# QuassLabs API (remote · api.quasslabs.com)

30+ deterministic dev and delivery tools: linting, metrics, diagrams, model advice, AI-text checks.

- Trust score: 63/100 (medium)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- remote · `api.quasslabs.com`: 63/100 (this document), [markdown](https://verifymcp.io/servers/com-quasslabs-api/api.md), [page](https://verifymcp.io/servers/com-quasslabs-api/api)

## Channel facts

- Endpoint: `https://api.quasslabs.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `0.1.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Endpoint Security**: 57/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - Authorisation not fully verified: no authorisation is required to call this server, and 30 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe.
  - HTTPS is enforced; there's no plaintext access path.
  - HSTS check failed: the Strict-Transport-Security header is absent.
  - DNSSEC check failed: this domain isn't protected by DNSSEC.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 64/100
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 5382 tokens (~179/item across 30 items; 30 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 20/100
  - Stability check failed: schema churn in the 7 days we've observed: 1 tool removals, 0 breaking changes, 0 auth/transport breaks, 0 additions.
- **Tool Coverage**: 91/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 73% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 30 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 30 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 60/100
  - Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28.

## Install

### How do I install the QuassLabs API MCP server?

QuassLabs API is a hosted endpoint at https://api.quasslabs.com/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add --transport http com-quasslabs-api 'https://api.quasslabs.com/mcp'
```

### Cursor

```json
{
  "mcpServers": {
    "com-quasslabs-api": {
      "url": "https://api.quasslabs.com/mcp"
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "com-quasslabs-api": {
      "type": "http",
      "url": "https://api.quasslabs.com/mcp"
    }
  }
}
```

### Codex

```toml
[mcp_servers.com-quasslabs-api]
url = "https://api.quasslabs.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "com-quasslabs-api": {
      "type": "remote",
      "url": "https://api.quasslabs.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add com-quasslabs-api --url 'https://api.quasslabs.com/mcp' --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  com-quasslabs-api:
    url: "https://api.quasslabs.com/mcp"
```

### Netclaw

```json
{
  "McpServers": {
    "com-quasslabs-api": {
      "Transport": "http",
      "Url": "https://api.quasslabs.com/mcp"
    }
  }
}
```

### Vellum

```bash
assistant mcp add com-quasslabs-api -t streamable-http -u 'https://api.quasslabs.com/mcp'
```

### Other

```json
{
  "mcpServers": {
    "com-quasslabs-api": {
      "type": "http",
      "url": "https://api.quasslabs.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 16 to 20.

### 2026-11-03 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13.

### 2026-11-01 (score 61, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 6.

### 2026-10-30 (score 60, 0)

- [security regression] Stability: unverified → fail
- [security regression] A breaking change shipped without a version bump: still 0.1.0
- [security regression] Tool “compress” was removed

### 2026-10-29 (score 60)

First indexed and scored.

## MCP tools (30)

### `alignment_gate` (~98 tokens)

Run an AI system prompt (and optional agent config) through a 45-criterion alignment/safety rubric. Returns a letter grade (A-F), numeric score, per-flag remediation, and a pass/fail verdict.

Input parameters:

- `agent_config` (object): Optional agent config (tools, memory, temperature, etc.).
- `model_id` (string): Optional target model identifier.
- `system_prompt` (string, required): The system prompt text to evaluate.

### `blm_land_lookup` (~110 tokens)

Look up Bureau of Land Management land status for a US coordinate: BLM ownership, jurisdiction, allowed activities (rockhounding, camping), permit requirements, and special designations (ACEC, Wilderness, WSA, NM/NCA).

Input parameters:

- `lat` (number, required): Latitude, -90 to 90.
- `lon` (number, required): Longitude, -180 to 180.
- `radius_km` (number): Optional buffer radius in km (0-50, default 1.0).

### `diagram_contrast` (~405 tokens)

Diagram quality QA. Catch and fix the things that ruin diagrams: (1) unreadable label contrast - POST a mermaid/SVG or HTML diagram, get every WCAG-AA failure (incl. mermaid <style>-block label colors, with unresolvable fills flagged honestly, not false-passed) + auto-corrected colors; (2) harden a mermaid SOURCE before it renders - rewrites every fill/label pair and remaps fills no label color can rescue, which scanning cannot do because a per-node style line overrides the theme block; (3) HTML-looks-fine-but-prints-broken - checks for the print-color-adjust/page-break gotchas and returns the fix CSS; (4) arrows crossing objects - returns the ELK-renderer config + layout rules that minimize crossings. Pure deterministic - no AI, no rate limit.

Input parameters:

- `add_init` (boolean): harden: prepend the %%{init}%% theme block (default true).
- `autofix` (boolean): scan: include suggested corrected colors.
- `bg` (string): contrast/readable: background/fill hex (#rrggbb).
- `brand` (string): brand palette to use (e.g. appstango). Default from config.
- `content` (string): scan/print: the SVG or HTML diagram/document source.
- `fg` (string): contrast: foreground hex (#rrggbb).
- `format` (string): scan: content format (default svg).
- `large` (boolean): contrast/harden: use the 3:1 large-text threshold.
- `mode` (string): Default "scan". scan=check rendered output; harden=fix a mermaid source before rendering; print=print-safety check; layout=arrow-crossing reduction.
- `renderer` (string): layout: mermaid renderer (default "elk").
- `source` (string): harden: the mermaid SOURCE text (not rendered SVG).

### `humanizer_score` (~124 tokens)

Detect AI-writing tells in text. POST prose and get a 0-1 ai_ness score + band (low/medium/high) + the EXACT patterns that fired (AI vocabulary, significance inflation, promotional language, filler phrases, negative parallelism, rule-of-three, em-dash overuse) with sample spans. Explainable, not an opaque classifier - every point is a named, located pattern. Deterministic, no LLM. The rewrite is a separate step.

Input parameters:

- `text` (string, required): The prose to score (up to 100k chars).

### `saas_metrics` (~176 tokens)

SaaS health advisor. POST your MRR/customers (+ optional churn/CAC/margin/growth) and get ARR/ARPA/LTV/CAC/payback/Rule-of-40/NRR/GRR computed, each with a health tag, plus an overall grade + a ranked "what to fix first" focus list. Deterministic math + advisory, no LLM.

Input parameters:

- `cac` (number)
- `churned_mrr` (number)
- `customers` (number, required)
- `expansion_mrr` (number)
- `gross_margin_pct` (number)
- `mrr` (number, required)
- `new_customers` (number)
- `new_mrr` (number)
- `prior_mrr` (number)
- `sales_marketing_spend` (number)

### `acceptance_criteria_validator` (~117 tokens)

QA advisor: validate acceptance criteria quality. POST a list of AC (or a story) and get per-AC problems (vague/untestable, non-atomic, no observable outcome) + a missing-coverage flag if there is no failure-path AC, plus a 0-100 score and pass/needs_work verdict. Tells you exactly what to fix. Deterministic, no LLM.

Input parameters:

- `acceptance_criteria` (array)
- `story` (string)
- `strictness` (string)

### `coverage_check` (~97 tokens)

Scope-completeness advisor. POST a brief (or requirements[]) + your stories[] and get a coverage score + the gaps (requirements no story covers), orphan stories (possible scope creep), and missing structural buckets (auth/CRUD/error-states/tests). Tells you what the scope is missing. Deterministic, no LLM.

Input parameters:

- `brief` (string)
- `requirements` (array)
- `stories` (array, required)

### `defect_triage` (~96 tokens)

Bug-triage advisor. POST one bug report (or a list) and get severity (critical/high/medium/low), category, whether it has repro steps, and what info is missing (no repro / no expected-vs-actual / no environment). For a list: priority ranking + likely-duplicate clusters. Deterministic, no LLM.

Input parameters:

- `report` (string)
- `reports` (array)

### `model_advisor` (~205 tokens)

LLM selection + cost advisor. POST a task description (+ optional volume/tokens/constraints like local-only or cheap) and get a recommended model + fallback chain + do-not-use (with reasons), the complexity tier, and per-run + monthly cost. A maintained model+price catalog. Deterministic, no LLM. Tells the AI/user which model to use and what it costs.

Input parameters:

- `constraints` (array)
- `models` (array): Optional allowlist - restrict ranking to only these model identifiers (e.g. models you already have access to). Any catalog model not in this list is excluded, listed in do_not_use.
- `task` (string, required)
- `tokens_in` (number)
- `tokens_out` (number)
- `top_n` (integer): How many ranked models to return as primary+fallbacks (rest land in also_considered). Default 1 = primary alone.
- `volume_per_month` (number)

### `tool_advisor` (~205 tokens)

Which QL-API endpoint fits this task. POST a task description and get the ranked endpoint(s) that best match, each with a confidence label (high/medium/low). Deterministic keyword matching over this platform's own endpoint catalog, no LLM. Pairs with model_advisor (which itself is one of the recommendable endpoints, so a "which model" task surfaces it) - call them independently and chain the results yourself; optionally pass a prior model_advisor result's rationale in as `context` to bias matching.

Input parameters:

- `context` (string): Optional extra text to fold into matching - e.g. a prior model_advisor rationale, or more detail than fits in `task`.
- `task` (string, required): What you are trying to do.
- `tools` (array): Optional allowlist - restrict matching to only these endpoint names.
- `top_n` (integer): How many ranked endpoints to return. Default 1 = best match only.

### `humanize` (~129 tokens)

Rewrite text to remove AI-writing tells. POST prose and get it back with the mechanical tells fixed (AI vocabulary swapped for plain words, filler phrases stripped, em-dash overuse reduced, significance inflation deflated) plus a change log, before/after ai-ness scores, and a residual list of tells that need human judgment (not auto-rewritten). Code fences, inline code, URLs, and quotes are never touched. Deterministic, no LLM. Sister to humanizer_score (the detector).

Input parameters:

- `text` (string, required): The prose to rewrite (up to 100k chars).

### `dependency_check` (~180 tokens)

Dependency-manifest hygiene check. POST package manifests (package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, composer.json, pubspec.yaml, lockfiles) or an upload_id and get findings with severity + concrete fixes: wildcard/unbounded versions, missing lockfiles, unpinned installs, non-https indexes, install-script risks, dependency-confusion signals, and matches against a static snapshot of famously compromised packages. NOT a live CVE feed - pair with npm audit / pip-audit / osv-scanner for that. Deterministic, no network, no LLM.

Input parameters:

- `filename` (string): Required with upload_id so the manifest type can be detected.
- `manifests` (array): Up to 20 manifest files inline.
- `upload_id` (string): Alternative: a single manifest uploaded via the uploads tool.

### `log_audit_creator` (~179 tokens)

Generate a concrete audit-logging spec for an app. POST your feature list (and optional compliance targets: soc2/hipaa/gdpr/pci) and get a full audit-event catalog (namespaced event names, actor/target/required fields, PII flags, retention), a canonical event envelope schema, a storage plan (append-only, access control, alerting), and per-framework compliance notes. A dev team can implement it directly. Deterministic, no LLM. Retention/compliance figures are common-practice defaults to verify with counsel.

Input parameters:

- `compliance` (array)
- `description` (string): Optional free-text app description (scanned for features).
- `features` (array): App features, e.g. ["user login", "payments", "file upload"].
- `stack` (string)

### `log_analyzer` (~195 tokens)

Analyze a log file. POST raw log text (or an upload_id from the uploads tool, up to 5MB) and get: level breakdown + time range, error clusters (messages normalized so variable ids/numbers collapse into one signature, with counts + first/last seen + a sample), a timeline, detected anomalies (error spikes, retry storms, new error signatures, log gaps/outages, level-ratio shifts) with evidence, and templated recommendations. Handles JSON-lines and plain formats (ISO8601/syslog/CLF/epoch timestamps). Deterministic, single-pass, no LLM.

Input parameters:

- `format` (string)
- `text` (string): Raw log content (up to 1M chars).
- `top_n` (number): Top clusters to return (1-50, default 10).
- `upload_id` (string): Alternative: a log file uploaded via the uploads tool.

### `ticket_lint` (~212 tokens)

Full Jira-ticket quality linter (whole ticket, not just AC - use acceptance_criteria_validator for the deep AC pass). POST one ticket or a batch (max 50) and get per-ticket findings with severity + concrete fixes: missing/weak summary or description, missing AC or estimate, bugs without repro/expected-vs-actual/environment, missing epic link, points-vs-hours mismatch, oversized estimates to split, urgent-but-thin tickets. Returns score, grade, and a ready/needs_work verdict per ticket plus batch summary. Type-aware rules (story/bug/task/epic/subtask), strict profile available. Deterministic, no LLM.

Input parameters:

- `profile` (string)
- `ticket` (object): One ticket: {key, summary, description, acceptance_criteria, issue_type, estimate_hours|story_points, priority, labels, components, epic_link, ...}. Missing fields ARE findings.
- `tickets` (array): Alternative: batch of up to 50 tickets.

### `story_lint` (~277 tokens)

Deterministic structural quality linter for user stories - a sibling to ticket_lint but scoped to story-writing concepts any team recognizes: narrative completeness (As-a/I-want-to/So-that/Summary), acceptance criteria presence, duplicate/unknown dependency IDs, a "Manage X" story with no CRUD split, list stories missing a pagination mention. An OPTIONAL rate_config unlocks team-specific checks (screen-vs-narrative match, hour-rate-per-screen tolerance, required risk level by story type, milestone-code format, required companion story types per milestone) - omit it and only the universal checks run. No house rates or milestone conventions are hardcoded. POST one story or a batch (max 50). Deterministic, no LLM.

Input parameters:

- `rate_config` (object): Optional. Enables team-specific checks, all off by default.
- `stories` (array): Alternative: batch of up to 50 stories. Dependency/duplicate/required-companion checks are evaluated across the whole batch.
- `story` (object): One story: {id, title, story: {as_a, i_want_to, so_that, summary, type_label?, on_screen?}, acceptance_criteria, dependencies?: [id], screen?, hours?: {<field>: number}, risk?, milestone_code?}. Miss…

### `estimate_sanity` (~320 tokens)

Deterministic classifier for story/task hour estimates against benchmarks: flags each estimate in_range, borderline, over, under, or unbenchmarked. Supply either an explicit {min, max} range per type (benchmarks) or a list of historical actual hours per type (historical) that this endpoint derives a mean/stdev variance band from - explicit ranges win when both are given for the same type. No benchmark numbers are built in; a type with neither input is reported unbenchmarked, never guessed at. POST one estimate or a batch (max 200). Deterministic, no LLM.

Input parameters:

- `benchmarks` (object): Optional. Per type: {min?, max?}. Wins over historical for the same type.
- `borderline_z` (number): Default 1.0. Stdevs from the historical mean before a result is "borderline" instead of "in_range".
- `estimate` (object): One item: {id?, type, hours}. type and hours are required.
- `estimates` (array): Alternative: batch of up to 200 items.
- `flag_z` (number): Default 2.0. Stdevs from the historical mean beyond which a result is "over"/"under" instead of "borderline". Must be >= borderline_z.
- `historical` (object): Optional. Per type: array of past actual hours (max 500 each), used to derive mean/stdev when no explicit benchmark exists for that type. Needs at least 2 values to produce a band.

### `pr_description_lint` (~156 tokens)

Deterministic PR description quality linter: flags a missing/too-short body, absent test evidence, absent stated rationale, an unstructured long body, and - only for PRs that look like bugfixes (title prefix fix/bug/hotfix/patch, or an explicit is_bugfix flag) - missing repro steps. Optionally requires a linked issue/ticket reference. Single PR only, no batch. Deterministic, no LLM.

Input parameters:

- `pr` (object, required): {title?, body?, is_bugfix?}. is_bugfix overrides title-based inference when supplied.
- `require_issue_link` (boolean): Default false. When true, flags a missing issue/ticket reference in the title or body.

### `commit_hygiene` (~178 tokens)

Deterministic commit-message hygiene checker: conventional-commit format, vague-subject detection, subject-length limit, a same-message secret-pattern scan (AWS keys, private key headers, Slack/GitHub tokens, inline password=/secret= style credentials - checked against the message text only, never a diff), and an oversized-commit warning from caller-supplied insertions/deletions. POST one commit or a batch (max 200). Deterministic, no LLM, no network.

Input parameters:

- `commit` (object): One commit: {sha?, message, insertions?, deletions?}. message is required.
- `commits` (array): Alternative: batch of up to 200 commits.
- `max_lines_changed` (integer): Default 500. Total insertions+deletions above this triggers a large_commit finding.

### `readability_grade` (~173 tokens)

Deterministic Flesch Reading Ease and Flesch-Kincaid Grade Level for a block of text, plus word/sentence/syllable counts and a plain-language reading-ease band (very_easy through very_confusing). Syllable counting is the standard vowel-group heuristic (same approximation used by textstat and most open readability tools), not a dictionary lookup. Optionally pass target_grade to get an on_target flag (within +/-2.0 grade levels). Different metric family from humanizer_score - this is pure readability statistics, not AI-writing-tell detection. Deterministic, no LLM.

Input parameters:

- `target_grade` (number): Optional target Flesch-Kincaid grade level, 0-20.
- `text` (string, required): Prose to analyze. Max 100,000 characters.

### `regex_lint` (~215 tokens)

Static safety analysis of a regular expression plus an English explanation of what it matches. Parses the pattern into an AST and flags the structures that cause catastrophic backtracking (ReDoS): nested unbounded quantifiers like (a+)+, repeated alternations whose branches can start with the same character like (a|ab)*, adjacent unbounded quantifiers over overlapping character sets like \d+\d+, and implausibly large bounded repeats. The pattern is COMPILED but never EXECUTED against input - running a caller-supplied regex is itself the denial-of-service vector. Detection is a structural heuristic, so a risk of "none" means no known dangerous shape was found, not a proof of safety. Deterministic, no LLM.

Input parameters:

- `flags` (string): Optional inline flags, any of "imsxau" (ignorecase, multiline, dotall, verbose, ascii, unicode).
- `pattern` (string, required): The regular expression source, without delimiters. Max 2,000 characters.

### `sprint_health` (~180 tokens)

Sprint/delivery health advisor. POST 1-24 sprints (committed/completed points, optional per-ticket estimate-vs-actual data) and get computed metrics each with a good/warn/bad health tag: velocity avg + trend + stability, commitment reliability, spillover rate, mid-sprint scope change, estimate accuracy (median + chronic-overrun pct), and WIP concentration per assignee. Plus an overall grade and a ranked what-to-fix-first focus list. Pure math + advisory, no LLM.

Input parameters:

- `sprint_length_days` (number): Default 10.
- `sprints` (array, required): Oldest first: [{name, committed_points, completed_points, added_points?, spillover_points?, tickets?: [{key, estimate_hours, actual_hours, status, assignee}]}].
- `team_size` (number)

### `worklog_guardrail` (~256 tokens)

Worklog/timesheet policy checker - run a batch of worklog entries through configurable guardrails BEFORE posting them to a time-tracking system. Checks: rounding increment (default 0.25h, float-safe), per-entry min/max, per-author daily totals, duplicates, over-estimate alerts (never suggests inflating hours or estimates - flags to PM instead), future dates, weekends, immutable-author edit protection, missing description/ticket. Returns pass/warnings/blocked verdict + per-entry violations with fixes + hour totals by author and date. Caller supplies the reference date - fully deterministic, no LLM.

Input parameters:

- `entries` (array, required): Up to 500: [{author, date "YYYY-MM-DD", hours, ticket?, description?, estimate_hours?, already_logged_hours?, id?, edit?, delete?, new?}].
- `policy` (object): Optional overrides: rounding_increment, max_hours_per_day, max_hours_per_entry, min_hours_per_entry, immutable_authors, require_description, require_ticket, over_estimate_policy (alert|block|ignore),…
- `today` (string, required): Reference date "YYYY-MM-DD" for future-date checks.

### `uploads` (~121 tokens)

Get a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id. Two-step: call this, PUT your file to the returned url, then pass upload_id to the consuming endpoint. Uploads auto-expire in 1 day and are readable only by your key. Auth required; not billed.

Input parameters:

- `content_type` (string): MIME type of the file you will PUT (e.g. text/plain, application/json). Default application/octet-stream.

### `feedback` (~161 tokens)

Submit free-text feedback about the API - a bug, a feature request, a docs gap, a billing question, or anything else. Tied to your key so we can follow up, but not billed and not a support-ticket SLA. Auth required; not billed.

Input parameters:

- `category` (string): Defaults to "other".
- `contact_ok` (boolean): Optional, defaults to false. Whether we may follow up with you about this.
- `endpoint` (string): Optional. Which /v1/* endpoint or MCP tool this is about, e.g. "/v1/ticket-lint".
- `message` (string, required): What you want us to know. Up to 4000 characters.
- `severity` (string): Optional. Omit if not applicable.

### `buy_credits` (~154 tokens)

Get a Stripe Checkout link to top up the credits on the API key you are calling with. Starter pack: $5 for 500 credits. Pro pack: $20 for 2500 credits. 1 credit = $0.01. Give the returned checkout_url to a human to complete payment in a browser; the credits are added to this key automatically once the payment succeeds, usually within seconds. Calling this tool does not charge anything and costs no credits.

Input parameters:

- `pack` (string): Which pack to buy. Defaults to "starter" ($5 / 500 credits). "pro" is $20 / 2500 credits.
- `packs` (integer): How many of that pack. Defaults to 1.

### `rate_call` (~146 tokens)

Rate a specific prior metered call - thumbs up or down, plus an optional comment - keyed by the request_id that call's response reported. Scoped for now to rating compress calls, so you can tell us when a compression was too aggressive or dropped something it shouldn't have. Resubmitting the same request_id overwrites your previous rating rather than adding a second one. Auth required; not billed - rating a call you already paid for should not cost more.

Input parameters:

- `comment` (string): Optional. What was good or wrong about that call's result.
- `rating` (string, required)
- `request_id` (string, required): The request_id from the response of the call you are rating.

### `supply_chain_scan` (~95 tokens)

Scan package manifests, lockfiles, and MCP server configs for known supply-chain compromises. The only scanner treating MCP configuration as a security surface. Returns findings with severity and remediation.

Input parameters:

- `archive_base64` (string): Base64-encoded ZIP of manifests/lockfiles/MCP configs.
- `archive_url` (string): Presigned HTTPS URL to a ZIP (for large archives).
- `ecosystems` (array): Optional ecosystem filter.

### `describe_diagram` (~174 tokens)

Turn a plain-English description into Mermaid diagram source. Describe the flow, system, schema or timeline you want ("a login flow with an OAuth branch and a failure path") and get back complete, valid Mermaid - no need to know the syntax. The mermaid field of the response is directly usable as the mermaid_source input of convert_diagram, so describe -> render is a two-call pipeline. Generation runs on our infrastructure via AWS Bedrock; your description is not sent to any third-party service beyond that.

Input parameters:

- `description` (string, required): What the diagram should show, in plain language. Include the nodes/steps/entities you care about; the generator fills in sensible structure.
- `diagram_type` (string): Force a specific Mermaid diagram type. Default "auto" - the generator picks the type that fits the description.

### `convert_diagram` (~248 tokens)

Make Mermaid diagrams portable. Takes HTML containing <div class="mermaid"> blocks (or a raw Mermaid source) and returns the same document with every diagram pre-rendered to inline SVG and the Mermaid CDN runtime stripped. A CDN-backed diagram only renders if the reader can fetch and run the runtime; inline SVG needs neither, so the output survives offline readers, email clients, Notion/Confluence (which strip <script>), and PDF export. Rendering happens on our infrastructure; diagram content is not sent to any third party.

Input parameters:

- `background` (string): "transparent" (default), "white", or a hex color.
- `html` (string): HTML document or fragment containing <div class="mermaid"> blocks. Mutually exclusive with mermaid_source.
- `inject_lightbox` (boolean): Add click-to-enlarge overlay CSS+JS for small-text diagrams. Default false.
- `mermaid_source` (string): A single raw Mermaid diagram source. Mutually exclusive with html.
- `output_format` (string): Default "html". "svg" returns the raw inline SVG and requires mermaid_source.
- `theme` (string): Mermaid theme. Default "default".

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/com-quasslabs-api/api#diagnostics

## Score history

- 2026-11-05: 63
- 2026-11-04: 62
- 2026-11-03: 62
- 2026-11-02: 61
- 2026-11-01: 61
- 2026-10-31: 60
- 2026-10-30: 60
- 2026-10-29: 60

## Common questions

### What is the QuassLabs API MCP server?

QuassLabs API is an MCP server listed in the public MCP registry as com.quasslabs/api. 30+ deterministic dev and delivery tools: linting, metrics, diagrams, model advice, AI-text checks. This page covers its hosted endpoint (https://api.quasslabs.com/mcp).

### Is the QuassLabs API MCP server safe to use?

QuassLabs API scores 63 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the QuassLabs API MCP server expose?

QuassLabs API exposes 30 tools: alignment_gate, blm_land_lookup, diagram_contrast, humanizer_score, saas_metrics, and 25 more. Their descriptions and schemas cost roughly 5,382 tokens of context every time the server is loaded.

### Does the QuassLabs API MCP server require authentication?

No. We connected to QuassLabs API without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.

### Is the QuassLabs API MCP server still maintained?

QuassLabs API is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Remote endpoint: https://api.quasslabs.com/mcp
- Website: https://docs.quasslabs.com/
- Changelog RSS feed: https://verifymcp.io/servers/com-quasslabs-api/api.xml
- Changelog JSON feed: https://verifymcp.io/servers/com-quasslabs-api/api.json
- HTML version of this page: https://verifymcp.io/servers/com-quasslabs-api/api