered an MCP connection on 26 Oct 2026 and introduced itself as ia-qa-toolbox-security 1.0.0 (MCP protocol 2025-06-18).

30 tools offered to AI assistants

  • find_tool · Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this when you are unsure which tool to use or want to explore the catalogue. Categorie
  • prompt_injection_scan · Scan user input or prompts for common prompt injection patterns. Detects system prompt overrides, jailbreak attempts, role manipulation, encoding tricks, delimiter attacks (chat-template tags `<|im_start|>`/`[INST]`/`<<SYS>>` AND fake role
  • guardrail_test · Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex. Returns pass/fail per rule.
  • redact_pii · Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, credit cards, IP addresses, and JWT tokens with [REDACTED_TYPE] placeholders. Safe to use before logging or sending t
  • secret_scan · Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth h
  • validate_agent_trajectory · Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). No LLM call — deterministic. Assertion types: order (tool A before B), must_call
  • validate_mcp_response · Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSON result and a set of checks to perform.
  • mcp_server_health_check · Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list (raw JSON-RPC or its result), a bare array of tools, one tool definition, or a manife
  • mcp_server_evaluate · Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize (protocol version, serverInfo, Mcp-Session-Id carried afterwards), notifications/initialized (202), tools/list with pa
  • toxicity_scan · Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term + predicate), not a semantic classifier — returns per-category risk plus the na
  • function_call_validate · Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args. For OpenAI function calling & MCP tool_use testing.
  • mcp_schema_lint · Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. Returns actionable warnings.
Show 18 more
  • bias_detect · Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score (0-100), sentiment analysis per variant, pairwise Jaccard similarity, and a hum
  • shield_analyze · Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel: hallucination detection (grounding score), prompt injection scan on BOTH the re
  • security_headers_check · Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissio
  • ssl_certificate_check · Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key exchange info, and an overall grade (A+, A, B, C, F). Detects expired, self-signe
  • cors_test · Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin reflection (echoing any origin), null origin acceptance, subdomain wildcard bypass, a
  • cors_checker · Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the preflight OPTIONS response. Use this for direct CORS debugging, not just security
  • cookie_security_audit · Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path scope, Max-Age/Expires, __Host-/__Secure- prefixes. Flags insecure patterns: mi
  • web_security_audit · Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrates security_headers_check + ssl_certificate_check + cors_test + cookie_security_a
  • rate_tool · Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high (4-5) only if it genuinely solved your need. Ratings are aggregated on a public
  • decode_jwt · Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry date. Use to inspect claims (sub, iss, exp, roles) during debugging or when inte
  • validate_url · Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.
  • http_status_lookup · Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code in the IANA HTTP Status Code Registry (1xx-5xx, including 226, 425, 451, 508, 51
  • parse_http_headers · Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing security headers (HSTS, CSP, X-Frame-Options, etc.).
  • detect_secrets · Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and generic passwords. Returns findings with severity. Run before every commit.
  • latency_benchmark · Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarking.
  • hash_text · Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or produce a fixed-length digest of any input. Supports SHA-256 (default), SHA-512,
  • generate_password · Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when resetting user passwords, seeding test accounts, or generating API secrets.
  • generate_hmac · Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verification (GitHub, Stripe, Twilio), and JWT validation.

What "online" means: the server answered an MCP connection at the time of the check. It is not a guarantee of security, quality or continuous uptime. How we test: we open an MCP session and ask for the tool list, as an AI assistant would. We never run a tool and never send a key. Checked every few days. Method

Is this your server? Monitoring Pro: a check every 30 minutes and an email within the hour when it stops answering. Launch offer: $39.99 once, for life.

Facts & evidence

Each fact shows where it was seen and when.
FactValueEvidenceSourceLast confirmed
Hosted endpointhttps://www.ia-qa.com/mcp/securityDECLAREDSRC-001 Official MCP Registry1h ago
Local install (package)noDECLAREDSRC-001 Official MCP Registry1h ago
Remote access (hosted)yesDECLAREDSRC-001 Official MCP Registry1h ago
Registry statusactiveDECLAREDSRC-001 Official MCP Registry1h ago
Version1.0.0DECLAREDSRC-001 Official MCP Registry1h ago
MCP serveryesDECLAREDSRC-001 Official MCP Registry1h ago

Change history

  • NEW26 Oct 2026
    first seen in the index

Is this page accurate?

Flag it and our robot re-checks the official source. Reports never change a score.

Are you the publisher of IA-QA Security — 30 tools?

Free · show your listing

An independent listing builds trust with your buyers. Announce it, and add the badge to your website or README.

Announce it on LinkedInListed on Electra Index
<a href="https://electraindex.com/mcp/ia-qa-security-30-tools?utm_source=badge&utm_medium=share&utm_campaign=listing"><img src="https://electraindex.com/api/badge/ia-qa-security-30-tools" alt="Listed on Electra Index"></a>

Questions about IA-QA Security — 30 tools

How do I connect IA-QA Security — 30 tools?

Use the hosted endpoint https://www.ia-qa.com/mcp/security in your assistant's MCP settings. The exact settings are in "How to connect" above, as declared in the Official MCP Registry.

What tools does IA-QA Security — 30 tools offer?

When Electra Index connected on 26 Oct 2026, it listed 30 tools: find_tool, prompt_injection_scan, guardrail_test, redact_pii, secret_scan, validate_agent_trajectory, validate_mcp_response, mcp_server_health_check and more. The full list is in "Live check" above.

Is IA-QA Security — 30 tools online?

Yes. Its hosted endpoint answered an MCP connection from Electra Index 1h ago.