Name: QuassLabs API
Author: quasslabs

QuassLabs API MCP

30+ deterministic dev and delivery tools: linting, metrics, diagrams, model advice, AI-text checks.

Tool-list grade A Remote · Streamable HTTP API key 30 tools v0.4.0

No reviews yet by quasslabs The publisher’s own endpoint — this marketplace is not in the path

96/100

tool-list score

tools declared

remote

at its publisher

—

calls last 7d

What it does

30+ deterministic dev and delivery tools: linting, metrics, diagrams, model advice, AI-text checks.

Quickstart

# 1 — add it to Claude Code
claude mcp add --scope user --transport http quasslabs-api-mcp https://api.quasslabs.com/mcp --header 'Authorization: Bearer ${AUTHORIZATION}'

# 2 — ask your agent for something these tools do
#   alignment_gate, blm_land_lookup, diagram_contrast and 27 more

It needs AUTHORIZATION (Bearer qlk_... API key from https://quasslabs.com/api, or from the account tool's signup action (needed for tools/call, except account signup and…): this sends it in the Authorization header from your environment, so export it first — its endpoint answers 401 without it.

QuassLabs API costs nothing on mcprush: there is no plan to choose here, no cap to set and nothing mcprush can bill you for.

Publishernot claimed

quasslabs1 server

1 category

All 1 server

Collected from a public index. Nobody has claimed this account, so nothing here was written by its author — claim it if it is yours.

Installation

Where are you running it?

Every route below installs the same thing and ends at the same approval screen. Nothing here runs on your machine and nothing runs on ours: this server answers at its publisher’s own address, and what you install is the connection straight to it.

Claude Codedeclared by this listing

This is a public server: it answers at its publisher’s own address and this marketplace is not in the path. Claude Code registers it in one command; --scope user makes it available in every project. The transport below is http, as the publisher's own manifest declares it. Claude Code reads AUTHORIZATION (Bearer qlk_... API key from https://quasslabs.com/api, or from the account tool's signup action (needed for tools/call, except account signup and…) from your environment each time it connects and sends it in the Authorization header — its endpoint answers 401 without it — so the key stays out of its config: export it in your shell profile (macOS, Linux), or run setx AUTHORIZATION … and open a new terminal (Windows).

claude mcp add --scope user --transport http quasslabs-api-mcp https://api.quasslabs.com/mcp --header 'Authorization: Bearer ${AUTHORIZATION}'

Reconnect, or start a new session, and the tools appear in the model’s tool list.

Free on mcprush, and it answers at its publisher’s own address: this marketplace is not in the path, so there is no key of ours to hold and no card to add — but its publisher asks for a key of their own on every call.

What it asks of you

Nothing is required, but it can take Authorization header (Bearer qlk_... API key from https://quasslabs.com/api, or from the account tool's signup action (needed for tools/call, except account signup and checkout_status)) if you want to set it.

What it writes

One config entry pointing straight at the publisher’s own address — this marketplace is not in the path, and nothing from this listing executes on your machine.

What you approve

30 tools, with what each one reads, writes and reaches shown before you agree — the same list on every route above. Read the tool surface.

Tool surface

What the model actually sees. Descriptions are diffed on every release — see version history.

Only tools that write or reach the network

Run an AI system prompt (and optional agent config) through a 45-criterion alignment/safety rubric. Returns a letter grade (A-F), numeric score, per-flag remediation, and a pass/fail verdict.

Parameter	Type	Required	Notes
system_prompt	string	yes	The system prompt text to evaluate.
agent_config	object	no	Optional agent config (tools, memory, temperature, etc.).
model_id	string	no	Optional target model identifier.

Look up Bureau of Land Management land status for a US coordinate: BLM ownership, jurisdiction, allowed activities (rockhounding, camping), permit requirements, and special designations (ACEC, Wilderness, WSA, NM/NCA).

Parameter	Type	Required	Notes
lat	number	yes	Latitude, -90 to 90.
lon	number	yes	Longitude, -180 to 180.
radius_km	number	no	Optional buffer radius in km (0-50, default 1.0).

Diagram quality QA. Catch and fix the things that ruin diagrams: (1) unreadable label contrast - POST a mermaid/SVG or HTML diagram, get every WCAG-AA failure (incl. mermaid <style>-block label colors, with unresolvable fills flagged honestly, not false-passed) + auto-corrected colors; (2) harden a mermaid SOURCE before it renders - rewrites every fill/label pair and remaps fills no label color ca

Parameter	Type	Required	Notes
mode	string	no	Default "scan". scan=check rendered output; harden=fix a mermaid source before rendering; print=print-safety check; layout=arrow-crossing reduction.
content	string	no	scan/print: the SVG or HTML diagram/document source.
source	string	no	harden: the mermaid SOURCE text (not rendered SVG).
format	string	no	scan: content format (default svg).
autofix	boolean	no	scan: include suggested corrected colors.
add_init	boolean	no	harden: prepend the %%{init}%% theme block (default true).
fg	string	no	contrast: foreground hex (#rrggbb).
bg	string	no	contrast/readable: background/fill hex (#rrggbb).
large	boolean	no	contrast/harden: use the 3:1 large-text threshold.
brand	string	no	brand palette to use (e.g. appstango). Default from config.
renderer	string	no	layout: mermaid renderer (default "elk").

Detect AI-writing tells in text. POST prose and get a 0-1 ai_ness score + band (low/medium/high) + the EXACT patterns that fired (AI vocabulary, significance inflation, promotional language, filler phrases, negative parallelism, rule-of-three, em-dash overuse) with sample spans. Explainable, not an opaque classifier - every point is a named, located pattern. Deterministic, no LLM. The rewrite is a

Parameter	Type	Required	Notes
text	string	yes	The prose to score (up to 100k chars).

SaaS health advisor. POST your MRR/customers (+ optional churn/CAC/margin/growth) and get ARR/ARPA/LTV/CAC/payback/Rule-of-40/NRR/GRR computed, each with a health tag, plus an overall grade + a ranked "what to fix first" focus list. Deterministic math + advisory, no LLM.

Parameter	Type	Required	Notes
mrr	number	yes	—
customers	number	yes	—
prior_mrr	number	no	—
new_mrr	number	no	—
churned_mrr	number	no	—
expansion_mrr	number	no	—
cac	number	no	—
gross_margin_pct	number	no	—
sales_marketing_spend	number	no	—
new_customers	number	no	—

QA advisor: validate acceptance criteria quality. POST a list of AC (or a story) and get per-AC problems (vague/untestable, non-atomic, no observable outcome) + a missing-coverage flag if there is no failure-path AC, plus a 0-100 score and pass/needs_work verdict. Tells you exactly what to fix. Deterministic, no LLM.

Parameter	Type	Required	Notes
acceptance_criteria	array	no	—
story	string	no	—
strictness	string	no	—

Scope-completeness advisor. POST a brief (or requirements[]) + your stories[] and get a coverage score + the gaps (requirements no story covers), orphan stories (possible scope creep), and missing structural buckets (auth/CRUD/error-states/tests). Tells you what the scope is missing. Deterministic, no LLM.

Parameter	Type	Required	Notes
brief	string	no	—
requirements	array	no	—
stories	array	yes	—

Bug-triage advisor. POST one bug report (or a list) and get severity (critical/high/medium/low), category, whether it has repro steps, and what info is missing (no repro / no expected-vs-actual / no environment). For a list: priority ranking + likely-duplicate clusters. Deterministic, no LLM.

Parameter	Type	Required	Notes
report	string	no	—
reports	array	no	—

LLM selection + cost advisor. POST a task description (+ optional volume/tokens/constraints like local-only or cheap) and get a recommended model + fallback chain + do-not-use (with reasons), the complexity tier, and per-run + monthly cost. A maintained model+price catalog. Deterministic, no LLM. Tells the AI/user which model to use and what it costs.

Parameter	Type	Required	Notes
task	string	yes	—
volume_per_month	number	no	—
tokens_in	number	no	—
tokens_out	number	no	—
constraints	array	no	—
top_n	integer	no	How many ranked models to return as primary+fallbacks (rest land in also_considered). Default 1 = primary alone.
models	array	no	Optional allowlist - restrict ranking to only these model identifiers (e.g. models you already have access to). Any catalog model not in this list is excluded, listed in do_not_use.

Which QL-API endpoint fits this task. POST a task description and get the ranked endpoint(s) that best match, each with a confidence label (high/medium/low). Deterministic keyword matching over this platform's own endpoint catalog, no LLM. Pairs with model_advisor (which itself is one of the recommendable endpoints, so a "which model" task surfaces it) - call them independently and chain the resul

Parameter	Type	Required	Notes
task	string	yes	What you are trying to do.
context	string	no	Optional extra text to fold into matching - e.g. a prior model_advisor rationale, or more detail than fits in task.
top_n	integer	no	How many ranked endpoints to return. Default 1 = best match only.
tools	array	no	Optional allowlist - restrict matching to only these endpoint names.

Rewrite text to remove AI-writing tells. POST prose and get it back with the mechanical tells fixed (AI vocabulary swapped for plain words, filler phrases stripped, em-dash overuse reduced, significance inflation deflated) plus a change log, before/after ai-ness scores, and a residual list of tells that need human judgment (not auto-rewritten). Code fences, inline code, URLs, and quotes are never

Parameter	Type	Required	Notes
text	string	yes	The prose to rewrite (up to 100k chars).

Dependency-manifest hygiene check. POST package manifests (package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, composer.json, pubspec.yaml, lockfiles) or an upload_id and get findings with severity + concrete fixes: wildcard/unbounded versions, missing lockfiles, unpinned installs, non-https indexes, install-script risks, dependency-confusion signals, and matches against a static snap

Parameter	Type	Required	Notes
manifests	array	no	Up to 20 manifest files inline.
upload_id	string	no	Alternative: a single manifest uploaded via the uploads tool.
filename	string	no	Required with upload_id so the manifest type can be detected.

Generate a concrete audit-logging spec for an app. POST your feature list (and optional compliance targets: soc2/hipaa/gdpr/pci) and get a full audit-event catalog (namespaced event names, actor/target/required fields, PII flags, retention), a canonical event envelope schema, a storage plan (append-only, access control, alerting), and per-framework compliance notes. A dev team can implement it dir

Parameter	Type	Required	Notes
features	array	no	App features, e.g. ["user login", "payments", "file upload"].
compliance	array	no	—
description	string	no	Optional free-text app description (scanned for features).
stack	string	no	—

Analyze a log file. POST raw log text (or an upload_id from the uploads tool, up to 5MB) and get: level breakdown + time range, error clusters (messages normalized so variable ids/numbers collapse into one signature, with counts + first/last seen + a sample), a timeline, detected anomalies (error spikes, retry storms, new error signatures, log gaps/outages, level-ratio shifts) with evidence, and t

Parameter	Type	Required	Notes
text	string	no	Raw log content (up to 1M chars).
upload_id	string	no	Alternative: a log file uploaded via the uploads tool.
top_n	number	no	Top clusters to return (1-50, default 10).
format	string	no	—

Full Jira-ticket quality linter (whole ticket, not just AC - use acceptance_criteria_validator for the deep AC pass). POST one ticket or a batch (max 50) and get per-ticket findings with severity + concrete fixes: missing/weak summary or description, missing AC or estimate, bugs without repro/expected-vs-actual/environment, missing epic link, points-vs-hours mismatch, oversized estimates to split,

Parameter	Type	Required	Notes
ticket	object	no	One ticket: {key, summary, description, acceptance_criteria, issue_type, estimate_hours\|story_points, priority, labels, components, epic_link, ...}. Missing fields ARE findings.
tickets	array	no	Alternative: batch of up to 50 tickets.
profile	string	no	—

Deterministic structural quality linter for user stories - a sibling to ticket_lint but scoped to story-writing concepts any team recognizes: narrative completeness (As-a/I-want-to/So-that/Summary), acceptance criteria presence, duplicate/unknown dependency IDs, a "Manage X" story with no CRUD split, list stories missing a pagination mention. An OPTIONAL rate_config unlocks team-specific checks (s

Parameter	Type	Required	Notes
story	object	no	One story: {id, title, story: {as_a, i_want_to, so_that, summary, type_label?, on_screen?}, acceptance_criteria, dependencies?: [id], screen?, hours?: {<field>: number}, risk?, milestone_code?}. Missi
stories	array	no	Alternative: batch of up to 50 stories. Dependency/duplicate/required-companion checks are evaluated across the whole batch.
rate_config	object	no	Optional. Enables team-specific checks, all off by default.

Deterministic classifier for story/task hour estimates against benchmarks: flags each estimate in_range, borderline, over, under, or unbenchmarked. Supply either an explicit {min, max} range per type (benchmarks) or a list of historical actual hours per type (historical) that this endpoint derives a mean/stdev variance band from - explicit ranges win when both are given for the same type. No bench

Parameter	Type	Required	Notes
estimate	object	no	One item: {id?, type, hours}. type and hours are required.
estimates	array	no	Alternative: batch of up to 200 items.
benchmarks	object	no	Optional. Per type: {min?, max?}. Wins over historical for the same type.
historical	object	no	Optional. Per type: array of past actual hours (max 500 each), used to derive mean/stdev when no explicit benchmark exists for that type. Needs at least 2 values to produce a band.
borderline_z	number	no	Default 1.0. Stdevs from the historical mean before a result is "borderline" instead of "in_range".
flag_z	number	no	Default 2.0. Stdevs from the historical mean beyond which a result is "over"/"under" instead of "borderline". Must be >= borderline_z.

Deterministic PR description quality linter: flags a missing/too-short body, absent test evidence, absent stated rationale, an unstructured long body, and - only for PRs that look like bugfixes (title prefix fix/bug/hotfix/patch, or an explicit is_bugfix flag) - missing repro steps. Optionally requires a linked issue/ticket reference. Single PR only, no batch. Deterministic, no LLM.

Parameter	Type	Required	Notes
pr	object	yes	{title?, body?, is_bugfix?}. is_bugfix overrides title-based inference when supplied.
require_issue_link	boolean	no	Default false. When true, flags a missing issue/ticket reference in the title or body.

Deterministic commit-message hygiene checker: conventional-commit format, vague-subject detection, subject-length limit, a same-message secret-pattern scan (AWS keys, private key headers, Slack/GitHub tokens, inline password=/secret= style credentials - checked against the message text only, never a diff), and an oversized-commit warning from caller-supplied insertions/deletions. POST one commit o

Parameter	Type	Required	Notes
commit	object	no	One commit: {sha?, message, insertions?, deletions?}. message is required.
commits	array	no	Alternative: batch of up to 200 commits.
max_lines_changed	integer	no	Default 500. Total insertions+deletions above this triggers a large_commit finding.

Deterministic Flesch Reading Ease and Flesch-Kincaid Grade Level for a block of text, plus word/sentence/syllable counts and a plain-language reading-ease band (very_easy through very_confusing). Syllable counting is the standard vowel-group heuristic (same approximation used by textstat and most open readability tools), not a dictionary lookup. Optionally pass target_grade to get an on_target fla

Parameter	Type	Required	Notes
text	string	yes	Prose to analyze. Max 100,000 characters.
target_grade	number	no	Optional target Flesch-Kincaid grade level, 0-20.

Static safety analysis of a regular expression plus an English explanation of what it matches. Parses the pattern into an AST and flags the structures that cause catastrophic backtracking (ReDoS): nested unbounded quantifiers like (a+)+, repeated alternations whose branches can start with the same character like (a|ab)*, adjacent unbounded quantifiers over overlapping character sets like \d+\d+, a

Parameter	Type	Required	Notes
pattern	string	yes	The regular expression source, without delimiters. Max 2,000 characters.
flags	string	no	Optional inline flags, any of "imsxau" (ignorecase, multiline, dotall, verbose, ascii, unicode).

Sprint/delivery health advisor. POST 1-24 sprints (committed/completed points, optional per-ticket estimate-vs-actual data) and get computed metrics each with a good/warn/bad health tag: velocity avg + trend + stability, commitment reliability, spillover rate, mid-sprint scope change, estimate accuracy (median + chronic-overrun pct), and WIP concentration per assignee. Plus an overall grade and a

Parameter	Type	Required	Notes
sprints	array	yes	Oldest first: [{name, committed_points, completed_points, added_points?, spillover_points?, tickets?: [{key, estimate_hours, actual_hours, status, assignee}]}].
team_size	number	no	—
sprint_length_days	number	no	Default 10.

Worklog/timesheet policy checker - run a batch of worklog entries through configurable guardrails BEFORE posting them to a time-tracking system. Checks: rounding increment (default 0.25h, float-safe), per-entry min/max, per-author daily totals, duplicates, over-estimate alerts (never suggests inflating hours or estimates - flags to PM instead), future dates, weekends, immutable-author edit protect

Parameter	Type	Required	Notes
entries	array	yes	Up to 500: [{author, date "YYYY-MM-DD", hours, ticket?, description?, estimate_hours?, already_logged_hours?, id?, edit?, delete?, new?}].
today	string	yes	Reference date "YYYY-MM-DD" for future-date checks.
policy	object	no	Optional overrides: rounding_increment, max_hours_per_day, max_hours_per_entry, min_hours_per_entry, immutable_authors, require_description, require_ticket, over_estimate_policy (alert\|block\|ignore),

Get a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id. Two-step: call this, PUT your file to the returned url, then pass upload_id to the consuming endpoint. Uploads auto-expire in 1 day and are readable only by your key. Auth required; not billed.

Parameter	Type	Required	Notes
content_type	string	no	MIME type of the file you will PUT (e.g. text/plain, application/json). Default application/octet-stream.

Submit free-text feedback about the API - a bug, a feature request, a docs gap, a billing question, or anything else. Tied to your key so we can follow up, but not billed and not a support-ticket SLA. Auth required; not billed.

Parameter	Type	Required	Notes
message	string	yes	What you want us to know. Up to 4000 characters.
category	string	no	Defaults to "other".
severity	string	no	Optional. Omit if not applicable.
endpoint	string	no	Optional. Which /v1/* endpoint or MCP tool this is about, e.g. "/v1/ticket-lint".
contact_ok	boolean	no	Optional, defaults to false. Whether we may follow up with you about this.

Get a Stripe Checkout link to top up the credits on the API key you are calling with. Starter pack: $5 for 500 credits. Pro pack: $20 for 2500 credits. 1 credit = $0.01. Give the returned checkout_url to a human to complete payment in a browser; the credits are added to this key automatically once the payment succeeds, usually within seconds. Calling this tool does not charge anything and costs no

Parameter	Type	Required	Notes
pack	string	no	Which pack to buy. Defaults to "starter" ($5 / 500 credits). "pro" is $20 / 2500 credits.
packs	integer	no	How many of that pack. Defaults to 1.

Rate a specific prior metered call - thumbs up or down, plus an optional comment - keyed by the request_id that call's response reported. Scoped for now to rating compress calls, so you can tell us when a compression was too aggressive or dropped something it shouldn't have. Resubmitting the same request_id overwrites your previous rating rather than adding a second one. Auth required; not billed

Parameter	Type	Required	Notes
request_id	string	yes	The request_id from the response of the call you are rating.
rating	string	yes	—
comment	string	no	Optional. What was good or wrong about that call's result.

Scan package manifests, lockfiles, and MCP server configs for known supply-chain compromises. The only scanner treating MCP configuration as a security surface. Returns findings with severity and remediation.

Parameter	Type	Required	Notes
archive_base64	string	no	Base64-encoded ZIP of manifests/lockfiles/MCP configs.
archive_url	string	no	Presigned HTTPS URL to a ZIP (for large archives).
ecosystems	array	no	Optional ecosystem filter.

Turn a plain-English description into Mermaid diagram source. Describe the flow, system, schema or timeline you want ("a login flow with an OAuth branch and a failure path") and get back complete, valid Mermaid - no need to know the syntax. The mermaid field of the response is directly usable as the mermaid_source input of convert_diagram, so describe -> render is a two-call pipeline. Generation r

Parameter	Type	Required	Notes
description	string	yes	What the diagram should show, in plain language. Include the nodes/steps/entities you care about; the generator fills in sensible structure.
diagram_type	string	no	Force a specific Mermaid diagram type. Default "auto" - the generator picks the type that fits the description.

Make Mermaid diagrams portable. Takes HTML containing <div class="mermaid"> blocks (or a raw Mermaid source) and returns the same document with every diagram pre-rendered to inline SVG and the Mermaid CDN runtime stripped. A CDN-backed diagram only renders if the reader can fetch and run the runtime; inline SVG needs neither, so the output survives offline readers, email clients, Notion/Confluence

Parameter	Type	Required	Notes
html	string	no	HTML document or fragment containing <div class="mermaid"> blocks. Mutually exclusive with mermaid_source.
mermaid_source	string	no	A single raw Mermaid diagram source. Mutually exclusive with html.
output_format	string	no	Default "html". "svg" returns the raw inline SVG and requires mermaid_source.
inject_lightbox	boolean	no	Add click-to-enlarge overlay CSS+JS for small-text diagrams. Default false.
theme	string	no	Mermaid theme. Default "default".
background	string	no	"transparent" (default), "white", or a hex color.

Free

$0 forever

Every tool — any call limit is its publisher’s, not ours
No card, and mcprush charges nothing for it
Runs at its publisher’s own address — this marketplace is not in the path
Nothing to cap, because mcprush bills nothing

Nothing here is billable: mcprush charges nothing to install QuassLabs API or to call it, at any volume.

ATool-list grade · score 96 / 100

Release 0.4.0 · scanned 9 Nov 2026

Graded from the tools this server lists, not from its source code.

Two independent axes, because powerful and malicious are different questions. The grade is threat only. The capability level is blast radius, and it is never a penalty on the grade — it is priced as one subtract-only term in the score, where you can see it.

Threat score100

Client score96

Findings0 threat · 0 capability

Capabilityminimal

Coveragemanifest

Verificationnot in this report

Surface digest568a00175c7a1a49ac795454e20293bab8c44b14af42add58b6d2918601db943

Score vectorthreat 100 → client 96

Term	Level	What it prices	Points
capability-exposure	minimal	capability blast radius (minimal) — client exposure if the model is manipulated	−0
coverage-honesty	manifest	inspection depth (manifest) — how much of the target the scan could see	−4

score = clamp(round(threatScore − E_cap − E_ver − E_cov), 0, 100). No model, no opinion, no network call at scoring time: the same methodology version against the same bytes always produces this number, and every line above is a field of the report rather than a summary of it.

What the scan could actually read

A grade is only as meaningful as its coverage, so the scanner publishes its own depth before it publishes its result.

The scan read each tool’s name, description, input schema and annotations exactly as the server listed them the last time it answered us; no code was reviewed. We ask the server again about once a month, and a list that changed is graded again.

Tool surfaceread

Implementation sourcenot available

Package metadatanot available

Live transportnot available

The implementation source was not read — this reflects the declared tool metadata only.

Capability — what it could do if the model were manipulated

Tags derived from each tool’s schema and the implementation, not from what the tool calls itself. minimal is the level these add up to.

Tool	Capability tags	Why the tag was assigned
alignment_gate	no tags
blm_land_lookup	no tags
diagram_contrast	no tags
humanizer_score	no tags
saas_metrics	no tags
acceptance_criteria_validator	no tags
coverage_check	no tags
defect_triage	no tags
model_advisor	no tags
tool_advisor	no tags
humanize	no tags
dependency_check	no tags
log_audit_creator	no tags
log_analyzer	no tags
ticket_lint	no tags
story_lint	no tags
estimate_sanity	no tags
pr_description_lint	no tags
commit_hygiene	no tags
readability_grade	no tags
regex_lint	no tags
sprint_health	no tags
worklog_guardrail	no tags
uploads	no tags
feedback	no tags
buy_credits	no tags
rate_call	no tags
supply_chain_scan	no tags
describe_diagram	no tags
convert_diagram	untrusted-input	untrusted-input: keyword "fetch"

Toxic-flow graph

The lethal trifecta, checked as a graph rather than as a checklist: untrusted input, a sensitive source and an external sink have to meet before there is a path worth worrying about.

The public result for this release does not print the flow graph, so there is nothing to show here. That is not the same as "no paths were found": what the scan did read is above, under coverage.

Supply chain and provenance

Integrityfirst-seen

Surface digest568a00175c7a1a49

Scanned2026-11-09

This is the first scan of this surface here, so there is nothing yet to compare it against.

Every result on this tab comes from one deterministic pass over the published package — offline, rule by rule, and auditable line by line above. Same methodology version, same bytes, same score.