IA-QA — 130+ QA & Dev Tools for AI Agents — MCP Server

Validate and pretty-print a string that is ALREADY valid JSON. Strict by design — it is a validity gate: valid JSON comes back formatted, anything else is rejected with the exact parse error. It never repairs, completes, or guesses. NOT for: plain text or prose (will fail), JSON embedded in markdown/prose (use extract_json_from_text first), JS objects (JSON.stringify them first), YAML (use yaml_to

Parameter	Type	Required	Notes
input	string	yes	A raw JSON string, e.g. '{"key":"value"}'. Must already parse as JSON — plain text or truncated JSON is rejected, not repaired.
indent	number	no	Indent size (default: 2)

Generate one or more cryptographically random UUID v4 identifiers. Use this when you need unique IDs for test fixtures, database records, session tokens, or any scenario requiring a guaranteed-unique string. Returns up to 100 UUIDs in one call.

Parameter	Type	Required	Notes
count	number	no	Number of UUIDs to generate (1–100, default: 1)

Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or produce a fixed-length digest of any input. Supports SHA-256 (default), SHA-512, SHA-1, and MD5.

Parameter	Type	Required	Notes
input	string	yes	Text to hash
algorithm	string	no	Hash algorithm: sha256 (default), sha512, sha1, md5

Estimate the token count of a text string using the cl100k_base approximation (~4 chars/token). Call this BEFORE sending any text to an LLM API to check if it fits within the model context window and to estimate cost. Returns token estimate, character count, and word count.

Parameter	Type	Required	Notes
input	string	yes	Text to count tokens for

Encode a UTF-8 string to Base64. Use when you need to embed binary data, multi-line text, or special characters safely inside JSON fields, HTTP headers, or data URIs.

Parameter	Type	Required	Notes
input	string	yes	Text to encode

Decode a Base64 string back to UTF-8 text. Use for inspecting Base64-encoded API responses, JWT payload claims, config file values, or attachment data.

Parameter	Type	Required	Notes
input	string	yes	Base64 string to decode

Percent-encode a string for safe use in URLs. Call this before programmatically building query strings, path segments, or form-encoded bodies to prevent injection and malformed URLs.

Parameter	Type	Required	Notes
input	string	yes	String to URL-encode
mode	string	no	"component" (default) or "full" for encodeURI behavior

Decode a percent-encoded URL string back to plain text. Use when parsing query parameters from raw URLs or when displaying encoded values to users.

Parameter	Type	Required	Notes
input	string	yes	URL-encoded string to decode

Convert any string into a URL-friendly slug: lowercase, ASCII-normalized (é→e), special characters removed, spaces replaced with hyphens. Use for generating SEO-friendly URL paths, file names, or identifier keys from user-provided titles or labels.

Parameter	Type	Required	Notes
input	string	yes	String to slugify
separator	string	no	Separator character (default: "-")

Validate an email address against RFC 5322 syntax before storing it, sending a transactional email, or adding it to a mailing list. Returns { valid, email } — use this to avoid bounces and malformed data.

Parameter	Type	Required	Notes
email	string	yes	Email address to validate

Minify a JavaScript snippet, function, class, or module up to 50 KB using Terser. Returns minified code and byte savings. Use when embedding scripts in HTML templates, report payloads, or injecting inline code programmatically.

Parameter	Type	Required	Notes
code	string	yes	JavaScript code to minify (max 50kb)

Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry date. Use to inspect claims (sub, iss, exp, roles) during debugging or when integrating with an auth provider.

Parameter	Type	Required	Notes
token	string	yes	The JWT string to decode (header.payload.signature)

Compute comprehensive statistics for any text: character count (with and without spaces), word count, line count, sentence count, paragraph count, and estimated reading time in minutes. Sentence counting is abbreviation-aware — titles (Mr., Dr.), acronyms (U.S., i.e., p.m.), initials, decimals, URLs and emails do not end a sentence, and a text with no terminal punctuation still counts as one. Use

Parameter	Type	Required	Notes
input	string	yes	The text to analyse

Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when resetting user passwords, seeding test accounts, or generating API secrets.

Parameter	Type	Required	Notes
length	number	no	Password length (4–128, default: 16)
uppercase	boolean	no	Include uppercase letters (default: true)
numbers	boolean	no	Include digits (default: true)
symbols	boolean	no	Include symbols like !@#$ (default: false)

Parse a CSV string into a JSON array of objects (or raw arrays). Full RFC 4180: quoted fields may contain the delimiter, embedded newlines (the Excel/Sheets multi-line cell), and doubled quotes. Custom delimiters supported. An unterminated quote is rejected with its position rather than parsed into corrupted rows. Use when processing spreadsheet exports, data imports, or structured text pipelines

Parameter	Type	Required	Notes
input	string	yes	CSV content to parse
delimiter	string	no	Field delimiter character (default: ",")
header	boolean	no	Treat the first row as headers (default: true)

Convert a color between HEX, RGB, and HSL formats. Use when translating design tokens between CSS notations, verifying color accessibility, or normalizing color values from user input. Accepts #rrggbb, #rgb, rgb(r,g,b), or hsl(h,s%,l%).

Parameter	Type	Required	Notes
input	string	yes	Color value to convert, e.g. "#ff6b6b", "rgb(255,107,107)", "hsl(0,100%,71%)"

Test a regular expression pattern against an input string and return all matches with their index positions and named capture groups. Use for validating user inputs, extracting structured data from text, or debugging regex patterns. Supports flags g, i, m, s, u, y. The match runs in an isolated thread with a 500 ms budget: a pattern that blows up (catastrophic backtracking, e.g. "(a+)+$") comes ba

Parameter	Type	Required	Notes
pattern	string	yes	Regular expression pattern (without delimiters)
input	string	yes	The string to test against (max 50 KB)
flags	string	no	Regex flags: g (global), i (case-insensitive), m (multiline), s (dotAll) — default: ""

Generate Lorem Ipsum placeholder text for UI mockups, design prototypes, or test data population. Configurable paragraphs (1–10), sentences per paragraph (1–20), and approximate words per sentence (3–30).

Parameter	Type	Required	Notes
paragraphs	number	no	Number of paragraphs to generate (1–10, default: 1)
sentences_per_paragraph	number	no	Sentences per paragraph (1–20, default: 5)
words_per_sentence	number	no	Approximate words per sentence (3–30, default: 10)

Convert between Unix timestamps (seconds or milliseconds) and ISO-8601 / UTC date strings. Auto-detects epoch vs. millisecond format. Omit input to get the current time. Returns iso, unix_s, unix_ms, utc, date, and time fields.

Parameter	Type	Required	Notes
input		no	Unix timestamp (number, seconds or ms) or ISO date string. Omit to get the current time.

Compute a unified line-by-line diff between two text strings (LCS algorithm). Returns added/removed/unchanged line counts and formatted diff hunks with configurable context lines (0–20). Use to compare versions of prompts, configs, code snippets, or any text where you need to see exactly what changed.

Parameter	Type	Required	Notes
a	string	yes	Original (before) text
b	string	yes	Modified (after) text
context	number	no	Context lines around each change (0–20, default: 3)

Truncate text to at most N tokens (cl100k_base: ~4 chars/token) to avoid exceeding an LLM context window. Optionally keeps the end of the text instead of the start (useful for keeping recent conversation history). Reports whether truncation occurred and the estimated token count.

Parameter	Type	Required	Notes
input	string	yes	Text to truncate
max_tokens	number	yes	Maximum number of tokens to keep
from_end	boolean	no	Keep the end of the text instead of the start (default: false)

Split text into chunks of at most N tokens (cl100k_base: ~4 chars/token) with optional overlap. Designed for RAG ingestion pipelines.

Parameter	Type	Required	Notes
input	string	yes	Text to split into chunks
chunk_tokens	number	yes	Maximum tokens per chunk (10–8000)
overlap	number	no	Token overlap between consecutive chunks (default: 0)

Extract the first valid JSON object or array embedded in chaotic LLM output (surrounded by markdown fences, prose, or explanatory text). Handles ```json blocks and inline JSON. Call this whenever an LLM returns structured data mixed with explanation text instead of raw JSON.

Parameter	Type	Required	Notes
input	string	yes	Raw text (e.g., LLM output) that may contain a JSON object or array

Strip all Markdown formatting (headers, bold, italic, code fences, links, lists) from text and return clean plain text. Run this before injecting scraped documentation, README files, or user content into an LLM prompt to eliminate redundant markup tokens and reduce cost.

Parameter	Type	Required	Notes
input	string	yes	Markdown text to convert to plain text

Estimate the API cost in USD for a given model and token counts. Supports all major 2024–2026 models: GPT-4o, GPT-4.1, o3, o4-mini, Claude Opus 4, Claude Sonnet 4/4.5, Gemini 2.5 Pro/Flash, DeepSeek V3/R1, Grok 3, and legacy models.

Parameter	Type	Required	Notes
model	string	yes	Model name, e.g. "gpt-4o", "claude-3.5-sonnet", "deepseek-v3"
input_tokens	number	yes	Number of input/prompt tokens
output_tokens	number	no	Number of output/completion tokens (default: 0)

Escape HTML special characters (&, <, >, ", ') to their safe HTML entities. ALWAYS call this before inserting any user-provided or LLM-generated content into an HTML template to prevent cross-site scripting (XSS) attacks.

Parameter	Type	Required	Notes
input	string	yes	String to HTML-escape

Convert HTML entities (&, <, >, ", ', and numeric &#NNN;) back to plain characters. Use when processing HTML-encoded text from APIs, email content, or legacy database fields before passing to an LLM or displaying to users.

Parameter	Type	Required	Notes
input	string	yes	HTML-encoded string to unescape

Fetch the latest QA & AI/LLM articles aggregated from curated RSS sources (Google Testing Blog, DEV.to Testing/QA/AI/LLM/Agents, Hugging Face Blog, Simon Willison). Perfect for agents monitoring the QA & AI landscape. Each article carries summary_source — the XML tag the summary was read from, or "none" when the feed publishes titles and links only; an empty summary with summary_source "none" is a

Parameter	Type	Required	Notes
category	string	no	Filter: "qa" (testing/quality), "ai" (AI/LLM/agents), "all" (default — both)
limit	number	no	Max articles to return (default: 20, max: 50)

Analyze a webpage <head> HTML (or full HTML) for GEO (Generative Engine Optimization) signals. Returns a score /60 with per-check results and improvement tips. GEO = optimizing pages for AI-powered search engines (ChatGPT Search, Perplexity, etc.).

Parameter	Type	Required	Notes
head_html	string	yes	Raw HTML of the <head> section (or full page HTML) to analyze

Extract a value from a JSON string using dot-notation path (e.g., "user.address.city", "items.0.name", "meta.tags"). Supports array index access via numeric path segments.

Parameter	Type	Required	Notes
input	string/object/array	yes	The JSON to traverse — a JSON string, or the object/array itself.
path	string	yes	Dot-notation path, e.g. "user.address.city" or "items.0.name"

Generate a ready-to-paste <script type="application/ld+json"> snippet for GEO / structured data optimization. Supported types: WebSite, FAQPage, Article, Person, Organization, SoftwareApplication, HowTo.

Parameter	Type	Required	Notes
type	string	yes	Schema @type: "WebSite", "FAQPage", "Article", "Person", "Organization", "SoftwareApplication", "HowTo"
fields	object	no	Schema fields as key-value pairs (name, url, description, author, datePublished, etc.)
faq_items	array	no	For FAQPage/HowTo: array of { question, answer } objects

Pattern-based diff linter: flags a fixed set of risky shapes in changed code — query-string interpolation (SQL/Cypher/Mongo injection shape), shell interpolation, eval/new Function, empty catch blocks, regex built from a variable, fewer catch blocks than before, and named authorization guards that disappeared. Every finding cites the line that produced it. It does NOT do data-flow analysis: it can

Parameter	Type	Required	Notes
version1	string	no	Original code (before changes). If omitted, only the new version is analysed.
version2	string	yes	New/modified code (after changes)
context	string	no	Optional PR title or feature context for better analysis

Generate a set of test cases (valid, edge, invalid, pairwise) for a given feature description. Declared constraints drive the boundaries: a length or numeric bound ("[8-64]", "min 8 chars", "at least 8 characters" — read from inputs, and from the feature prose when a sentence names exactly one field) yields the last accepted value AND the first rejected one; a format (email/url/uuid, from the type

Parameter	Type	Required	Notes
feature	string	yes	Feature or function to test. Be specific: describe inputs, expected behaviour, context. Constraints stated here ("password must be at least 8 characters") are used when the sentence names exactly one
inputs	string	no	Optional: list of input parameters (one per line, e.g. "email: string [required]", "password: string [required, min 8 chars]", "age: number [18-99]")

Review triage for a pull request. Takes a unified git diff (git diff HEAD) and returns: diff-lint findings with the lines that produced them, regression impact areas, a risk score 0–100 with the factors that built it (churn, files touched, sensitive paths, whether any test file changed, lint severities, impacted risk areas), generated test cases, and a PASS / CONDITIONAL / BLOCK recommendation.

Parameter	Type	Required	Notes
git_diff	string	yes	Unified git diff (output of git diff HEAD or copied from GitHub diff view)
context	string	no	Optional PR title or description for richer analysis

Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSON result and a set of checks to perform.

Parameter	Type	Required	Notes
response	string	yes	The MCP tool result as a JSON string to validate
expected_type	string	no	Expected top-level type: "object", "array", "string", "number"
required_keys	string	no	Comma-separated list of keys that MUST exist in the response (dot-notation for nested: "data.id, data.name")
forbidden_keys	string	no	Comma-separated list of keys that MUST NOT exist (e.g. "password, secret, token")
max_response_ms	number	no	Maximum acceptable latency in ms (will be compared if provided)
actual_latency	number	no	Actual measured latency in ms (from the call)
min_items	number	no	If response is an array, minimum number of items expected
max_size_bytes	number	no	Maximum acceptable response size in bytes

Validate an LLM response against QA criteria: format checks (JSON, code, markdown), content rules (must-include, must-not-include), length constraints, language detection, and safety patterns. Essential for QA testing LLM-powered features.

Parameter	Type	Required	Notes
output	string	yes	The LLM output text to validate
expected_format	string	no	Expected output format
must_include	string	no	Comma-separated strings that MUST appear in the output
must_not_include	string	no	Comma-separated strings that must NOT appear (e.g. "TODO, FIXME, undefined, NaN")
max_length	number	no	Maximum character length for the output
min_length	number	no	Minimum character length for the output
expected_language	string	no	Expected language of the output (en, fr, es, de…). Checks for common words.
check_safety	boolean	no	Check for PII patterns (emails, phones, SSN), profanity signals, and prompt leakage
check_json_schema	string	no	If expected_format is JSON, provide required keys as comma-separated list to validate the structure

Compare two ALREADY-PRODUCED outputs (e.g. model A vs model B on the same task) side by side. Returns deterministic metrics (token cosine, ROUGE-L, Jaccard, length/structure deltas, JSON diff) and a verdict. If a reference (ground truth) is given, scores each output against it and picks the closer one. If model + api_key are given, an LLM judge also picks a qualitative winner for the task. N

Parameter	Type	Required	Notes
response_a	string	yes	First output (e.g. model A's answer)
response_b	string	yes	Second output (e.g. model B's answer)
label_a	string	no	Label for output A (e.g. "GPT-4o", "v1.0")
label_b	string	no	Label for output B (e.g. "GPT-5-nano", "v1.1")
task	string	no	The task/prompt both outputs were answering — used by the LLM judge for context
reference	string	no	Optional ground-truth / expected answer. If set, each output is scored against it and the closer one wins (deterministic).
check_json	boolean	no	Try to parse as JSON and compare structurally (keys, types, values)
model	string	no	Optional judge model id (BYOK). When set with api_key, an LLM judge picks a qualitative winner.
api_key	string	no	Optional API key for the judge model (BYOK). Used only for the judge call; never stored.

Semantically analyze N already-produced model outputs for the SAME task (the MCP counterpart to the LLM Sandbox). Without a reference: computes consensus — pairwise cosine agreement, the most-representative output, and the outlier. With a reference (ground truth): also ranks every output by closeness (token cosine + ROUGE-L composite) and names the closest. No LLM, no key, runs locally. The refe

Parameter	Type	Required	Notes
responses	array	yes	The outputs to analyze (same task, N models/prompts/versions). Each item is a plain string or { "label": "GPT-4o", "text": "..." }. At least 2 required.
reference	string	no	Optional ground-truth answer. If set, each output is also ranked by closeness to it and the closest one is named.

Define a test suite for a prompt: provide the system prompt, user prompt, and expected output criteria. Returns a test plan with scored rubric — use this as input for manual or automated LLM evaluation.

Parameter	Type	Required	Notes
system_prompt	string	yes	The system prompt under test
user_prompt	string	yes	The user prompt to send
expected_behavior	string	no	Description of what the LLM should do (free text)
expected_format	string	no	Expected output format
must_include	string	no	Required content (comma-separated)
must_not_include	string	no	Forbidden content (comma-separated)
max_tokens	number	no	Max token budget for the test
temperature	number	no	Temperature to use
check_safety	boolean	no	Include safety/PII checks in the rubric
adversarial_prompts	boolean	no	Auto-generate adversarial test variants (jailbreak, injection, edge cases)

Generate a health check report for an MCP server's tool manifest. Validates tool definitions, schema quality, naming conventions, and documentation completeness. Paste the server manifest JSON to audit.

Parameter	Type	Required	Notes
manifest	string	yes	MCP server manifest JSON (the response from GET /mcp or tools/list)
strict	boolean	no	Enable strict mode: also check for optional best practices (examples, default values, descriptions > 20 chars)

Run a full compliance evaluation against a live MCP server URL. Tests: server reachability (ping), manifest discovery (GET /mcp), schema quality (snake_case names, descriptions, inputSchema), JSON-RPC 2.0 test call, and P50/P95 latency. Returns a PASS/FIX/BLOCK verdict with a 0-100 score and per-check details.

Parameter	Type	Required	Notes
url	string	yes	Base URL of the MCP server (e.g. https://www.ia-qa.com or http://localhost:3001)
test_tool_name	string	no	Specific tool name to use in the JSON-RPC test call (defaults to the first tool in the manifest)

Validate a JSON value against a JSON Schema (draft-07 subset). Supports type, required, properties, items, enum, const, pattern, format (email/uri/date), minimum/maximum, minLength/maxLength, minItems/maxItems, uniqueItems, additionalProperties, anyOf, allOf, oneOf. Returns all validation errors with dot-notation paths.

Parameter	Type	Required	Notes
value	string/object/array	yes	The JSON value to validate — a JSON string, or the value itself.
schema	string/object/array	yes	The JSON Schema — a JSON string, or the schema object itself.

Flatten a nested JSON object to single-level dot-notation keys (e.g. {"a":{"b":1}} → {"a.b":1}), or unflatten dot-notation keys back to a nested object. Supports custom separators.

Parameter	Type	Required	Notes
input	string/object/array	yes	The JSON to flatten or unflatten — a JSON string, or the object itself.
mode	string	no	"flatten" (default) or "unflatten"
separator	string	no	Key separator (default: ".")

Convert an XML string to a JSON object. Supports attributes, nested elements, arrays, CDATA, and namespaces. Options: parse numbers, parse booleans, ignore attributes.

Parameter	Type	Required	Notes
input	string	yes	XML string to convert
parse_values	boolean	no	Auto-parse numbers and booleans (default: true)
ignore_attrs	boolean	no	Ignore XML attributes (default: false)
attr_prefix	string	no	Prefix for attribute keys (default: "@_")

Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, credit cards, IP addresses, and JWT tokens with [REDACTED_TYPE] placeholders. Safe to use before logging or sending to an LLM.

Parameter	Type	Required	Notes
input	string	yes	Text to redact PII from
types	string	no	Comma-separated types to redact (default: all). Options: email, phone, ssn, credit_card, ip_address, jwt
marker	string	no	Custom replacement marker (default: "REDACTED"). Result: [REDACTED_EMAIL]

Generate realistic mock data from a JSON Schema. Supports all common types (string, number, integer, boolean, array, object, null), format hints (email, date, date-time, uri, uuid), enum, const, and nested schemas. Perfect for testing MCP tools with realistic data.

Parameter	Type	Required	Notes
schema	string/object/array	yes	The JSON Schema to generate from — a JSON string, or the schema object itself.
count	number	no	Number of mock objects to generate (default: 1, max: 20)
seed	string	no	Optional seed string for deterministic output (uses first char codes)

Transform a JSON array using common operations: pluck (extract specific fields), filter (by field value), sort_by (field), group_by (field), count_by (field), uniq_by (field). Useful for processing MCP tool results and LLM structured outputs.

Parameter	Type	Required	Notes
input	string/object/array	yes	The JSON containing an array (or an object with an array at path) — a JSON string, or the value itself.
path	string	no	Optional dot-notation path to the array within the JSON object (e.g. "data.items")
operation	string	yes	Operation: "pluck", "filter", "sort_by", "group_by", "count_by", "uniq_by", "reverse", "first_n", "last_n", "flatten"
field	string	no	Field to operate on (for sort_by, group_by, count_by, uniq_by, filter)
fields	string	no	Comma-separated field list for "pluck" (e.g. "id,name,email")
filter_op	string	no	For "filter": "==" \| "!=" \| ">" \| ">=" \| "<" \| "<=" \| "contains" \| "exists" \| "!exists"
filter_value	string	no	For "filter": value to compare against
n	number	no	For first_n / last_n: number of items
sort_order	string	no	For sort_by: "asc" (default) or "desc"

Convert a JSON array of objects to CSV format. Automatically detects columns from all object keys. Handles quoting and escaping per RFC 4180.

Parameter	Type	Required	Notes
input	string/object/array	yes	The array of objects to convert — a JSON string, or the array itself.
delimiter	string	no	Column delimiter (default: ",")
headers	boolean	no	Include header row (default: true)

Convert a string between naming conventions: camelCase, PascalCase, snake_case, kebab-case, UPPER_SNAKE_CASE, dot.case, Title Case. Essential for code generation and refactoring.

Parameter	Type	Required	Notes
input	string	yes	String to convert (e.g., "myVariableName", "my-css-class")
to	string	yes	Target case: "camel", "pascal", "snake", "kebab", "upper_snake", "dot", "title"

Sort, deduplicate, reverse, or filter lines of text. Useful for cleaning import lists, dependencies, log files, and config entries.

Parameter	Type	Required	Notes
input	string	yes	Multi-line text to process
operation	string	no	"sort" (default), "sort_desc", "reverse", "deduplicate", "unique_sort", "filter"
filter	string	no	For "filter": keep lines containing this substring (case-insensitive)
trim	boolean	no	Trim whitespace from each line (default: true)
remove_empty	boolean	no	Remove empty lines (default: true)

Convert numbers between bases: decimal, binary, octal, hexadecimal, or any base 2–36. Auto-detects 0x, 0b, 0o prefixes.

Parameter	Type	Required	Notes
input	string	yes	Number to convert (e.g., "255", "0xFF", "0b1010", "0o77")
from_base	number	no	Source base 2–36 (auto-detects prefix if omitted)
to_base	number	no	Target base 2–36 (omit to get all common bases)

Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.

Parameter	Type	Required	Notes
input	string	yes	URL to validate and parse

Calculate WCAG 2.1 contrast ratio between two colors. Returns ratio and compliance for AA/AAA normal and large text.

Parameter	Type	Required	Notes
foreground	string	yes	Foreground color in hex (e.g., "#333333")
background	string	yes	Background color in hex (e.g., "#ffffff")

Convert HTML to clean Markdown. Strips scripts, styles, nav, ads, and comments. Converts headings, lists, links, images, code blocks. Ideal for preparing web content as LLM context.

Parameter	Type	Required	Notes
input	string	yes	HTML string to convert
strip_links	boolean	no	Strip link URLs, keep text only (default: false)

Parse a cron expression into a human-readable schedule description. Supports standard 5-field cron (minute hour day month weekday).

Parameter	Type	Required	Notes
expression	string	yes	Cron expression (e.g., "0 9 * * 1-5", "/15 * * *")

Validate a 5-field cron expression, explain the schedule, and preview the next execution times. Use this to debug cron jobs before they reach production. Returns parsed fields, a human-readable description, and upcoming ISO timestamps.

Parameter	Type	Required	Notes
expression	string	yes	Cron expression with 5 fields, e.g. "/15 9-18 * 1-5"
next_runs_count	number	no	How many upcoming runs to return (1-50, default: 10)

Calculate readability scores: Flesch Reading Ease, Flesch-Kincaid Grade Level, Coleman-Liau Index, and Automated Readability Index. Useful for evaluating LLM output quality.

Parameter	Type	Required	Notes
input	string	yes	Text to analyze for readability

Normalize whitespace: trim trailing spaces, collapse blank lines, normalize line endings (LF/CRLF), convert tabs to spaces. Useful for cleaning code, configs, and text before processing.

Parameter	Type	Required	Notes
input	string	yes	Text to normalize
line_ending	string	no	"lf" (default), "crlf", or "cr"
collapse_blanks	boolean	no	Collapse runs of blank lines down to max_blank_lines (default: true)
max_blank_lines	number	no	Blank lines to keep when collapsing, 0-10 (default: 2)
trim_lines	boolean	no	Trim trailing whitespace from each line (default: true)
trim_file	boolean	no	Trim leading/trailing blank lines (default: true)
tab_to_spaces	number	no	Convert tabs to N spaces (omit to keep tabs)

Compute text similarity using local algorithms (Bag of Words, TF-IDF, Character N-grams). No API key needed — runs entirely in-process. NOT real embeddings: for true semantic similarity with vector embeddings, use run_semantic_tests with mode="embeddings" and your OpenAI API key. Supports single pair or batch mode with pipe-separated pairs. Useful for RAG retrieval testing, semantic search evaluat

Parameter	Type	Required	Notes
text_a	string	no	First text to compare (single-pair mode)
text_b	string	no	Second text to compare (single-pair mode)
batch	array	no	Batch mode: array of { text_a, text_b } pairs. Overrides text_a/text_b if provided.
methods	array	no	Algorithms to use (default: all three). Options: "bow", "tfidf", "ngram"

Validate that an LLM output matches an expected format: JSON, Markdown, code block, bullet list, numbered list, table, YAML, XML, or custom regex. Essential for structured output testing.

Parameter	Type	Required	Notes
output	string	yes	The LLM output to validate
expected_format	string	yes	Expected format
regex_pattern	string	no	Custom regex pattern (only when expected_format is "regex")

Lexical hallucination check: verifies an LLM answer's words, numbers and polarity against the provided source/context. Fast, deterministic, no API key needed. Each answer sentence is aligned to its best-matching source sentence, so a number only counts as support when it sits on the SAME statement ("founded in 1998" is not grounded by "sold 1998 units"), and a negation or antonym flip against that

Parameter	Type	Required	Notes
answer	string	yes	The LLM-generated answer to verify
context	string	yes	The source/reference text that should ground the answer
strict	boolean	no	If true, every sentence in the answer must be supported (default: false)

Scan user input or prompts for common prompt injection patterns. Detects system prompt overrides, jailbreak attempts, role manipulation, encoding tricks, delimiter attacks (chat-template tags <|im_start|>/[INST]/<<SYS>> AND fake role headers imitating markdown or chat separators: "### System:", "--- SYSTEM ---", "---BEGIN SYSTEM OVERRIDE---", "--- SYSTEM:"), template/interpolation injection

Parameter	Type	Required	Notes
input	string	yes	The user input or prompt to scan for injection patterns
sensitivity	string	no	Detection sensitivity (default: medium)

Plan token allocation across system prompt, user input, context/RAG chunks, and expected output. Warns if budget exceeds model context window. Supports 25+ models.

Parameter	Type	Required	Notes
model	string	yes	Model name (e.g. gpt-4o, claude-3.5-sonnet, gemini-2.0-flash)
system_prompt_tokens	number	no	Token count for system prompt
user_input_tokens	number	no	Token count for user message
context_tokens	number	no	Token count for RAG context / documents
expected_output_tokens	number	no	Expected max output tokens
system_prompt	string	no	Actual system prompt text (will estimate tokens)
user_input	string	no	Actual user input text (will estimate tokens)
context	string	no	Actual context text (will estimate tokens)

Compare multiple LLM responses to the same prompt and detect inconsistencies using Jaccard word-overlap similarity and fact drift (number comparison). Fast, deterministic, no API key needed. Limitations: relies on surface-level word matching — "Paris is the capital of France" vs "Paris is the French capital" may score low despite semantic equivalence. For true semantic consistency, use run_semanti

Parameter	Type	Required	Notes
responses	array	yes	Array of 2+ LLM responses to compare (same prompt, different runs)
check_facts	boolean	no	Check for contradictory numbers/facts across responses (default: true)

Validate that an LLM JSON output matches a JSON Schema definition. Tests required fields, types, enums, nested objects, and arrays. Critical for function-calling and structured output testing.

Parameter	Type	Required	Notes
output	string	yes	The LLM JSON output (raw string, will be parsed)
schema	object	yes	JSON Schema (draft-07 subset) to validate against

Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarking.

Parameter	Type	Required	Notes
endpoints	string/array	yes	Endpoints to benchmark. Accepts a single URL string, an array of URL strings, or an array of {url, method?, body?, headers?, label?} objects.
iterations	number	no	Number of iterations per endpoint (default: 3, max: 10)

Score an LLM response against the criteria you pass: coverage of expected_keywords and compliance with max_length. Returns a 0-100 score over the criteria actually measured — or total_score null with the reason when none is given, because relevance and correctness cannot be read off word overlap (a correct one-word answer shares no words with its question). For meaning against a reference answer,

Parameter	Type	Required	Notes
question	string	yes	The original question/prompt
response	string	yes	The LLM response to score
expected_keywords	array	no	Keywords a correct answer must contain (case-insensitive). Scored as coverage.
max_length	number	no	Maximum character length. Scored as a proportional penalty beyond it.

Rank an array of text chunks by relevance to a query using TF-IDF scoring. Simulates retrieval ranking for RAG testing without needing embeddings or an API.

Parameter	Type	Required	Notes
query	string	yes	The user query
chunks	array	yes	Array of text chunks to rank
top_k	number	no	Return top K results (default: all)

Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching (identity term + predicate), not a semantic classifier — returns per-category risk plus the named rules that fired, so every finding can be checked. Useful for LLM safety guardrail testing and triage; signal-only, not a calibrated CI gate.

Parameter	Type	Required	Notes
text	string	yes	Text to scan
categories	array	no	Categories to check (default: all)

Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex. Returns pass/fail per rule.

Parameter	Type	Required	Notes
response	string	yes	The LLM response to test
rules	array	yes	Array of guardrail rules to check

Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args. For OpenAI function calling & MCP tool_use testing.

Parameter	Type	Required	Notes
function_call	object	yes	The function call object from LLM (e.g. { "name": "get_weather", "arguments": {"city":"Paris"} })
allowed_functions	array	yes	List of allowed function definitions

Analyze a multi-turn conversation for context retention, topic drift, instruction following, and repetition. Accepts messages array [{role, content}]. Essential for chatbot QA.

Parameter	Type	Required	Notes
messages	array	yes	Conversation messages in order

Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. Returns actionable warnings.

Parameter	Type	Required	Notes
tool_definition	object	yes	MCP tool definition object with name, description, inputSchema

Analyze a Chain-of-Thought (CoT) or reasoning trace from an LLM. Detects step count, logical flow, conclusion presence, backtracking, and estimates reasoning depth. Useful for o1/o3/DeepSeek-R1 evaluation.

Parameter	Type	Required	Notes
reasoning	string	yes	The CoT / reasoning trace text (e.g. from <think> tags or step-by-step output)
expected_conclusion	string	no	Expected final answer to check against (optional)

Generate an A/B test report comparing two prompts or model configurations. Accepts arrays of scores and returns statistical comparison: mean, median, std deviation, winner, and improvement percentage.

Parameter	Type	Required	Notes
variant_a	object	yes	First variant configuration with name and score array
variant_b	object	yes	Second variant configuration with name and score array

Given an array of message objects [{role, content}], estimate total token usage and check if it fits in the target model's context window. Warns about truncation risk.

Parameter	Type	Required	Notes
messages	array	yes	Array of messages (system/user/assistant)
model	string	yes	Target model name (e.g. gpt-4o, claude-3.5-sonnet)
max_output_tokens	number	no	Reserved tokens for output (default: 4096)

Compute similarity/distance between two float vectors: cosine similarity, dot product, Euclidean and Manhattan distance. Essential for vector DB relevance scoring, embedding evaluation, and nearest-neighbor testing.

Parameter	Type	Required	Notes
vector_a	array	yes	First vector as array of floats
vector_b	array	yes	Second vector as array of floats
metric	string	no	Distance metric (default: all)

L2-normalize a float vector (produce a unit vector with norm=1). Required by many vector DBs (Pinecone, Qdrant cosine). Supports batch normalization of up to 1000 vectors.

Parameter	Type	Required	Notes
vector	array	no	Single vector to normalize
batch	array	no	Batch of vectors to normalize (overrides vector)

Simulate int8 or int4 quantization of float32 embedding vectors. Reduces storage by 4x (int8) or 8x (int4). Returns quantized values, scale factor, and precision loss (MSE). Useful for understanding vector DB compression trade-offs.

Parameter	Type	Required	Notes
vector	array	yes	Float32 vector to quantize
bits	number	no	Quantization bits: 8 (int8, default) or 4 (int4)

Compute statistics for a float vector or matrix of vectors: mean, std, L2 norm, min, max, sparsity, top-K indices. Useful for debugging embedding quality and analyzing vector distributions in a vector DB.

Parameter	Type	Required	Notes
vector	array	no	Single vector to analyze. Required unless matrix is given.
matrix	array	no	Matrix of vectors (overrides vector). Returns per-vector + matrix-level stats. Required unless vector is given.
top_k	number	no	Return indices of top K absolute values (default: 5)

Compute BM25 relevance score between a query and one or more documents. BM25 is the industry-standard keyword-based ranking algorithm used in Elasticsearch, OpenSearch, and Weaviate hybrid search. Returns ranked results with normalized scores.

Parameter	Type	Required	Notes
query	string	yes	The search query
documents	array	yes	Array of documents to rank
k1	number	no	Term frequency saturation (default: 1.5)
b	number	no	Length normalization factor (default: 0.75)
top_k	number	no	Return top K results (default: all)

Assemble a complete RAG (Retrieval-Augmented Generation) prompt from retrieved context chunks and a user query. Handles token budgeting, citation numbering, system instruction injection, and source attribution.

Parameter	Type	Required	Notes
query	string	yes	The user question to answer
chunks	array	yes	Retrieved context chunks with .text (required), .source (optional), .score (optional)
system_instruction	string	no	Custom system instruction (default: standard RAG grounding instruction)
max_context_tokens	number	no	Max tokens for context section (default: 2000)
cite_sources	boolean	no	Add [1], [2] citation numbers (default: true)
language	string	no	Response language instruction (e.g. "French", "Spanish")

Fill a prompt template with variables. Supports {{variable}} syntax and {{#if key}}...{{/if}} conditional blocks. Returns the filled prompt and lists unfilled variables.

Parameter	Type	Required	Notes
template	string	yes	Prompt template with {{variable}} placeholders
variables	object	no	Key-value pairs to fill (e.g. {"name":"Alice","role":"engineer"})
strict	boolean	no	Throw error if any variable is not provided (default: false)

Format few-shot examples for LLM prompts. Converts example pairs into formatted blocks. Supports chat format (User/Assistant), XML tags, Markdown, or plain text.

Parameter	Type	Required	Notes
examples	array	yes	Array of {input, output} pairs
format	string	no	Output format (default: chat)
input_label	string	no	Label for input (default: User / <input>)
output_label	string	no	Label for output (default: Assistant / <output>)

Build a structured system prompt from components: role, task, constraints, output format, tone, language, and examples. Generates a production-ready system prompt with token estimate.

Parameter	Type	Required	Notes
role	string	yes	Role/persona (e.g. "Senior QA Engineer", "JSON extraction assistant")
task	string	no	Main task or objective
constraints	array	no	Rules and constraints to follow
output_format	string	no	Expected output format description
tone	string	no	Communication tone
language	string	no	Response language (e.g. "French")
examples	string	no	Brief examples to include

Get detailed specs for an AI model: context window, pricing per 1K tokens, knowledge cutoff, provider, multimodal support, reasoning capabilities, and feature list. Covers 30+ models from OpenAI, Anthropic, Google, DeepSeek, Meta, Mistral, Cohere, xAI.

Parameter	Type	Required	Notes
model	string	yes	Model name (e.g. "gpt-4o", "claude-3.5-sonnet", "gemini-2.5-pro")

Compare 2-5 AI models side by side: context window, pricing, multimodal, reasoning capabilities, and provider. Returns a comparison table with a recommendation based on your use case.

Parameter	Type	Required	Notes
models	array	yes	Array of 2-5 model names (e.g. ["gpt-4o","claude-3.5-sonnet","gemini-2.0-flash"])
use_case	string	no	Optimize recommendation for this criterion

Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code in the IANA HTTP Status Code Registry (1xx-5xx, including 226, 425, 451, 508, 511 and the WebDAV codes) with its defining RFC; anything outside the registry is reported as registered: false rather than described. cacheable means heurist

Parameter	Type	Required	Notes
code	number	yes	HTTP status code (e.g. 200, 404, 429, 503)

Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing security headers (HSTS, CSP, X-Frame-Options, etc.).

Parameter	Type	Required	Notes
headers	string	yes	Raw HTTP headers (one "Name: Value" per line)
analyze_security	boolean	no	Audit for missing security headers (default: true)

Generate a curl command from request parameters. Supports GET/POST/PUT/DELETE, custom headers, JSON body, and form data. Useful for documentation, sharing, and debugging API calls.

Parameter	Type	Required	Notes
url	string	yes	Request URL (must be http/https)
method	string	no	HTTP method (default: GET)
headers	object	no	Request headers as key-value object
body	string	no	Raw request body string
body_json	object	no	JSON body (auto-adds Content-Type: application/json)
follow_redirects	boolean	no	Follow redirects with -L flag (default: true)
verbose	boolean	no	Add -v for verbose output (default: false)

Extract TODO, FIXME, HACK, BUG, NOTE, OPTIMIZE, and custom tags from any source code or text. Returns line numbers, tag types, and message text. Essential for technical debt auditing.

Parameter	Type	Required	Notes
input	string	yes	Code or text to scan
tags	array	no	Custom tags to add (default set: TODO, FIXME, HACK, NOTE, BUG, OPTIMIZE, XXX)
include_context	boolean	no	Include full line text (default: true)

Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and generic passwords. Returns findings with severity. Run before every commit.

Parameter	Type	Required	Notes
input	string	yes	Code or config content to scan (max 500KB)
filename	string	no	Optional filename for context (e.g. ".env", "config.js")

Count lines of code: total, code lines, comment lines, blank lines, and comment density. Supports JS/TS, Python, Java/C/C++, Ruby, Go, Shell, HTML/XML, and CSS.

Parameter	Type	Required	Notes
input	string	yes	Source code to analyze
language	string	no	Language hint: "js", "ts", "py", "java", "c", "rb", "go", "sh", "html", "css" (auto-detect if omitted)

Validate a git commit message against the Conventional Commits spec (feat, fix, docs, style, refactor, test, chore, ci, perf, build). Returns compliance score, breaking change detection, and actionable suggestions.

Parameter	Type	Required	Notes
message	string	yes	Git commit message to validate
strict	boolean	no	Enforce strict rules: max 72-char subject, imperative mood check (default: false)

Analyze word frequency in text. Returns top N words with counts and percentages. Supports English stopword filtering. Useful for content analysis, keyword extraction, and LLM output analysis.

Parameter	Type	Required	Notes
input	string	yes	Text to analyze
top_n	number	no	Return top N words (default: 20, max: 200)
min_length	number	no	Minimum word length to include (default: 3)
remove_stopwords	boolean	no	Remove common English stopwords (default: true)

Extract all URLs, email addresses, and domain names from text. Returns categorized and deduplicated results. Useful for content auditing, link checking, and web scraping validation.

Parameter	Type	Required	Notes
input	string	yes	Text to extract links from
types	array	no	Types to extract (default: all three)

Compute the Levenshtein (edit) distance and normalized similarity ratio between two strings. Supports batch comparison. Useful for fuzzy string matching, deduplication, and test result comparison.

Parameter	Type	Required	Notes
a	string	no	First string (single-pair mode)
b	string	no	Second string (single-pair mode)
batch	array	no	Batch of {a,b} pairs (max 50)
case_insensitive	boolean	no	Ignore case differences (default: false)

Compute a deep structural diff between two JSON values. Returns added, removed, and changed keys with dot-notation paths. Like git diff but for JSON objects — perfect for API response regression testing. Arrays are not compared blindly by position: the same elements in a different order collapse to a single "reordered" change, and an array of records sharing a stable identity field (id, uuid, key,

Parameter	Type	Required	Notes
before	string/object/array	yes	The original JSON (before) — a JSON string, or the value itself.
after	string/object/array	yes	The modified JSON (after) — a JSON string, or the value itself.
max_depth	number	no	Max nesting depth to recurse (default: 10)

Deep merge two JSON objects. Supports three array strategies: replace (default), concat, or unique (dedup concat). Nested objects are recursively merged — override takes precedence for primitives.

Parameter	Type	Required	Notes
base	string/object/array	yes	The base JSON object (merged into) — a JSON string, or the object itself.
override	string/object/array	yes	The override JSON object (takes precedence) — a JSON string, or the object itself.
array_strategy	string	no	Array merge strategy: replace (default), concat, or unique

Convert a JSON object to clean, human-readable YAML. Handles nested objects, arrays, multiline strings, and special characters. No external dependencies.

Parameter	Type	Required	Notes
input	string/object/array	yes	The JSON to convert to YAML — a JSON string, or the value itself.
indent	number	no	Indentation size in spaces (default: 2)

Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verification (GitHub, Stripe, Twilio), and JWT validation.

Parameter	Type	Required	Notes
message	string	yes	Message to sign
secret	string	yes	Secret key
algorithm	string	no	Hash algorithm: sha256 (default), sha512, sha1, md5
encoding	string	no	Output encoding (default: hex)

Convert raw byte counts to human-readable sizes in SI (KB=1000) or IEC (KiB=1024) units, or parse size strings back to bytes. Covers B, KB/KiB, MB/MiB, GB/GiB, TB/TiB, PB/PiB.

Parameter	Type	Required	Notes
bytes	number	no	Number of bytes to format
size_string	string	no	Size string to parse to bytes (e.g. "1.5 GB", "512 MiB")
standard	string	no	Output standard (default: both)

Detect the natural language of a text using n-gram frequency analysis and common word markers. Supports 15 languages: English, French, Spanish, German, Italian, Portuguese, Dutch, Russian, Chinese, Japanese, Korean, Arabic, Polish, Turkish, Swedish.

Parameter	Type	Required	Notes
input	string	yes	Text to detect language from (min 20 chars for accuracy)

Compound quality gate for pull requests. Runs three sequential checks: (1) secret detection — scans diff for API keys, tokens, passwords matching 16 regex patterns; (2) bug analysis — heuristic scan for eval(), innerHTML, empty catch, console.log, TODO/FIXME; (3) commit message linting against Conventional Commits spec. Returns gate verdict (PASS/WARN/BLOCK), blockers, and actionable warnings. Use

Parameter	Type	Required	Notes
diff	string	yes	Unified git diff (output of git diff HEAD)
commit_message	string	yes	The commit message to lint (e.g. "feat(auth): add OAuth2 login")
context	string	no	Optional: PR title or description for richer bug analysis

List all LLM models available on ia-qa.com with their provider, API endpoint, and capabilities. Filter by provider name (e.g. "Groq", "HuggingFace", "OpenAI") or return the full catalog. Use this to discover which models are available before calling an LLM API, or to compare providers.

Parameter	Type	Required	Notes
provider	string	no	Filter by provider name (case-insensitive). E.g. "Groq", "HuggingFace", "OpenAI", "Anthropic", "Google", "DeepSeek", "xAI", "Ollama". Omit for full catalog.

Generate text using open-source LLM models hosted on Groq (ultra-fast) or HuggingFace Inference (serverless). No API key required — the server provides its own keys. Supported models: Qwen3 32B, Gemma 4 27B, Gemma 3 27B, Llama 3.3 70B, Llama 4 Scout, DeepSeek R1, Mistral Small 24B, and more. Use list_llm_models to see the full catalog. Rate-limited to prevent abuse.

Parameter	Type	Required	Notes
prompt	string	yes	The user prompt / instruction to send to the model
model	string	no	Model ID (default: "openai/gpt-oss-20b"). Server-keyed whitelist only — Groq: openai/gpt-oss-20b, openai/gpt-oss-120b, qwen/qwen3.6-27b; HuggingFace: Qwen/Qwen3-32B, meta-llama/Llama-3.3-70B-Instruct,
system	string	no	Optional system prompt to set context or persona
temperature	number	no	Sampling temperature 0.0–1.5 (default: 0.7)
max_tokens	number	no	Maximum tokens to generate (default: 2048, max: 4096)

Evaluate RAG retrieval quality: rank passages against a query and compute Precision@k / Recall@k plus a PASS/FAIL CI verdict from ground-truth relevance labels. Three modes, all keyless except the last. (1) BYO scores — give each passage the score your own reranker produced (Cohere, Jina, a self-hosted NIM, a cross-encoder): deterministic, offline, and it evaluates YOUR reranker rather than some

Parameter	Type	Required	Notes
query	string	yes	The search query or question to rank against
passages	array	yes	Array of passage objects to rank (min 2, max 20)
top_k	integer	no	k for Precision@k evaluation (default 3)
threshold	number	no	Minimum Precision@k to PASS (0-1, default 0.5)
api_key	string	no	Your NVIDIA API key (BYOK), used only when no passage carries a score. Transits RAM for the single call, never stored.

Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel: hallucination detection (grounding score), prompt injection scan on BOTH the response and the original prompt (reported separately as checks.injection / checks.injection_prompt, scored once at the worse of the two), toxicity scan, output v

Parameter	Type	Required	Notes
response	string	yes	The LLM-generated response to analyze
source	string	no	Optional reference/source text for hallucination grounding check
prompt	string	no	Optional original prompt. Used for quality scoring AND scanned for prompt injection in its own right (checks.injection_prompt) — pass it whenever you have it, it is where the attack actually lands.
rules	array	no	Optional guardrail rules array (same format as guardrail_test tool)
model	string	no	LLM model for AI-powered deep analysis (default: "openai/gpt-oss-20b"). Set to "none" to skip LLM check. Supports any model from list_llm_models.

Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-h

Parameter	Type	Required	Notes
url	string	no	Optional. Full public URL to check (e.g. https://example.com). Omit it entirely when using headers. The server cannot reach localhost/private IPs.
headers		no	Optional, and sufficient on its own (no url needed). The response headers to grade, either as an object {"strict-transport-security": "max-age=...", ...} or as the raw header block pasted as a string

Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key exchange info, and an overall grade (A+, A, B, C, F). Detects expired, self-signed, and weak certificates. Use this to audit TLS posture before production deployment or during security reviews.

Parameter	Type	Required	Notes
host	string	yes	Hostname to check (e.g. example.com). Do not include https:// prefix.
port	number	no	Port number (default: 443)

Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) requests with various Origin headers to detect: wildcard origins with credentials, origin reflection (echoing any origin), null origin acceptance, subdomain wildcard bypass, and missing Vary headers. Returns risk level (safe/low/medium/high/critical) plus per-origin results. "unknown" means nothing was actually tested — every origin

Parameter	Type	Required	Notes
url	string	yes	Full URL to test (e.g. https://api.example.com/endpoint)
origin	string	no	Custom Origin header to test (default: tests multiple origins automatically)

Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the preflight OPTIONS response. Use this for direct CORS debugging, not just security auditing.

Parameter	Type	Required	Notes
url	string	yes	Full URL to test, e.g. https://api.example.com/resource
origin	string	no	Origin header to simulate (default: https://yourdomain.com)
method	string	no	HTTP method to simulate (default: GET)

Create a temporary webhook endpoint that captures incoming HTTP requests for one hour. Returns the webhook id, public URL, expiration timestamp, and current request count. Use together with webhook_endpoint_requests to inspect captured payloads.

Parameter	Type	Required	Notes
base_url	string	no	Optional public base URL. Default: https://www.ia-qa.com/mcp/webhook (the apex ia-qa.com answers 301 and a redirected POST loses its body, so an apex base_url is normalized to www)

Fetch the requests captured by a webhook created with webhook_endpoint_create. Returns the newest requests first with method, headers, query params, body payload, and timestamps.

Parameter	Type	Required	Notes
id	string	yes	Webhook id returned by webhook_endpoint_create
limit	number	no	Maximum number of requests to return (1-100, default: 20)

Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path scope, Max-Age/Expires, __Host-/__Secure- prefixes. Flags insecure patterns: missing HttpOnly on session cookies, missing Secure flag, SameSite=None without Secure, overly broad Domain, and excessive TTL. Returns per-cookie grades and an o

Parameter	Type	Required	Notes
url	string	yes	Full URL to audit (e.g. https://example.com/login)

Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrates security_headers_check + ssl_certificate_check + cors_test + cookie_security_audit in parallel, merges all findings, then asks an AI model to: (1) rank vulnerabilities by real-world exploitability, (2) generate a remediation roadmap, (3)

Parameter	Type	Required	Notes
url	string	yes	Full URL to audit (e.g. https://example.com)
model	string	no	LLM model for AI analysis (default: "openai/gpt-oss-20b"). Set to "none" to skip AI analysis.
api_key	string	no	Your Groq or HuggingFace API key. Required to enable AI analysis.

Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line number, and a redacted preview. Use before committing code, sharing logs, or sending text to an LLM

Parameter	Type	Required	Notes
input	string	yes	Text or code to scan for secrets
types	string	no	Comma-separated families to scan (default: all): aws, gcp, azure, openai, anthropic, huggingface, github, gitlab, stripe, slack, twilio, sendgrid, jwt, private_key, connection_string, bearer, basic_au

Compute text similarity between reference and hypothesis using multiple metrics: Cosine (BoW, TF-IDF), Jaccard, ROUGE-1, ROUGE-2, ROUGE-L, and BLEU. No API key needed. Ideal for LLM eval (expected vs actual), RAG quality checks, and NLG benchmarking. Supports batch mode.

Parameter	Type	Required	Notes
reference	string	no	Reference / expected text (ground truth)
hypothesis	string	no	Hypothesis / actual text (LLM output)
metrics	array	no	Metrics to compute (default: all). Options: "cosine_bow", "cosine_tfidf", "jaccard", "rouge1", "rouge2", "rougeL", "bleu"
batch	array	no	Batch mode: array of {reference, hypothesis} pairs.
threshold	number	no	Optional pass/fail threshold (0-1). Applies to ROUGE-L F1 score.

Generate a "needle in a haystack" test: embeds a target fact into a large block of filler text at a specified position. Use this to test LLM context window retrieval accuracy. Returns the full haystack, the question to ask, and metadata. No API key needed.

Parameter	Type	Required	Notes
needle	string	yes	The fact to hide (e.g. "The secret code is ALPHA-42")
question	string	yes	The question to ask the LLM (e.g. "What is the secret code?")
tokens	integer	no	Target haystack size in tokens (default: 5000, max: 100000)
position	string	no	Where to insert the needle: "start", "middle", "end", "random" (default: "middle")

Compress an LLM prompt by removing filler words, verbose phrases, duplicate sentences, and unnecessary whitespace. Returns optimized text with token savings breakdown. 100% deterministic, no API key needed.

Parameter	Type	Required	Notes
text	string	yes	The prompt text to optimize
options	object	no	Toggle optimization steps (all true by default)

Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score (0-100), sentiment analysis per variant, pairwise Jaccard similarity, and a human-readable verdict. No API key needed — runs entirely locally.

Parameter	Type	Required	Notes
responses	array	yes	Array of variant responses to compare for bias

Find the best LLM for a given use case. Compares 30+ cloud API models and 12+ local models by cost, speed, benchmarks, features and VRAM requirements. Returns ranked recommendations with cost simulation. No API key needed.

Parameter	Type	Required	Notes
use_case	string	no	Primary use case: chatbot \| code \| rag \| summarization \| classification \| reasoning \| agents \| multilingual
features	array	no	Required features: vision, function_calling, json_mode, streaming, reasoning
max_budget	number	no	Maximum monthly budget in USD (based on tokens_per_day)
tokens_per_day	number	no	Estimated daily token volume (default: 100000)
mode	string	no	cloud (API models) or local (Ollama/self-hosted). Default: cloud
vram_gb	number	no	GPU VRAM in GB (only for mode=local). Default: 16
quantization	string	no	Quantization (only for mode=local): Q4_K_M \| Q8_0 \| FP16. Default: Q4_K_M
top_n	number	no	Number of recommendations to return (default: 5)

Diff a baseline page mapping against a current one and return a CI-style verdict: PASS / FIX / BLOCK, plus per-element drift (ok, renamed, healable, ambiguous, lost, added, rebound). Pure and deterministic — provide two mappings as JSON with "elements" arrays of {role, name, selector, context?}. Use the companion @ia-qa/self-healing package (npm install -g @ia-qa/self-healing) to capture mappings

Parameter	Type	Required	Notes
before	object	yes	Baseline page mapping: { page, url, capturedAt, elements: [{role, name, selector, context?}] }. Captured before a UI change.
after	object	yes	Current page mapping: same shape as before, captured after the UI change.

Get a ready-made selector-drift test case with a known-correct answer, for testing this MCP server or an agent workflow end to end. Each scenario is a real DOM capture of a deliberately breakable app, taken before and after one specific UI change (a renamed label, two swapped buttons, a duplicated locator, an element moved behind a menu…), plus the verdict those two contracts MUST produce. Call wi

Parameter	Type	Required	Notes
scenario	string	no	Scenario id. Omit to list every available scenario with its expected verdict. Ids: no-change, swap-label, add-testid, duplicate-role-name, remove-element, insert-sibling, rename-label, counter-label,
include_html	boolean	no	Include the generated HTML of the mutated page (default false). Only useful if you want to render or re-capture it yourself; the loop does not need it.

Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this when you are unsure which tool to use or want to explore the catalogue. Categories: data, encoding, text, llm, qa, rag, dev, security, web.

Parameter	Type	Required	Notes
query	string	yes	Keyword(s) to search in tool name and description (e.g. "cors", "token", "vector", "json")
category	string	no	Optional: filter by category — data \| encoding \| text \| llm \| qa \| rag \| dev \| security \| web
with_schema	boolean	no	Set true to include inputSchema in results (default: false)
max_results	number	no	Maximum tools to return (default 10, max 50). Results are ranked by IDF-weighted relevance, so common words like "test" do not inflate the list.

Discover .ia-eval.yaml LLM test suite files in the project directory. Scans CWD and standard sub-directories (evals/, tests/, contracts/). Returns file paths ready to pass to run_eval_contract.

Parameter	Type	Required	Notes
dir	string	no	Directory to scan (defaults to server CWD)

Parse a .ia-eval.yaml LLM test suite, call the specified LLM model for each scenario, run all configured scorers, and return a structured JSON report with per-scenario Pass/Fail verdicts and a Markdown summary. Use list_local_tests to discover available test files.

Parameter	Type	Required	Notes
contract_path	string	no	Absolute or relative path to a .ia-eval.yaml file (required unless inline_contract is provided)
inline_contract	object	no	Raw contract object (alternative to contract_path). Must contain top-level "metadata" ({name, version, model?, provider?}), "expectations" ({min_score?}), and "scenarios" ([{id, input, ground_truth?}]
api_keys	object	no	API keys to use for LLM generation (all optional — falls back to server env vars)
overrides	object	no	Override contract defaults

Convert a run_eval_contract() LLM Test Runner JSON result into a fully self-contained dark-themed HTML report with Pass/Fail badges, side-by-side Input/Output/Ground-Truth panels, evaluator score bars, and a radar chart. Returns the HTML as a string.

Parameter	Type	Required	Notes
results	object	yes	The JSON object returned by run_eval_contract()

Run a test suite against a Vision-Language Model (VLM) — send an image (URL or base64) + N test cases (each with a question + assertion) to GPT-4o, Claude 3.5, or Gemini. Returns per-case PASS/FAIL verdicts, a pass rate, an overall PASS/WARNING/FAIL verdict (customizable threshold), and latency stats. Assertion types: contains, not_contains, json_format, min_length, max_length, semantic_contains (

Parameter	Type	Required	Notes
image_url	string	no	Public URL of the image to evaluate (required unless image_base64 is provided).
image_base64	string	no	Base64-encoded image data (required unless image_url is provided).
image_mime_type	string	no	MIME type of the image if using image_base64 (default: image/jpeg).
system_prompt	string	no	Optional system prompt sent to the VLM.
threshold	number	no	Pass rate threshold for overall verdict (default: 80, 0–100).
model	string	yes	VLM model to use.
api_key	string	yes	API key for the model provider (OpenAI sk-, Anthropic sk-ant-, or Google AIzaSy...).
test_cases	array	yes	Array of test cases to run.

Unified tool for multimodal AI evaluation: set action=guide for reference thresholds/interpretation (CLIP, FID, VQA), or set action=clip_score / fid_score / vqa_accuracy / pipeline to compute real metrics via HuggingFace Inference API and VLM BYOK calls. One tool for both reference and computation.

Parameter	Type	Required	Notes
action	string	no	guide (default) = reference thresholds/interpretation. clip_score/fid_score/vqa_accuracy = compute that metric. pipeline = run all three.
metric	string	no	[guide only] Metric to explain.
score	number	no	[guide only] Optional score value to interpret.
image_url	string	no	[clip_score/vqa_accuracy] Public URL of the image.
text	string	no	[clip_score only] Text description to compare against the image.
image_base64	string	no	[clip_score/vqa_accuracy] Base64-encoded image data.
image_mime_type	string	no	[clip_score/vqa_accuracy] MIME type for base64 image.
system_prompt	string	no	[vqa_accuracy] Optional system prompt.
model	string	no	[vqa_accuracy] VLM model ID (default: gpt-4o).
api_key	string	no	[vqa_accuracy] Your API key for the provider (BYOK).
test_cases	array	no	[vqa_accuracy] Array of {question, accepted_answers} objects.
real_images	array	no	[fid_score] Array of real image URLs.
generated_images	array	no	[fid_score] Array of generated image URLs.
clip	object	no	[pipeline] {image_url, text} for CLIP.
vqa	object	no	[pipeline] VQA config object (same inputs as vqa_accuracy).
fid	object	no	[pipeline] {real_images, generated_images} for FID.

Compare multiple VLMs on the same test suite in parallel — send an image (URL or base64) + N test cases to all models simultaneously. Returns per-model PASS/FAIL verdicts, pass rates, latency stats, and a comparison table. Assertion types: contains, not_contains, json_format, min_length, max_length, semantic_contains. BYOK: requires API keys for each provider.

Parameter	Type	Required	Notes
image_url	string	no	Public URL of the image to evaluate (required unless image_base64 is provided).
image_base64	string	no	Base64-encoded image data (required unless image_url is provided).
image_mime_type	string	no	MIME type of the image if using image_base64 (default: image/jpeg).
system_prompt	string	no	Optional system prompt sent to every VLM.
threshold	number	no	Pass rate threshold for overall verdict (default: 80, 0–100).
models	array	yes	Array of model IDs to compare (runs in parallel).
api_keys	object	yes	Map of model ID → API key. Example: { "gpt-4o": "sk-...", "claude-3-5-sonnet-20241022": "sk-ant-..." }
test_cases	array	yes	Array of test cases to run against every model.

Generate a complete .ia-eval.yaml evaluation contract from a plain-language description of what your LLM should do. Uses Groq openai/gpt-oss-20b (server-side, no API key needed). Returns ready-to-run YAML for the LLM Test Runner (run_eval_contract). Picks appropriate evaluators (cosine_similarity, contains_check, hallucination_check, etc.) based on the task type.

Parameter	Type	Required	Notes
description	string	yes	Plain-language description of what the LLM under test should do. Be specific: describe inputs, expected behaviour, and constraints.
system_prompt	string	no	Optional system prompt of the LLM under test. Helps generate more accurate test cases.
scenario_count	number	no	Number of scenarios to generate (default: 5). Covers happy path + edge cases + adversarial.
task_type	string	no	Optional task type hint to guide evaluator selection.

Generate a ready-to-commit GitHub Actions workflow that gates a build on IA-QA. Two gate types, combinable: "eval_contract" runs a .ia-eval.yaml through ia-qa-com/eval-action@v1 (LLM quality gate, needs a provider API key as a repo secret), and "cli_checks" runs deterministic primitives via npx @ia-qa/cli (secret scan, prompt-injection scan, security headers…) whose exit code fails the build. Dete

Parameter	Type	Required	Notes
gate	string	no	Which gate to emit. eval_contract = LLM eval via the action (default). cli_checks = deterministic CLI assertions. selector_drift = an E2E selector-drift gate via @ia-qa/self-healing (boots the app, ca
contract_path	string	no	Path to the .ia-eval.yaml contract, relative to the repo root (default: evals/smoke.ia-eval.yaml). Only used when the gate includes eval_contract.
provider	string	no	LLM provider the contract runs against — decides which repository secret the workflow wires (default: groq).
cli_tools	array	no	IA-QA tool names to run as deterministic gates, e.g. ["secret_scan","prompt_injection_scan"]. Tools with no known CI recipe get a --stdin step flagged in notes.
triggers	array	no	Workflow triggers (default: push + pull_request).
cron	string	no	Cron expression when triggers include 'schedule' (default: '0 6 * * 1' — Mondays 06:00 UTC).
min_score	number	no	Override the contract min_score (0-100). Omit to use the value in the contract.
fail_on_fail	boolean	no	Fail the build on a FAIL/PARTIAL verdict (default: true). Set false to report without gating.
workflow_name	string	no	Workflow display name (default: "IA-QA Quality Gate").
node_version	string	no	Node version for the CLI steps (default: "20").
app_start_command	string	no	Command that boots the app for the selector_drift gate, e.g. "npm run start:ci". Cannot be guessed — omitted, the step carries an explicit TODO and the note says so, because a plausible default would
app_base_url	string	no	URL the drift gate waits for before capturing (default: http://127.0.0.1:3000). Must match config.baseUrl in .ia-qa/config.json.

Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs). No LLM call — deterministic. Assertion types: order (tool A before B), must_call, must_not_call, max_calls, min_calls, no_error, recovery (agent completes a successful step after its last error). A step counts as errored when the trace says

Parameter	Type	Required	Notes
trace		yes	Agent execution trace as JSON (OpenAI messages array, LangChain run tree) or plain text log (Thought/Action/Observation format).
assertions	array	yes	List of assertions to validate against the trace.
format	string	no	Trace format. auto (default) detects automatically.

Semantic assertion primitive: compare actual vs expected text pairs using cosine similarity + ROUGE-L. Two modes: tfidf (default, free, no API key) or embeddings (OpenAI text-embedding-3-small, BYOK, true semantic similarity). Returns per-case PASS/FAIL verdicts and an overall verdict. CI-ready: pipe the JSON verdict field to gate a build.

Parameter	Type	Required	Notes
cases	array	yes	Array of (actual, expected) pairs to evaluate.
thresholds	object	no	Pass/fail thresholds (defaults: cosine 0.75, rouge_l 0.5).
require_all	boolean	no	If true (default), all cases must pass for overall PASS. If false, at least one case passing returns PASS.
mode	string	no	tfidf (default): fast, free, lexical. embeddings: OpenAI text-embedding-3-small, true semantic similarity, requires api_key.
api_key	string	no	OpenAI API key — required only when mode is embeddings.

Reference-free stability primitive: instead of comparing an answer to a ground truth, it checks that an assistant's answer stays INVARIANT when the QUESTION is transformed (typo, casing, paraphrase, reordering, translation). Catches the failure class no reference answer can expose — an assistant that handles one phrasing well and a trivial variant of it badly. You bring the outputs (no model is ca

Parameter	Type	Required	Notes
base	object	yes	The reference run: the original question and the answer your system produced for it.
variants	array	yes	Answers produced for transformed versions of the same question, each tagged with the relation that was applied.
mode	string	no	tfidf (default): free, lexical, deterministic — but a genuine paraphrase rarely reaches 0.80, so gate on case/typo and treat paraphrase as a trend. embeddings: OpenAI text-embedding-3-small, true sema
api_key	string	no	OpenAI API key — required only when mode is embeddings.
thresholds	object	no	Per-relation threshold overrides. Calibrate on your own corpus before gating — the defaults are starting points, not measurements.
baseline_guard	object	no	Correctness floor applied to the BASE answer before anything is scored. Failing it returns INVALID, not FAIL.
require_all	boolean	no	If true (default), every gated variant must pass. KEEP THE DEFAULT for any run you gate on. Setting it false is not a tolerance dial but an off switch: relations have asymmetric pass rates (a typo var

Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd,

Parameter	Type	Required	Notes
topic	string	no	The testing topic to retrieve guidelines for. Omit to get the start-here map and the full list of available topics.

Validate a SKILL.md definition (Cursor / GitHub Copilot / Windsurf) by auto-generating trigger-positive and trigger-negative scenarios, running each through the model with the skill injected as a system prompt, and scoring trigger accuracy + step adherence. Returns a PASS/FIX/BLOCK verdict with per-scenario breakdown. Uses Groq llama-3.3-70b by default (server key, no api_key needed). Pass api_key

Parameter	Type	Required	Notes
skill_md	string	yes	Full content of the SKILL.md file to test. Must include a name, a "Use when:" trigger description, and at least one step.
scenario_count	number	no	Number of test scenarios to generate: half trigger-positive, half trigger-negative. Default: 6.
model	string	no	LLM model ID to use for both scenario generation and testing (e.g. gpt-4o-mini, claude-3-5-haiku-20241022). Defaults to openai/gpt-oss-20b (Groq, server key).
api_key	string	no	API key for the chosen model provider. Not required when using the default Groq model.

Returns what the server knows about the current MCP client: clientInfo captured during initialize, User-Agent, and any _meta fields sent with this request. Useful for debugging caller identification.

Parameter	Type	Required	Notes
_meta	object	no	Optional self-identification. Keys: agent (string), model (string), version (string).

Parse a YAML string and return the equivalent JSON value. The reverse of json_to_yaml. Supports nested objects, arrays, anchors, aliases, multi-document streams, and all scalar types. Use when processing config files, CI/CD pipeline definitions, or OpenAPI specs authored in YAML.

Parameter	Type	Required	Notes
input	string	yes	YAML string to parse
multi	boolean	no	If true, parse all documents in a multi-document stream and return an array (default: false)

Parse a .env file content into a JSON object. Handles quoted values (single and double), inline comments, export prefix, and escaped sequences ( , inside double quotes). Returns all key-value pairs. Use in CI/CD pipelines, agent config loaders, or when processing dotenv files programmatically.

Parameter	Type	Required	Notes
input	string	yes	.env file content to parse (e.g. the output of cat .env)

Infer a JSON Schema (draft-07) from a sample JSON value. Detects types, required fields, array item shapes, nested objects, and common string formats (email, uri, date, date-time, uuid). Returns a ready-to-use schema compatible with json_schema_validate. Use when you have a sample API response or LLM output and want to auto-generate a validation schema for CI/CD testing.

Parameter	Type	Required	Notes
input	string/object/array	yes	The sample JSON value to infer the schema from — a JSON string, or the value itself.
required_all	boolean	no	Mark all detected object properties as required (default: true)

Convert a JSON array of objects into a Markdown table. Automatically detects columns, aligns headers, and fills missing keys with empty cells. Use when an agent needs to present structured data — tool results, model comparisons, test reports — as a readable table in a response or document.

Parameter	Type	Required	Notes
input	string/object/array	yes	The array of objects to render — a JSON string, or the array itself.
columns	array	no	Column names and order (default: all keys from first row)

Validate the structure of an OpenAPI 3.x specification (JSON or YAML). Checks required top-level fields (openapi, info.title, info.version, paths), validates each operation (responses, operationId uniqueness), detects undeclared $ref components, and flags missing 2xx responses. Returns a PASS/FAIL verdict, a 0–100 compliance score, and a list of errors and warnings with JSON-pointer locations. Use

Parameter	Type	Required	Notes
input	string/object/array	yes	The OpenAPI 3.x spec — a JSON string, a YAML string, or the already-parsed spec object.

Post the output of jira_to_test_suite as a formatted comment on the source Jira ticket. Converts Gherkin, E2E steps, API tests, and ambiguities into Atlassian Document Format (ADF). STATEFUL — creates a comment on the issue.

Parameter	Type	Required	Notes
issue_key	string	yes	Jira issue key, e.g. "PROJ-123"
jira_base_url	string	yes	Atlassian base URL
jira_email	string	yes	Atlassian account email
jira_token	string	yes	Atlassian API token
test_suite	object	yes	The test_suite object from jira_to_test_suite result

Create a new Confluence page from the output of jira_to_test_suite. Formats Gherkin, E2E steps, API tests, and test data as a properly structured Confluence page with code blocks and tables. STATEFUL — creates a new page in the specified space.

Parameter	Type	Required	Notes
confluence_base_url	string	yes	Atlassian base URL
confluence_email	string	yes	Atlassian account email
confluence_token	string	yes	Atlassian API token
space_key	string	yes	Confluence space key where the page will be created, e.g. "QA", "ENG"
title	string	no	Page title. Defaults to "Test Plan: {issue_key}"
parent_page_id	string	no	Optional parent page ID — page will be created as a child of this page
test_suite	object	yes	The test_suite object from jira_to_test_suite result
issue_key	string	no	Source Jira issue key (for the page title and source link)
issue_url	string	no	Source Jira issue URL (added as a link in the page)

Fetch a complete Jira issue: summary, description converted to Markdown, status, assignee, priority, labels, custom fields, and optionally comments and attachment metadata. BYOK — credentials transit in-memory only, never stored on ia-qa.com.

Parameter	Type	Required	Notes
issue_key	string	yes	Jira issue key, e.g. "PROJ-123"
jira_base_url	string	yes	Atlassian base URL, e.g. "https://mycompany.atlassian.net"
jira_email	string	yes	Atlassian account email
jira_token	string	yes	Atlassian API token (from id.atlassian.com > Security > API tokens)
fields	array	no	Specific Jira field names to return. Omit for all standard fields.
include_comments	boolean	no	Include issue comments, up to 20 (default: true)
include_attachments	boolean	no	Include attachment metadata list (default: false)

Search Jira using JQL (Jira Query Language). Returns matching issues with key fields. Ideal for finding open bugs, sprint tickets, or issues by label/assignee/component. BYOK — credentials transit in-memory only, never stored.

Parameter	Type	Required	Notes
jql	string	yes	JQL query string, e.g. "project = PROJ AND status = Open AND assignee = currentUser() ORDER BY priority DESC"
jira_base_url	string	yes	Atlassian base URL, e.g. "https://mycompany.atlassian.net"
jira_email	string	yes	Atlassian account email
jira_token	string	yes	Atlassian API token
max_results	number	no	Max issues to return (default: 10, max: 50)
fields	array	no	Fields per issue. Default: summary, status, assignee, priority, issuetype, labels, created, updated

Transform a Jira ticket into a complete test suite: Gherkin scenarios, E2E steps, API test cases, test data matrix, and ambiguity detection. Accepts either Jira credentials (auto-fetch) or a pre-fetched issue object. The returned test_suite includes _gherkin_warnings (deterministic syntax validation — empty if clean). Requires BYOK LLM key (OpenAI, Anthropic, etc.).

Parameter	Type	Required	Notes
issue_key	string	no	Jira issue key to fetch automatically, e.g. "PROJ-123". Required if issue is not provided.
jira_base_url	string	no	Atlassian base URL. Required for auto-fetch mode.
jira_email	string	no	Atlassian account email. Required for auto-fetch mode.
jira_token	string	no	Atlassian API token. Required for auto-fetch mode.
issue	object	no	Pre-fetched issue object from fetch_jira_issue, OR a mock object with fields: key, summary, description (plain text or Markdown), status, issue_type, priority, labels, comments. Use this for offline/C
confluence_pages	array	no	Optional array of pre-fetched Confluence page objects from fetch_confluence_page, used as documentation context.
api_key	string	yes	Your LLM provider API key (OpenAI sk-, Anthropic sk-ant-, Google AIzaSy-, etc.).
model	string	yes	LLM model to use, e.g. "gpt-4o-mini", "claude-3-5-haiku-20241022", "gemini-2.0-flash".
max_tokens	integer	no	Maximum tokens for the LLM response. Default: 8192. Increase for large tickets with many ACs; decrease to reduce cost on simple tickets.

Fix Gherkin syntax warnings from a jira_to_test_suite result. Takes the current gherkin text and the _gherkin_warnings array, calls your LLM to fix ONLY the flagged issues (adds missing Given/When/Then steps, etc.), and returns the corrected Gherkin. Lightweight — uses ~300-500 tokens vs ~5k for a full regeneration. Requires BYOK LLM key.

Parameter	Type	Required	Notes
gherkin	string	yes	The current Gherkin text from the jira_to_test_suite result (test_suite.gherkin).
warnings	array	yes	The _gherkin_warnings array from the jira_to_test_suite result.
api_key	string	yes	Your own LLM provider API key (BYOK) — OpenAI "sk-…", Anthropic "sk-ant-…", Google "AIzaSy…", or Groq "gsk_…". There is no server-side key for this tool: if you do not have one, do not call it and do
model	string	yes	LLM model to use for the fix, e.g. "gpt-4o-mini". Must belong to the provider whose key you passed in api_key.

Fetch a Confluence page and return its content as clean Markdown. Accepts a numeric page_id or a full page URL. Optionally lists direct child pages. BYOK — credentials transit in-memory only, never stored.

Parameter	Type	Required	Notes
page_id	string	no	Confluence page ID (numeric string), e.g. "123456789"
page_url	string	no	Full Confluence page URL (alternative to page_id), e.g. "https://mycompany.atlassian.net/wiki/spaces/ENG/pages/123456789"
confluence_base_url	string	yes	Atlassian base URL, e.g. "https://mycompany.atlassian.net"
confluence_email	string	yes	Atlassian account email (same credentials as Jira)
confluence_token	string	yes	Atlassian API token
include_children	boolean	no	List direct child pages (id + title) (default: false)

Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high (4-5) only if it genuinely solved your need. Ratings are aggregated on a public dashboard at /devtools/mcp-ratings. Skip rating routine successes — we want signal, not praise. Example: rate_tool({ tool_name: "format_json", score: 2, commen

Parameter	Type	Required	Notes
tool_name	string	yes	Name of the MCP tool to rate (e.g. "format_json", "shield_analyze")
score	number	yes	Rating from 1 (poor) to 5 (excellent)
comment	string	no	Strongly encouraged — explain what you were trying to do and whether the tool got you there. Be specific about what was missing, wrong, or a poor fit. This is the most valuable part of the rating. Up

Where are you running it?

Tool surface

Release history

IA-QA — 130+ QA & Dev Tools for AI Agents MCP

What it does

Quickstart

Where are you running it?

Tool surface

What counts against your monthly calls

Release history

See also