# IA-QA — 130+ QA & Dev Tools for AI Agents (remote · www.ia-qa.com)

130+ QA & dev tools for AI agents: prompt injection, RAG testing, VLM eval, guardrails. Free.

- Trust score: 76/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `www.ia-qa.com`: 76/100 (this document), [markdown](https://verifymcp.io/servers/jcjamet-ia-qa-toolbox/www.md), [page](https://verifymcp.io/servers/jcjamet-ia-qa-toolbox/www)

## Channel facts

- Endpoint: `https://www.ia-qa.com/mcp`
- Transports: `streamable-http`
- Auth: `none`
- Version: `1.0.0`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Endpoint Security**: 83/100
  - The endpoint's TLS certificate is valid, in date, and uses a strong key.
  - No authorisation is required to call this server. Every tool declares its destructiveHint and none is destructive, so open access doesn't expose one.
  - HTTPS is enforced; there's no plaintext access path.
  - The HSTS (Strict-Transport-Security) header is present.
  - DNSSEC is configured correctly; the domain's records validate against the full chain to the root.
- **Transport & Reachability**: 100/100
  - Verified streamable-http transport via a live MCP handshake.
- **Schema Quality & AI Usability**: 70/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 20450 tokens (~136/item across 150 items; 150 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 27/100
  - Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add --transport http jcjamet-ia-qa-toolbox https://www.ia-qa.com/mcp
```

### Codex

```toml
[mcp_servers.jcjamet-ia-qa-toolbox]
url = "https://www.ia-qa.com/mcp"
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "jcjamet-ia-qa-toolbox": {
      "type": "remote",
      "url": "https://www.ia-qa.com/mcp",
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add jcjamet-ia-qa-toolbox --url https://www.ia-qa.com/mcp --transport streamable-http
```

### Hermes

```yaml
mcp_servers:
  jcjamet-ia-qa-toolbox:
    url: "https://www.ia-qa.com/mcp"
```

### Other

```json
{
  "mcpServers": {
    "jcjamet-ia-qa-toolbox": {
      "type": "http",
      "url": "https://www.ia-qa.com/mcp"
    }
  }
}
```

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 76, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 75, +3)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 72, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-29 (score 71, 0)

- [security] Tool “analyze_diff_bugs” rewrote its description, which is the text the model reads
- [security] Tool “run_pr_gate_pipeline” rewrote its description, which is the text the model reads
- [cosmetic] “find_tool” added an optional parameter “max_results”

### 2026-07-28 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-27 (score 70, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-26 (score 69)

First indexed and scored.

## MCP tools (150)

### `format_json` (~148 tokens)

Validate and pretty-print a string that is ALREADY valid JSON. Strict by design — it is a validity gate: valid JSON comes back formatted, anything else is rejected with the exact parse error. It never repairs, completes, or guesses. NOT for: plain text or prose (will fail), JSON embedded in markdown/prose (use extract_json_from_text first), JS objects (JSON.stringify them first), YAML (use yaml_to_json).

Input parameters:

- `indent` (number): Indent size (default: 2)
- `input` (string, required): A raw JSON string, e.g. '{"key":"value"}'. Must already parse as JSON — plain text or truncated JSON is rejected, not repaired.

Output parameters:

- `formatted` (string)
- `valid` (boolean)

### `generate_uuid` (~80 tokens)

Generate one or more cryptographically random UUID v4 identifiers. Use this when you need unique IDs for test fixtures, database records, session tokens, or any scenario requiring a guaranteed-unique string. Returns up to 100 UUIDs in one call.

Input parameters:

- `count` (number): Number of UUIDs to generate (1–100, default: 1)

Output parameters:

- `count` (number)
- `uuids`

### `hash_text` (~102 tokens)

Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-256+), or produce a fixed-length digest of any input. Supports SHA-256 (default), SHA-512, SHA-1, and MD5.

Input parameters:

- `algorithm` (string): Hash algorithm: sha256 (default), sha512, sha1, md5
- `input` (string, required): Text to hash

Output parameters:

- `algorithm`
- `hash`
- `input_length` (number)

### `count_tokens` (~77 tokens)

Estimate the token count of a text string using the cl100k_base approximation (~4 chars/token). Call this BEFORE sending any text to an LLM API to check if it fits within the model context window and to estimate cost. Returns token estimate, character count, and word count.

Input parameters:

- `input` (string, required): Text to count tokens for

Output parameters:

- `chars`
- `tokens_estimate`
- `words`

### `base64_encode` (~58 tokens)

Encode a UTF-8 string to Base64. Use when you need to embed binary data, multi-line text, or special characters safely inside JSON fields, HTTP headers, or data URIs.

Input parameters:

- `input` (string, required): Text to encode

Output parameters:

- `encoded` (string)

### `base64_decode` (~55 tokens)

Decode a Base64 string back to UTF-8 text. Use for inspecting Base64-encoded API responses, JWT payload claims, config file values, or attachment data.

Input parameters:

- `input` (string, required): Base64 string to decode

Output parameters:

- `decoded`

### `url_encode` (~76 tokens)

Percent-encode a string for safe use in URLs. Call this before programmatically building query strings, path segments, or form-encoded bodies to prevent injection and malformed URLs.

Input parameters:

- `input` (string, required): String to URL-encode
- `mode` (string): "component" (default) or "full" for encodeURI behavior

Output parameters:

- `encoded`

### `url_decode` (~49 tokens)

Decode a percent-encoded URL string back to plain text. Use when parsing query parameters from raw URLs or when displaying encoded values to users.

Input parameters:

- `input` (string, required): URL-encoded string to decode

Output parameters:

- `decoded`

### `generate_slug` (~84 tokens)

Convert any string into a URL-friendly slug: lowercase, ASCII-normalized (é→e), special characters removed, spaces replaced with hyphens. Use for generating SEO-friendly URL paths, file names, or identifier keys from user-provided titles or labels.

Input parameters:

- `input` (string, required): String to slugify
- `separator` (string): Separator character (default: "-")

Output parameters:

- `slug`

### `validate_email` (~63 tokens)

Validate an email address against RFC 5322 syntax before storing it, sending a transactional email, or adding it to a mailing list. Returns { valid, email } — use this to avoid bounces and malformed data.

Input parameters:

- `email` (string, required): Email address to validate

Output parameters:

- `email`
- `valid` (boolean)

### `minify_js` (~77 tokens)

Minify a JavaScript snippet, function, class, or module up to 50 KB using Terser. Returns minified code and byte savings. Use when embedding scripts in HTML templates, report payloads, or injecting inline code programmatically.

Input parameters:

- `code` (string, required): JavaScript code to minify (max 50kb)

Output parameters:

- `minified`

### `decode_jwt` (~80 tokens)

Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry date. Use to inspect claims (sub, iss, exp, roles) during debugging or when integrating with an auth provider.

Input parameters:

- `token` (string, required): The JWT string to decode (header.payload.signature)

Output parameters:

- `expired`
- `expiresAt`
- `header`
- `note` (string)
- `payload`

### `text_stats` (~70 tokens)

Compute comprehensive statistics for any text: character count (with and without spaces), word count, line count, sentence count, paragraph count, and estimated reading time in minutes. Use for validating form field lengths, evaluating LLM output verbosity, or content auditing.

Input parameters:

- `input` (string, required): The text to analyse

Output parameters:

- `chars`
- `chars_no_space`
- `lines`
- `paragraphs`
- `reading_time_minutes`
- `sentences`
- `words`

### `generate_password` (~114 tokens)

Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. Use when resetting user passwords, seeding test accounts, or generating API secrets.

Input parameters:

- `length` (number): Password length (4–128, default: 16)
- `numbers` (boolean): Include digits (default: true)
- `symbols` (boolean): Include symbols like !@#$ (default: false)
- `uppercase` (boolean): Include uppercase letters (default: true)

Output parameters:

- `charset_size` (number)
- `length` (number)
- `password`

### `parse_csv` (~107 tokens)

Parse a CSV string into a JSON array of objects (or raw arrays). Handles RFC 4180 quoted fields, escaped quotes, and custom delimiters. Use when processing spreadsheet exports, data imports, or structured text pipelines where the source is CSV. Supports up to 200 KB.

Input parameters:

- `delimiter` (string): Field delimiter character (default: ",")
- `header` (boolean): Treat the first row as headers (default: true)
- `input` (string, required): CSV content to parse

Output parameters:

- `columns` (number)
- `headers` (array)
- `row_count` (number)
- `rows` (array)

### `color_convert` (~109 tokens)

Convert a color between HEX, RGB, and HSL formats. Use when translating design tokens between CSS notations, verifying color accessibility, or normalizing color values from user input. Accepts #rrggbb, #rgb, rgb(r,g,b), or hsl(h,s%,l%).

Input parameters:

- `input` (string, required): Color value to convert, e.g. "#ff6b6b", "rgb(255,107,107)", "hsl(0,100%,71%)"

Output parameters:

- `b`
- `g`
- `hex`
- `hsl` (string)
- `input`
- `r`
- `rgb` (string)

### `regex_test` (~125 tokens)

Test a regular expression pattern against an input string and return all matches with their index positions and named capture groups. Use for validating user inputs, extracting structured data from text, or debugging regex patterns. Supports flags g, i, m, s, u, y.

Input parameters:

- `flags` (string): Regex flags: g (global), i (case-insensitive), m (multiline), s (dotAll) — default: ""
- `input` (string, required): The string to test against (max 50 KB)
- `pattern` (string, required): Regular expression pattern (without delimiters)

Output parameters:

- `flags`
- `match_count` (number)
- `matched`
- `matches`
- `note`
- `pattern`

### `lorem_ipsum` (~120 tokens)

Generate Lorem Ipsum placeholder text for UI mockups, design prototypes, or test data population. Configurable paragraphs (1–10), sentences per paragraph (1–20), and approximate words per sentence (3–30).

Input parameters:

- `paragraphs` (number): Number of paragraphs to generate (1–10, default: 1)
- `sentences_per_paragraph` (number): Sentences per paragraph (1–20, default: 5)
- `words_per_sentence` (number): Approximate words per sentence (3–30, default: 10)

Output parameters:

- `paragraph_count` (number)
- `paragraphs`

### `timestamp_convert` (~90 tokens)

Convert between Unix timestamps (seconds or milliseconds) and ISO-8601 / UTC date strings. Auto-detects epoch vs. millisecond format. Omit input to get the current time. Returns iso, unix_s, unix_ms, utc, date, and time fields.

Input parameters:

- `input`: Unix timestamp (number, seconds or ms) or ISO date string. Omit to get the current time.

Output parameters:

- `date` (string)
- `iso` (string)
- `time` (string)
- `unix_ms` (number)
- `unix_s` (number)
- `utc` (string)

### `diff_text` (~116 tokens)

Compute a unified line-by-line diff between two text strings (LCS algorithm). Returns added/removed/unchanged line counts and formatted diff hunks with configurable context lines (0–20). Use to compare versions of prompts, configs, code snippets, or any text where you need to see exactly what changed.

Input parameters:

- `a` (string, required): Original (before) text
- `b` (string, required): Modified (after) text
- `context` (number): Context lines around each change (0–20, default: 3)

Output parameters:

- `added` (number)
- `diff` (string)
- `removed` (number)
- `unchanged` (number)

### `truncate_to_tokens` (~115 tokens)

Truncate text to at most N tokens (cl100k_base: ~4 chars/token) to avoid exceeding an LLM context window. Optionally keeps the end of the text instead of the start (useful for keeping recent conversation history). Reports whether truncation occurred and the estimated token count.

Input parameters:

- `from_end` (boolean): Keep the end of the text instead of the start (default: false)
- `input` (string, required): Text to truncate
- `max_tokens` (number, required): Maximum number of tokens to keep

Output parameters:

- `original_tokens_estimate`
- `text`
- `tokens_estimate`
- `truncated` (boolean)

### `split_chunks` (~85 tokens)

Split text into chunks of at most N tokens (cl100k_base: ~4 chars/token) with optional overlap. Designed for RAG ingestion pipelines.

Input parameters:

- `chunk_tokens` (number, required): Maximum tokens per chunk (10–8000)
- `input` (string, required): Text to split into chunks
- `overlap` (number): Token overlap between consecutive chunks (default: 0)

Output parameters:

- `chunk_count` (number)
- `chunks` (array)
- `overlap_tokens`
- `tokens_per_chunk`

### `extract_json_from_text` (~88 tokens)

Extract the first valid JSON object or array embedded in chaotic LLM output (surrounded by markdown fences, prose, or explanatory text). Handles ```json blocks and inline JSON. Call this whenever an LLM returns structured data mixed with explanation text instead of raw JSON.

Input parameters:

- `input` (string, required): Raw text (e.g., LLM output) that may contain a JSON object or array

Output parameters:

- `json`
- `source` (string)

### `strip_markdown` (~76 tokens)

Strip all Markdown formatting (headers, bold, italic, code fences, links, lists) from text and return clean plain text. Run this before injecting scraped documentation, README files, or user content into an LLM prompt to eliminate redundant markup tokens and reduce cost.

Input parameters:

- `input` (string, required): Markdown text to convert to plain text

Output parameters:

- `original_length` (number)
- `stripped_length` (number)
- `text`

### `estimate_llm_cost` (~162 tokens)

Estimate the API cost in USD for a given model and token counts. Supports all major 2024–2026 models: GPT-4o, GPT-4.1, o3, o4-mini, Claude Opus 4, Claude Sonnet 4/4.5, Gemini 2.5 Pro/Flash, DeepSeek V3/R1, Grok 3, and legacy models.

Input parameters:

- `input_tokens` (number, required): Number of input/prompt tokens
- `model` (string, required): Model name, e.g. "gpt-4o", "claude-3.5-sonnet", "deepseek-v3"
- `output_tokens` (number): Number of output/completion tokens (default: 0)

Output parameters:

- `input_cost_usd` (string)
- `input_tokens`
- `model`
- `output_cost_usd` (string)
- `output_tokens`
- `rates` (object)
- `total_cost_usd` (string)

### `escape_html` (~67 tokens)

Escape HTML special characters (&, <, >, ", ') to their safe HTML entities. ALWAYS call this before inserting any user-provided or LLM-generated content into an HTML template to prevent cross-site scripting (XSS) attacks.

Input parameters:

- `input` (string, required): String to HTML-escape

Output parameters:

- `escaped`
- `original_length` (string)

### `unescape_html` (~81 tokens)

Convert HTML entities (&amp;, &lt;, &gt;, &quot;, &#x27;, and numeric &#NNN;) back to plain characters. Use when processing HTML-encoded text from APIs, email content, or legacy database fields before passing to an LLM or displaying to users.

Input parameters:

- `input` (string, required): HTML-encoded string to unescape

Output parameters:

- `unescaped`

### `fetch_veille_feed` (~118 tokens)

Fetch the latest QA & AI/LLM articles aggregated from curated RSS sources (Google Testing Blog, DEV.to Testing/QA/AI/LLM/Agents, Hugging Face Blog, Simon Willison). Perfect for agents monitoring the QA & AI landscape.

Input parameters:

- `category` (string): Filter: "qa" (testing/quality), "ai" (AI/LLM/agents), "all" (default — both)
- `limit` (number): Max articles to return (default: 20, max: 50)

Output parameters:

- `articles` (array)
- `category`
- `sources_queried` (number)
- `total_found` (number)

### `score_geo_signals` (~89 tokens)

Analyze a webpage <head> HTML (or full HTML) for GEO (Generative Engine Optimization) signals. Returns a score /60 with per-check results and improvement tips. GEO = optimizing pages for AI-powered search engines (ChatGPT Search, Perplexity, etc.).

Input parameters:

- `head_html` (string, required): Raw HTML of the <head> section (or full page HTML) to analyze

Output parameters:

- `checks`
- `grade`
- `max_score` (number)
- `passed` (number)
- `score`
- `total_checks` (number)

### `extract_json_path` (~88 tokens)

Extract a value from a JSON string using dot-notation path (e.g., "user.address.city", "items.0.name", "meta.tags"). Supports array index access via numeric path segments.

Input parameters:

- `input` (string, required): A valid JSON string to traverse
- `path` (string, required): Dot-notation path, e.g. "user.address.city" or "items.0.name"

Output parameters:

- `path`
- `type`
- `value`

### `generate_json_ld` (~138 tokens)

Generate a ready-to-paste <script type="application/ld+json"> snippet for GEO / structured data optimization. Supported types: WebSite, FAQPage, Article, Person, Organization, SoftwareApplication, HowTo.

Input parameters:

- `faq_items` (array): For FAQPage/HowTo: array of { question, answer } objects
- `fields` (object): Schema fields as key-value pairs (name, url, description, author, datePublished, etc.)
- `type` (string, required): Schema @type: "WebSite", "FAQPage", "Article", "Person", "Organization", "SoftwareApplication", "HowTo"

Output parameters:

- `acceptedAnswer` (object)
- `name` (string)
- `schema`
- `snippet` (string)

### `analyze_diff_bugs` (~188 tokens)

Pattern-based diff linter: flags a fixed set of risky shapes in changed code — query-string interpolation (SQL/Cypher/Mongo injection shape), shell interpolation, eval/new Function, empty catch blocks, regex built from a variable, fewer catch blocks than before, and named authorization guards that disappeared. Every finding cites the line that produced it. It does NOT do data-flow analysis: it cannot follow a value to a sink, across functions or files, and an empty result is not a safety verdict (the response lists what it did not analyse). Advisory triage — use a static analyser for a real security gate.

Input parameters:

- `context` (string): Optional PR title or feature context for better analysis
- `version1` (string): Original code (before changes). If omitted, only the new version is analysed.
- `version2` (string, required): New/modified code (after changes)

Output parameters:

- `bugs` (array)
- `disclaimer` (string)
- `notAnalysed` (array)
- `overallRisk` (string)
- `rulesApplied` (number)
- `scannedLines` (number)
- `totalSuggestions` (number)

### `generate_test_cases` (~90 tokens)

Generate a set of test cases (valid, edge, invalid) for a given feature description. Returns test matrix with Gherkin scenarios ready to use.

Input parameters:

- `feature` (string, required): Feature or function to test. Be specific: describe inputs, expected behaviour, context.
- `inputs` (string): Optional: list of input parameters (one per line, e.g. "email: string [required]")

Output parameters:

- `feature` (string)
- `test_cases` (array)

### `run_pr_gate_pipeline` (~179 tokens)

Review triage for a pull request. Takes a unified git diff (`git diff HEAD`) and returns: diff-lint findings with the lines that produced them, regression impact areas, a risk score 0–100 with the factors that built it (churn, files touched, sensitive paths, whether any test file changed, lint severities), generated test cases, and a PASS / CONDITIONAL / BLOCK recommendation. Advisory: the score measures properties of the diff, not the correctness of the change — it does not read the code semantically and does not replace a reviewer or a static analyser. See notAnalysed in the response.

Input parameters:

- `context` (string): Optional PR title or description for richer analysis
- `git_diff` (string, required): Unified git diff (output of `git diff HEAD` or copied from GitHub diff view)

Output parameters:

- `bugsFound` (number)
- `changedFiles`
- `critical`
- `disclaimer` (string)
- `high`
- `impactAreas` (array)
- `inputFormat` (string)
- `mergeRecommendation`
- `notAnalysed` (array)
- `riskFactors` (array)
- `riskLevel`
- `riskScore`
- `severityLevel`
- `sla`
- `testCasesGenerated`
- `topBugs` (array)

### `validate_mcp_response` (~225 tokens)

Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSON result and a set of checks to perform.

Input parameters:

- `actual_latency` (number): Actual measured latency in ms (from the call)
- `expected_type` (string): Expected top-level type: "object", "array", "string", "number"
- `forbidden_keys` (string): Comma-separated list of keys that MUST NOT exist (e.g. "password, secret, token")
- `max_response_ms` (number): Maximum acceptable latency in ms (will be compared if provided)
- `max_size_bytes` (number): Maximum acceptable response size in bytes
- `min_items` (number): If response is an array, minimum number of items expected
- `required_keys` (string): Comma-separated list of keys that MUST exist in the response (dot-notation for nested: "data.id, data.name")
- `response` (string, required): The MCP tool result as a JSON string to validate

Output parameters:

- `checks`
- `failed` (number)
- `passed` (number)
- `total` (number)
- `verdict` (string)

### `llm_output_validator` (~240 tokens)

Validate an LLM response against QA criteria: format checks (JSON, code, markdown), content rules (must-include, must-not-include), length constraints, language detection, and safety patterns. Essential for QA testing LLM-powered features.

Input parameters:

- `check_json_schema` (string): If expected_format is JSON, provide required keys as comma-separated list to validate the structure
- `check_safety` (boolean): Check for PII patterns (emails, phones, SSN), profanity signals, and prompt leakage
- `expected_format` (string): Expected output format
- `expected_language` (string): Expected language of the output (en, fr, es, de…). Checks for common words.
- `max_length` (number): Maximum character length for the output
- `min_length` (number): Minimum character length for the output
- `must_include` (string): Comma-separated strings that MUST appear in the output
- `must_not_include` (string): Comma-separated strings that must NOT appear (e.g. "TODO, FIXME, undefined, NaN")
- `output` (string, required): The LLM output text to validate

Output parameters:

- `checks`
- `failed`
- `passed`
- `total` (number)
- `verdict`

### `compare_responses` (~350 tokens)

Compare two ALREADY-PRODUCED outputs (e.g. model A vs model B on the same task) side by side. Returns deterministic metrics (token cosine, ROUGE-L, Jaccard, length/structure deltas, JSON diff) and a verdict. If a `reference` (ground truth) is given, scores each output against it and picks the closer one. If `model` + `api_key` are given, an LLM judge also picks a qualitative winner for the task. No re-execution — you bring the outputs.

Input parameters:

- `api_key` (string): Optional API key for the judge model (BYOK). Used only for the judge call; never stored.
- `check_json` (boolean): Try to parse as JSON and compare structurally (keys, types, values)
- `label_a` (string): Label for output A (e.g. "GPT-4o", "v1.0")
- `label_b` (string): Label for output B (e.g. "GPT-5-nano", "v1.1")
- `model` (string): Optional judge model id (BYOK). When set with api_key, an LLM judge picks a qualitative winner.
- `reference` (string): Optional ground-truth / expected answer. If set, each output is scored against it and the closer one wins (deterministic).
- `response_a` (string, required): First output (e.g. model A's answer)
- `response_b` (string, required): Second output (e.g. model B's answer)
- `task` (string): The task/prompt both outputs were answering — used by the LLM judge for context

Output parameters:

- `judge`
- `labelA`
- `labelB`
- `metrics`
- `summary` (string)
- `verdict`

### `analyze_responses` (~209 tokens)

Semantically analyze N already-produced model outputs for the SAME task (the MCP counterpart to the LLM Sandbox). Without a reference: computes consensus — pairwise cosine agreement, the most-representative output, and the outlier. With a `reference` (ground truth): also ranks every output by closeness (token cosine + ROUGE-L composite) and names the closest. Deterministic, no LLM, no key — gate-able in CI. You bring the outputs (2+). For a 2-way head-to-head with structural JSON diff use compare_responses instead.

Input parameters:

- `reference` (string): Optional ground-truth answer. If set, each output is also ranked by closeness to it and the closest one is named.
- `responses` (array, required): The outputs to analyze (same task, N models/prompts/versions). Each item is a plain string or { "label": "GPT-4o", "text": "..." }. At least 2 required.

Output parameters:

- `consensus`
- `count`
- `reference_ranking`
- `summary` (string)

### `prompt_test_suite` (~201 tokens)

Define a test suite for a prompt: provide the system prompt, user prompt, and expected output criteria. Returns a test plan with scored rubric — use this as input for manual or automated LLM evaluation.

Input parameters:

- `adversarial_prompts` (boolean): Auto-generate adversarial test variants (jailbreak, injection, edge cases)
- `check_safety` (boolean): Include safety/PII checks in the rubric
- `expected_behavior` (string): Description of what the LLM should do (free text)
- `expected_format` (string): Expected output format
- `max_tokens` (number): Max token budget for the test
- `must_include` (string): Required content (comma-separated)
- `must_not_include` (string): Forbidden content (comma-separated)
- `system_prompt` (string, required): The system prompt under test
- `temperature` (number): Temperature to use
- `user_prompt` (string, required): The user prompt to send

Output parameters:

- `categories` (array)
- `instructions` (string)
- `rubric`
- `test_suite_name` (string)
- `total_tests` (number)

### `mcp_server_health_check` (~97 tokens)

Generate a health check report for an MCP server's tool manifest. Validates tool definitions, schema quality, naming conventions, and documentation completeness. Paste the server manifest JSON to audit.

Input parameters:

- `manifest` (string, required): MCP server manifest JSON (the response from GET /mcp or tools/list)
- `strict` (boolean): Enable strict mode: also check for optional best practices (examples, default values, descriptions > 20 chars)

Output parameters:

- `checks` (array)
- `failed` (number)
- `passed` (number)
- `stats` (object)
- `toolIssues`
- `total` (number)
- `verdict` (string)

### `mcp_server_evaluate` (~148 tokens)

Run a full compliance evaluation against a live MCP server URL. Tests: server reachability (ping), manifest discovery (GET /mcp), schema quality (snake_case names, descriptions, inputSchema), JSON-RPC 2.0 test call, and P50/P95 latency. Returns a PASS/FIX/BLOCK verdict with a 0-100 score and per-check details.

Input parameters:

- `test_tool_name` (string): Specific tool name to use in the JSON-RPC test call (defaults to the first tool in the manifest)
- `url` (string, required): Base URL of the MCP server (e.g. https://ia-qa.com or http://localhost:3001)

Output parameters:

- `checks` (object)
- `latency` (object)
- `score` (number)
- `url` (string)
- `verdict` (string)

### `json_schema_validate` (~108 tokens)

Validate a JSON value against a JSON Schema (draft-07 subset). Supports type, required, properties, items, enum, const, pattern, format (email/uri/date), minimum/maximum, minLength/maxLength, minItems/maxItems, uniqueItems, additionalProperties, anyOf, allOf, oneOf. Returns all validation errors with dot-notation paths.

Input parameters:

- `schema` (string, required): JSON Schema as a JSON string
- `value` (string, required): JSON string to validate

Output parameters:

- `error_count` (number)
- `errors` (array)
- `valid` (boolean)

### `flatten_json` (~99 tokens)

Flatten a nested JSON object to single-level dot-notation keys (e.g. {"a":{"b":1}} → {"a.b":1}), or unflatten dot-notation keys back to a nested object. Supports custom separators.

Input parameters:

- `input` (string, required): JSON string to flatten or unflatten
- `mode` (string): "flatten" (default) or "unflatten"
- `separator` (string): Key separator (default: ".")

Output parameters:

- `key_count` (number)
- `max_depth` (array)
- `result`

### `xml_to_json` (~108 tokens)

Convert an XML string to a JSON object. Supports attributes, nested elements, arrays, CDATA, and namespaces. Options: parse numbers, parse booleans, ignore attributes.

Input parameters:

- `attr_prefix` (string): Prefix for attribute keys (default: "@_")
- `ignore_attrs` (boolean): Ignore XML attributes (default: false)
- `input` (string, required): XML string to convert
- `parse_values` (boolean): Auto-parse numbers and booleans (default: true)

Output parameters:

- `key_count` (number)
- `result`

### `redact_pii` (~139 tokens)

Automatically detect and redact Personally Identifiable Information (PII) from text. Replaces emails, phone numbers, SSNs, credit cards, IP addresses, and JWT tokens with [REDACTED_TYPE] placeholders. Safe to use before logging or sending to an LLM.

Input parameters:

- `input` (string, required): Text to redact PII from
- `marker` (string): Custom replacement marker (default: "REDACTED"). Result: [REDACTED_EMAIL]
- `types` (string): Comma-separated types to redact (default: all). Options: email, phone, ssn, credit_card, ip_address, jwt

Output parameters:

- `clean` (boolean)
- `pii_found`
- `redacted_text`
- `replacements`
- `total_redactions`

### `mock_from_schema` (~122 tokens)

Generate realistic mock data from a JSON Schema. Supports all common types (string, number, integer, boolean, array, object, null), format hints (email, date, date-time, uri, uuid), enum, const, and nested schemas. Perfect for testing MCP tools with realistic data.

Input parameters:

- `count` (number): Number of mock objects to generate (default: 1, max: 20)
- `schema` (string, required): JSON Schema as a JSON string
- `seed` (string): Optional seed string for deterministic output (uses first char codes)

Output parameters:

- `count` (number)
- `results`

### `transform_json_array` (~296 tokens)

Transform a JSON array using common operations: pluck (extract specific fields), filter (by field value), sort_by (field), group_by (field), count_by (field), uniq_by (field). Useful for processing MCP tool results and LLM structured outputs.

Input parameters:

- `field` (string): Field to operate on (for sort_by, group_by, count_by, uniq_by, filter)
- `fields` (string): Comma-separated field list for "pluck" (e.g. "id,name,email")
- `filter_op` (string): For "filter": "==" | "!=" | ">" | ">=" | "<" | "<=" | "contains" | "exists" | "!exists"
- `filter_value` (string): For "filter": value to compare against
- `input` (string, required): JSON string containing an array (or object with an array at path)
- `n` (number): For first_n / last_n: number of items
- `operation` (string, required): Operation: "pluck", "filter", "sort_by", "group_by", "count_by", "uniq_by", "reverse", "first_n", "last_n", "flatten"
- `path` (string): Optional dot-notation path to the array within the JSON object (e.g. "data.items")
- `sort_order` (string): For sort_by: "asc" (default) or "desc"

Output parameters:

- `count` (number)
- `field`
- `fields`
- `group_count` (number)
- `operation` (string)
- `order`
- `removed` (number)
- `removed_duplicates` (number)
- `result`
- `total` (number)
- `unique_values` (number)

### `json_to_csv` (~78 tokens)

Convert a JSON array of objects to CSV format. Automatically detects columns from all object keys. Handles quoting and escaping per RFC 4180.

Input parameters:

- `delimiter` (string): Column delimiter (default: ",")
- `headers` (boolean): Include header row (default: true)
- `input` (string, required): JSON string containing an array of objects

Output parameters:

- `column_names`
- `columns` (number)
- `csv` (string)
- `rows` (number)

### `case_convert` (~106 tokens)

Convert a string between naming conventions: camelCase, PascalCase, snake_case, kebab-case, UPPER_SNAKE_CASE, dot.case, Title Case. Essential for code generation and refactoring.

Input parameters:

- `input` (string, required): String to convert (e.g., "myVariableName", "my-css-class")
- `to` (string, required): Target case: "camel", "pascal", "snake", "kebab", "upper_snake", "dot", "title"

Output parameters:

- `from_words`
- `result`
- `target_case`

### `sort_lines` (~129 tokens)

Sort, deduplicate, reverse, or filter lines of text. Useful for cleaning import lists, dependencies, log files, and config entries.

Input parameters:

- `filter` (string): For "filter": keep lines containing this substring (case-insensitive)
- `input` (string, required): Multi-line text to process
- `operation` (string): "sort" (default), "sort_desc", "reverse", "deduplicate", "unique_sort", "filter"
- `remove_empty` (boolean): Remove empty lines (default: true)
- `trim` (boolean): Trim whitespace from each line (default: true)

Output parameters:

- `line_count` (number)
- `original_count` (number)
- `removed` (number)
- `result` (string)

### `number_base_convert` (~123 tokens)

Convert numbers between bases: decimal, binary, octal, hexadecimal, or any base 2–36. Auto-detects 0x, 0b, 0o prefixes.

Input parameters:

- `from_base` (number): Source base 2–36 (auto-detects prefix if omitted)
- `input` (string, required): Number to convert (e.g., "255", "0xFF", "0b1010", "0o77")
- `to_base` (number): Target base 2–36 (omit to get all common bases)

Output parameters:

- `binary` (string)
- `decimal`
- `from_base`
- `hexadecimal` (string)
- `octal` (string)
- `result` (string)
- `to_base`

### `validate_url` (~47 tokens)

Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.

Input parameters:

- `input` (string, required): URL to validate and parse

Output parameters:

- `full`
- `hash`
- `hostname`
- `origin`
- `pathname`
- `port`
- `protocol`
- `query_params`
- `search`
- `valid` (boolean)

### `check_contrast_ratio` (~72 tokens)

Calculate WCAG 2.1 contrast ratio between two colors. Returns ratio and compliance for AA/AAA normal and large text.

Input parameters:

- `background` (string, required): Background color in hex (e.g., "#ffffff")
- `foreground` (string, required): Foreground color in hex (e.g., "#333333")

Output parameters:

- `AAA_large` (boolean)
- `AAA_normal` (boolean)
- `AA_large` (boolean)
- `AA_normal` (boolean)
- `background` (object)
- `foreground` (object)
- `ratio`
- `ratio_text` (string)

### `html_to_markdown` (~81 tokens)

Convert HTML to clean Markdown. Strips scripts, styles, nav, ads, and comments. Converts headings, lists, links, images, code blocks. Ideal for preparing web content as LLM context.

Input parameters:

- `input` (string, required): HTML string to convert
- `strip_links` (boolean): Strip link URLs, keep text only (default: false)

Output parameters:

- `markdown`
- `markdown_length` (number)
- `original_length` (number)

### `cron_parse` (~63 tokens)

Parse a cron expression into a human-readable schedule description. Supports standard 5-field cron (minute hour day month weekday).

Input parameters:

- `expression` (string, required): Cron expression (e.g., "0 9 * * 1-5", "*/15 * * * *")

Output parameters:

- `expression`
- `fields` (object)
- `human_readable` (string)

### `cron_validator` (~106 tokens)

Validate a 5-field cron expression, explain the schedule, and preview the next execution times. Use this to debug cron jobs before they reach production. Returns parsed fields, a human-readable description, and upcoming ISO timestamps.

Input parameters:

- `expression` (string, required): Cron expression with 5 fields, e.g. "*/15 9-18 * * 1-5"
- `next_runs_count` (number): How many upcoming runs to return (1-50, default: 10)

Output parameters:

- `expression`
- `fields` (object)
- `human_readable`
- `next_runs`
- `valid` (boolean)

### `calculate_readability` (~59 tokens)

Calculate readability scores: Flesch Reading Ease, Flesch-Kincaid Grade Level, Coleman-Liau Index, and Automated Readability Index. Useful for evaluating LLM output quality.

Input parameters:

- `input` (string, required): Text to analyze for readability

Output parameters:

- `automated_readability_index` (number)
- `coleman_liau_index` (number)
- `flesch_kincaid_grade` (number)
- `flesch_reading_ease`
- `level`
- `stats` (object)

### `normalize_whitespace` (~156 tokens)

Normalize whitespace: trim trailing spaces, collapse blank lines, normalize line endings (LF/CRLF), convert tabs to spaces. Useful for cleaning code, configs, and text before processing.

Input parameters:

- `collapse_blanks` (boolean): Collapse 3+ consecutive blank lines to 2 (default: true)
- `input` (string, required): Text to normalize
- `line_ending` (string): "lf" (default), "crlf", or "cr"
- `tab_to_spaces` (number): Convert tabs to N spaces (omit to keep tabs)
- `trim_file` (boolean): Trim leading/trailing blank lines (default: true)
- `trim_lines` (boolean): Trim trailing whitespace from each line (default: true)

Output parameters:

- `line_ending`
- `normalized_length` (number)
- `original_length` (number)
- `result`

### `embedding_similarity` (~186 tokens)

Compute text similarity using local algorithms (Bag of Words, TF-IDF, Character N-grams). No API key needed — runs entirely in-process. NOT real embeddings: for true semantic similarity with vector embeddings, use run_semantic_tests with mode="embeddings" and your OpenAI API key. Supports single pair or batch mode with pipe-separated pairs. Useful for RAG retrieval testing, semantic search evaluation, and text deduplication.

Input parameters:

- `batch` (array): Batch mode: array of { text_a, text_b } pairs. Overrides text_a/text_b if provided.
- `methods` (array): Algorithms to use (default: all three). Options: "bow", "tfidf", "ngram"
- `text_a` (string): First text to compare (single-pair mode)
- `text_b` (string): Second text to compare (single-pair mode)

Output parameters:

- `count` (number)
- `mode` (string)
- `results`
- `scores`
- `text_a`
- `text_b`

### `llm_format_check` (~92 tokens)

Validate that an LLM output matches an expected format: JSON, Markdown, code block, bullet list, numbered list, table, YAML, XML, or custom regex. Essential for structured output testing.

Input parameters:

- `expected_format` (string, required): Expected format
- `output` (string, required): The LLM output to validate
- `regex_pattern` (string): Custom regex pattern (only when expected_format is "regex")

Output parameters:

- `checks`
- `expected_format`
- `failed`
- `passed`
- `total_checks` (number)
- `valid` (boolean)

### `hallucination_check` (~131 tokens)

Word-overlap based hallucination check: verifies if an LLM answer's words and numbers appear in the provided source/context. Fast, deterministic, no API key needed. Limitations: not semantic — does not understand synonyms or paraphrases. For true semantic grounding, use run_semantic_tests with embedding mode. Essential for quick RAG accuracy testing.

Input parameters:

- `answer` (string, required): The LLM-generated answer to verify
- `context` (string, required): The source/reference text that should ground the answer
- `strict` (boolean): If true, every sentence in the answer must be supported (default: false)

Output parameters:

- `analysis`
- `detail` (string)
- `entities`
- `grounded` (boolean)
- `grounded_count` (number)
- `grounding_score`
- `matched_words` (number)
- `message` (string)
- `numbers`
- `overlap` (number)
- `sentence`
- `total_sentences` (number)
- `total_words` (number)
- `ungrounded_count` (number)
- `unsupported_claims`
- `verdict` (string)

### `prompt_injection_scan` (~91 tokens)

Scan user input or prompts for common prompt injection patterns. Detects system prompt overrides, jailbreak attempts, role manipulation, encoding tricks, delimiter attacks, template/interpolation injection ({{...}}, ${...}), and context-exfiltration attempts ("repeat everything above").

Input parameters:

- `input` (string, required): The user input or prompt to scan for injection patterns
- `sensitivity` (string): Detection sensitivity (default: medium)

Output parameters:

- `detections`
- `detections_count` (number)
- `injection_detected` (boolean)
- `input_length` (number)
- `risk_level`
- `sensitivity`

### `token_budget_calculator` (~183 tokens)

Plan token allocation across system prompt, user input, context/RAG chunks, and expected output. Warns if budget exceeds model context window. Supports 25+ models.

Input parameters:

- `context` (string): Actual context text (will estimate tokens)
- `context_tokens` (number): Token count for RAG context / documents
- `expected_output_tokens` (number): Expected max output tokens
- `model` (string, required): Model name (e.g. gpt-4o, claude-3.5-sonnet, gemini-2.0-flash)
- `system_prompt` (string): Actual system prompt text (will estimate tokens)
- `system_prompt_tokens` (number): Token count for system prompt
- `user_input` (string): Actual user input text (will estimate tokens)
- `user_input_tokens` (number): Token count for user message

Output parameters:

- `breakdown` (object)
- `context_window`
- `fits_in_window`
- `model`
- `remaining_tokens`
- `utilization_percent`
- `warnings`

### `consistency_check` (~143 tokens)

Compare multiple LLM responses to the same prompt and detect inconsistencies using Jaccard word-overlap similarity and fact drift (number comparison). Fast, deterministic, no API key needed. Limitations: relies on surface-level word matching — "Paris is the capital of France" vs "Paris is the French capital" may score low despite semantic equivalence. For true semantic consistency, use run_semantic_tests with embedding mode. Essential for determinism testing.

Input parameters:

- `check_facts` (boolean): Check for contradictory numbers/facts across responses (default: true)
- `responses` (array, required): Array of 2+ LLM responses to compare (same prompt, different runs)

Output parameters:

- `avg_similarity`
- `fact_contradiction`
- `fact_drift`
- `length_variance_percent`
- `pairwise_scores`
- `response_count` (number)
- `verdict`

### `llm_json_schema_check` (~85 tokens)

Validate that an LLM JSON output matches a JSON Schema definition. Tests required fields, types, enums, nested objects, and arrays. Critical for function-calling and structured output testing.

Input parameters:

- `output` (string, required): The LLM JSON output (raw string, will be parsed)
- `schema` (object, required): JSON Schema (draft-07 subset) to validate against

Output parameters:

- `error_count` (number)
- `errors` (array)
- `parse_error`
- `parsed_type`
- `valid` (boolean)

### `latency_benchmark` (~110 tokens)

Measure response time of one or more HTTP endpoints (GET/POST). Runs N iterations and returns min/max/avg/p95 latency. Useful for API and MCP server benchmarking.

Input parameters:

- `endpoints` (string|array, required): Endpoints to benchmark. Accepts a single URL string, an array of URL strings, or an array of {url, method?, body?, headers?, label?} objects.
- `iterations` (number): Number of iterations per endpoint (default: 3, max: 10)

Output parameters:

- `iterations` (number)
- `results` (array)

### `response_quality_score` (~102 tokens)

Score an LLM response on multiple quality dimensions: relevance, completeness, clarity, conciseness, formatting. Returns a weighted 0-100 score with detailed breakdown.

Input parameters:

- `expected_keywords` (array): Keywords that should appear in a good answer
- `max_length` (number): Ideal max character length (penalize if exceeded)
- `question` (string, required): The original question/prompt
- `response` (string, required): The LLM response to score

Output parameters:

- `breakdown` (object)
- `grade`
- `max_score` (number)
- `stats` (object)
- `total_score`

### `rag_relevance_rank` (~81 tokens)

Rank an array of text chunks by relevance to a query using TF-IDF scoring. Simulates retrieval ranking for RAG testing without needing embeddings or an API.

Input parameters:

- `chunks` (array, required): Array of text chunks to rank
- `query` (string, required): The user query
- `top_k` (number): Return top K results (default: all)

Output parameters:

- `chunk_preview`
- `index`
- `keyword_overlap`
- `query`
- `rank` (number)
- `results`
- `returned` (number)
- `score` (string)
- `total_chunks` (number)

### `toxicity_scan` (~63 tokens)

Scan text for toxic language, bias indicators, profanity, and harmful content categories. Returns risk scores per category. Useful for LLM safety guardrail testing.

Input parameters:

- `categories` (array): Categories to check (default: all)
- `text` (string, required): Text to scan

Output parameters:

- `categories_checked` (number)
- `overall_risk`
- `results`
- `text_length` (number)

### `guardrail_test` (~80 tokens)

Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex. Returns pass/fail per rule.

Input parameters:

- `response` (string, required): The LLM response to test
- `rules` (array, required): Array of guardrail rules to check

Output parameters:

- `all_passed` (boolean)
- `detail` (string)
- `failed`
- `label`
- `pass` (boolean)
- `passed`
- `results`
- `rule`
- `total_rules` (number)
- `value`

### `function_call_validate` (~99 tokens)

Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args. For OpenAI function calling & MCP tool_use testing.

Input parameters:

- `allowed_functions` (array, required): List of allowed function definitions
- `function_call` (object, required): The function call object from LLM (e.g. { "name": "get_weather", "arguments": {"city":"Paris"} })

Output parameters:

- `error_count` (number)
- `errors` (array)
- `function_name`
- `provided_args`
- `required_args`
- `valid` (boolean)

### `conversation_analyze` (~53 tokens)

Analyze a multi-turn conversation for context retention, topic drift, instruction following, and repetition. Accepts messages array [{role, content}]. Essential for chatbot QA.

Input parameters:

- `messages` (array, required): Conversation messages in order

Output parameters:

- `assistant_messages` (number)
- `avg_response_length` (number)
- `context_retention`
- `has_system_prompt` (boolean)
- `repetition_detected` (boolean)
- `repetitions`
- `topic_drift`
- `turn_count` (number)
- `user_messages` (number)

### `mcp_schema_lint` (~60 tokens)

Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. Returns actionable warnings.

Input parameters:

- `tool_definition` (object, required): MCP tool definition object with name, description, inputSchema

Output parameters:

- `error_count` (number)
- `errors`
- `grade`
- `quality_score`
- `warning_count` (number)
- `warnings`

### `cot_analyzer` (~104 tokens)

Analyze a Chain-of-Thought (CoT) or reasoning trace from an LLM. Detects step count, logical flow, conclusion presence, backtracking, and estimates reasoning depth. Useful for o1/o3/DeepSeek-R1 evaluation.

Input parameters:

- `expected_conclusion` (string): Expected final answer to check against (optional)
- `reasoning` (string, required): The CoT / reasoning trace text (e.g. from <think> tags or step-by-step output)

Output parameters:

- `backtracking_signals`
- `conclusion_matches_expected`
- `has_conclusion` (boolean)
- `markers`
- `reasoning_depth`
- `reasoning_depth_label`
- `step_count` (number)
- `total_chars` (number)
- `total_lines` (number)

### `ab_test_report` (~77 tokens)

Generate an A/B test report comparing two prompts or model configurations. Accepts arrays of scores and returns statistical comparison: mean, median, std deviation, winner, and improvement percentage.

Input parameters:

- `variant_a` (object, required): First variant configuration with name and score array
- `variant_b` (object, required): Second variant configuration with name and score array

Output parameters:

- `count` (number)
- `improvement_percent`
- `max`
- `mean` (string)
- `median` (string)
- `min`
- `recommendation` (number)
- `std_dev` (string)
- `variant_a` (object)
- `variant_b` (object)
- `winner`

### `context_window_check` (~106 tokens)

Given an array of message objects [{role, content}], estimate total token usage and check if it fits in the target model's context window. Warns about truncation risk.

Input parameters:

- `max_output_tokens` (number): Reserved tokens for output (default: 4096)
- `messages` (array, required): Array of messages (system/user/assistant)
- `model` (string, required): Target model name (e.g. gpt-4o, claude-3.5-sonnet)

Output parameters:

- `breakdown` (object)
- `chars` (number)
- `context_window`
- `fits`
- `index`
- `message_count` (number)
- `model`
- `per_message`
- `reserved_output_tokens`
- `role`
- `tokens`
- `total_input_tokens`
- `total_tokens`
- `utilization_percent` (string)
- `warnings`

### `vector_similarity` (~86 tokens)

Compute similarity/distance between two float vectors: cosine similarity, dot product, Euclidean and Manhattan distance. Essential for vector DB relevance scoring, embedding evaluation, and nearest-neighbor testing.

Input parameters:

- `metric` (string): Distance metric (default: all)
- `vector_a` (array, required): First vector as array of floats
- `vector_b` (array, required): Second vector as array of floats

Output parameters:

- `cosine_distance`
- `cosine_similarity`
- `dimension`
- `dot_product`
- `euclidean_distance`
- `interpretation`
- `manhattan_distance`
- `norm_a`
- `norm_b`

### `normalize_vector` (~79 tokens)

L2-normalize a float vector (produce a unit vector with norm=1). Required by many vector DBs (Pinecone, Qdrant cosine). Supports batch normalization of up to 1000 vectors.

Input parameters:

- `batch` (array): Batch of vectors to normalize (overrides vector)
- `vector` (array): Single vector to normalize

Output parameters:

- `count` (number)
- `dimension` (number)
- `index`
- `mode` (string)
- `norm` (number)
- `norm_after` (number)
- `norm_before` (number)
- `normalized`
- `results`
- `vector`

### `vector_quantize` (~105 tokens)

Simulate int8 or int4 quantization of float32 embedding vectors. Reduces storage by 4x (int8) or 8x (int4). Returns quantized values, scale factor, and precision loss (MSE). Useful for understanding vector DB compression trade-offs.

Input parameters:

- `bits` (number): Quantization bits: 8 (int8, default) or 4 (int4)
- `vector` (array, required): Float32 vector to quantize

Output parameters:

- `bits`
- `compression_ratio` (string)
- `dimension` (number)
- `mse` (number)
- `offset` (number)
- `quantized`
- `scale_factor` (number)
- `storage_bytes_float32`
- `storage_bytes_quantized` (number)

### `vector_stats` (~105 tokens)

Compute statistics for a float vector or matrix of vectors: mean, std, L2 norm, min, max, sparsity, top-K indices. Useful for debugging embedding quality and analyzing vector distributions in a vector DB.

Input parameters:

- `matrix` (array): Matrix of vectors (overrides vector). Returns per-vector + matrix-level stats.
- `top_k` (number): Return indices of top K absolute values (default: 5)
- `vector` (array): Single vector to analyze

Output parameters:

- `dimension`
- `l2_norm` (number)
- `matrix_shape` (array)
- `matrix_stats` (object)
- `max` (number)
- `mean` (number)
- `min` (number)
- `per_vector`
- `sparsity` (number)
- `std` (number)
- `top_k_indices`

### `bm25_score` (~127 tokens)

Compute BM25 relevance score between a query and one or more documents. BM25 is the industry-standard keyword-based ranking algorithm used in Elasticsearch, OpenSearch, and Weaviate hybrid search. Returns ranked results with normalized scores.

Input parameters:

- `b` (number): Length normalization factor (default: 0.75)
- `documents` (array, required): Array of documents to rank
- `k1` (number): Term frequency saturation (default: 1.5)
- `query` (string, required): The search query
- `top_k` (number): Return top K results (default: all)

Output parameters:

- `avg_doc_length` (number)
- `b`
- `bm25_score` (number)
- `doc_length` (number)
- `doc_preview`
- `documents_count` (number)
- `index`
- `k1`
- `query`
- `results`

### `build_rag_prompt` (~163 tokens)

Assemble a complete RAG (Retrieval-Augmented Generation) prompt from retrieved context chunks and a user query. Handles token budgeting, citation numbering, system instruction injection, and source attribution.

Input parameters:

- `chunks` (array, required): Retrieved context chunks with .text (required), .source (optional), .score (optional)
- `cite_sources` (boolean): Add [1], [2] citation numbers (default: true)
- `language` (string): Response language instruction (e.g. "French", "Spanish")
- `max_context_tokens` (number): Max tokens for context section (default: 2000)
- `query` (string, required): The user question to answer
- `system_instruction` (string): Custom system instruction (default: standard RAG grounding instruction)

Output parameters:

- `chunks_included` (number)
- `chunks_truncated` (number)
- `context_tokens_estimate` (number)
- `included_chunks`
- `prompt`
- `system_prompt`
- `total_tokens_estimate` (number)

### `prompt_template_fill` (~103 tokens)

Fill a prompt template with variables. Supports {{variable}} syntax and {{#if key}}...{{/if}} conditional blocks. Returns the filled prompt and lists unfilled variables.

Input parameters:

- `strict` (boolean): Throw error if any variable is not provided (default: false)
- `template` (string, required): Prompt template with {{variable}} placeholders
- `variables` (object): Key-value pairs to fill (e.g. {"name":"Alice","role":"engineer"})

Output parameters:

- `filled_variables`
- `result`
- `total_vars`
- `unfilled_variables`

### `few_shot_formatter` (~107 tokens)

Format few-shot examples for LLM prompts. Converts example pairs into formatted blocks. Supports chat format (User/Assistant), XML tags, Markdown, or plain text.

Input parameters:

- `examples` (array, required): Array of {input, output} pairs
- `format` (string): Output format (default: chat)
- `input_label` (string): Label for input (default: User / <input>)
- `output_label` (string): Label for output (default: Assistant / <output>)

Output parameters:

- `example_count` (number)
- `format`
- `formatted`
- `token_estimate` (number)

### `system_prompt_builder` (~136 tokens)

Build a structured system prompt from components: role, task, constraints, output format, tone, language, and examples. Generates a production-ready system prompt with token estimate.

Input parameters:

- `constraints` (array): Rules and constraints to follow
- `examples` (string): Brief examples to include
- `language` (string): Response language (e.g. "French")
- `output_format` (string): Expected output format description
- `role` (string, required): Role/persona (e.g. "Senior QA Engineer", "JSON extraction assistant")
- `task` (string): Main task or objective
- `tone` (string): Communication tone

Output parameters:

- `sections` (object)
- `system_prompt`
- `token_estimate` (number)

### `model_info` (~109 tokens)

Get detailed specs for an AI model: context window, pricing per 1K tokens, knowledge cutoff, provider, multimodal support, reasoning capabilities, and feature list. Covers 30+ models from OpenAI, Anthropic, Google, DeepSeek, Meta, Mistral, Cohere, xAI.

Input parameters:

- `model` (string, required): Model name (e.g. "gpt-4o", "claude-3.5-sonnet", "gemini-2.5-pro")

Output parameters:

- `model`
- `pricing_per_1k` (object)

### `compare_models` (~102 tokens)

Compare 2-5 AI models side by side: context window, pricing, multimodal, reasoning capabilities, and provider. Returns a comparison table with a recommendation based on your use case.

Input parameters:

- `models` (array, required): Array of 2-5 model names (e.g. ["gpt-4o","claude-3.5-sonnet","gemini-2.0-flash"])
- `use_case` (string): Optimize recommendation for this criterion

Output parameters:

- `cost_per_1k_total` (string)
- `model`
- `models_compared` (number)
- `recommendation`
- `rows`
- `use_case`

### `http_status_lookup` (~72 tokens)

Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers all standard 1xx-5xx codes.

Input parameters:

- `code` (number, required): HTTP status code (e.g. 200, 404, 429, 503)

Output parameters:

- `cacheable`
- `class`
- `code`
- `desc` (string)
- `description`
- `name` (string)

### `parse_http_headers` (~88 tokens)

Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing security headers (HSTS, CSP, X-Frame-Options, etc.).

Input parameters:

- `analyze_security` (boolean): Audit for missing security headers (default: true)
- `headers` (string, required): Raw HTTP headers (one "Name: Value" per line)

Output parameters:

- `header_count` (number)
- `parsed` (object)
- `security` (object)

### `generate_curl` (~154 tokens)

Generate a curl command from request parameters. Supports GET/POST/PUT/DELETE, custom headers, JSON body, and form data. Useful for documentation, sharing, and debugging API calls.

Input parameters:

- `body` (string): Raw request body string
- `body_json` (object): JSON body (auto-adds Content-Type: application/json)
- `follow_redirects` (boolean): Follow redirects with -L flag (default: true)
- `headers` (object): Request headers as key-value object
- `method` (string): HTTP method (default: GET)
- `url` (string, required): Request URL (must be http/https)
- `verbose` (boolean): Add -v for verbose output (default: false)

Output parameters:

- `curl` (string)
- `header_count` (number)
- `method`
- `url`

### `extract_todos` (~111 tokens)

Extract TODO, FIXME, HACK, BUG, NOTE, OPTIMIZE, and custom tags from any source code or text. Returns line numbers, tag types, and message text. Essential for technical debt auditing.

Input parameters:

- `include_context` (boolean): Include full line text (default: true)
- `input` (string, required): Code or text to scan
- `tags` (array): Custom tags to add (default set: TODO, FIXME, HACK, NOTE, BUG, OPTIMIZE, XXX)

Output parameters:

- `counts`
- `has_critical` (boolean)
- `items`
- `total` (number)

### `detect_secrets` (~97 tokens)

Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and generic passwords. Returns findings with severity. Run before every commit.

Input parameters:

- `filename` (string): Optional filename for context (e.g. ".env", "config.js")
- `input` (string, required): Code or config content to scan (max 500KB)

Output parameters:

- `filename`
- `findings`
- `recommendation`
- `risk_level`
- `total_findings` (number)

### `count_code_lines` (~109 tokens)

Count lines of code: total, code lines, comment lines, blank lines, and comment density. Supports JS/TS, Python, Java/C/C++, Ruby, Go, Shell, HTML/XML, and CSS.

Input parameters:

- `input` (string, required): Source code to analyze
- `language` (string): Language hint: "js", "ts", "py", "java", "c", "rb", "go", "sh", "html", "css" (auto-detect if omitted)

Output parameters:

- `blank_lines`
- `code_lines`
- `code_to_comment_ratio` (string)
- `comment_density`
- `comment_lines`
- `language`
- `total_lines`

### `lint_commit_message` (~91 tokens)

Validate a git commit message against the Conventional Commits spec (feat, fix, docs, style, refactor, test, chore, ci, perf, build). Returns compliance score, breaking change detection, and actionable suggestions.

Input parameters:

- `message` (string, required): Git commit message to validate
- `strict` (boolean): Enforce strict rules: max 72-char subject, imperative mood check (default: false)

Output parameters:

- `checks`
- `has_body` (boolean)
- `is_breaking_change` (boolean)
- `scope`
- `score` (number)
- `subject`
- `type`
- `valid` (boolean)

### `word_frequency` (~111 tokens)

Analyze word frequency in text. Returns top N words with counts and percentages. Supports English stopword filtering. Useful for content analysis, keyword extraction, and LLM output analysis.

Input parameters:

- `input` (string, required): Text to analyze
- `min_length` (number): Minimum word length to include (default: 3)
- `remove_stopwords` (boolean): Remove common English stopwords (default: true)
- `top_n` (number): Return top N words (default: 20, max: 200)

Output parameters:

- `stopwords_removed`
- `top_words` (array)
- `total_words`
- `unique_words` (number)

### `extract_links` (~69 tokens)

Extract all URLs, email addresses, and domain names from text. Returns categorized and deduplicated results. Useful for content auditing, link checking, and web scraping validation.

Input parameters:

- `input` (string, required): Text to extract links from
- `types` (array): Types to extract (default: all three)

Output parameters:

- `total`

### `levenshtein_distance` (~109 tokens)

Compute the Levenshtein (edit) distance and normalized similarity ratio between two strings. Supports batch comparison. Useful for fuzzy string matching, deduplication, and test result comparison.

Input parameters:

- `a` (string): First string (single-pair mode)
- `b` (string): Second string (single-pair mode)
- `batch` (array): Batch of {a,b} pairs (max 50)
- `case_insensitive` (boolean): Ignore case differences (default: false)

Output parameters:

- `a`
- `b`
- `count` (number)
- `distance`
- `mode` (string)
- `operations_needed`
- `results`
- `similarity` (string)

### `json_diff` (~89 tokens)

Compute a deep structural diff between two JSON values. Returns added, removed, and changed keys with dot-notation paths. Like git diff but for JSON objects — perfect for API response regression testing.

Input parameters:

- `after` (string, required): Modified JSON string (after)
- `before` (string, required): Original JSON string (before)
- `max_depth` (number): Max nesting depth to recurse (default: 10)

Output parameters:

- `added` (boolean)
- `changes` (array)
- `identical` (boolean)
- `modified` (boolean)
- `removed` (boolean)
- `total_changes` (number)

### `merge_json` (~92 tokens)

Deep merge two JSON objects. Supports three array strategies: replace (default), concat, or unique (dedup concat). Nested objects are recursively merged — override takes precedence for primitives.

Input parameters:

- `array_strategy` (string): Array merge strategy: replace (default), concat, or unique
- `base` (string, required): Base JSON object (will be merged into)
- `override` (string, required): Override JSON object (takes precedence)

Output parameters:

- `merged`
- `new_keys` (array)
- `overridden_keys` (array)
- `total_keys` (number)

### `json_to_yaml` (~67 tokens)

Convert a JSON object to clean, human-readable YAML. Handles nested objects, arrays, multiline strings, and special characters. No external dependencies.

Input parameters:

- `indent` (number): Indentation size in spaces (default: 2)
- `input` (string, required): JSON string to convert to YAML

Output parameters:

- `lines` (number)
- `yaml`

### `generate_hmac` (~117 tokens)

Compute an HMAC signature for a message using a secret key. Supports SHA-256 (default), SHA-512, SHA-1, and MD5. Used for API request signing, webhook verification (GitHub, Stripe, Twilio), and JWT validation.

Input parameters:

- `algorithm` (string): Hash algorithm: sha256 (default), sha512, sha1, md5
- `encoding` (string): Output encoding (default: hex)
- `message` (string, required): Message to sign
- `secret` (string, required): Secret key

Output parameters:

- `algorithm`
- `encoding`
- `hmac`
- `message_length` (number)

### `format_bytes` (~124 tokens)

Convert raw byte counts to human-readable sizes in SI (KB=1000) or IEC (KiB=1024) units, or parse size strings back to bytes. Covers B, KB/KiB, MB/MiB, GB/GiB, TB/TiB, PB/PiB.

Input parameters:

- `bytes` (number): Number of bytes to format
- `size_string` (string): Size string to parse to bytes (e.g. "1.5 GB", "512 MiB")
- `standard` (string): Output standard (default: both)

Output parameters:

- `bytes` (number)
- `original`

### `detect_language` (~80 tokens)

Detect the natural language of a text using n-gram frequency analysis and common word markers. Supports 15 languages: English, French, Spanish, German, Italian, Portuguese, Dutch, Russian, Chinese, Japanese, Korean, Arabic, Polish, Turkish, Swedish.

Input parameters:

- `input` (string, required): Text to detect language from (min 20 chars for accuracy)

Output parameters:

- `confidence` (number)
- `lang`
- `language` (string)
- `matched`
- `method` (string)
- `name` (string)
- `score`
- `top_candidates` (array)

### `pr_gatekeeper` (~162 tokens)

Compound quality gate for pull requests. Runs three sequential checks: (1) secret detection — scans diff for API keys, tokens, passwords matching 16 regex patterns; (2) bug analysis — heuristic scan for eval(), innerHTML, empty catch, console.log, TODO/FIXME; (3) commit message linting against Conventional Commits spec. Returns gate verdict (PASS/WARN/BLOCK), blockers, and actionable warnings. Use before merging any code change.

Input parameters:

- `commit_message` (string, required): The commit message to lint (e.g. "feat(auth): add OAuth2 login")
- `context` (string): Optional: PR title or description for richer bug analysis
- `diff` (string, required): Unified git diff (output of `git diff HEAD`)

Output parameters:

- `checks` (object)
- `flags` (array)
- `score` (number)
- `verdict` (string)

### `list_llm_models` (~137 tokens)

List all LLM models available on ia-qa.com with their provider, API endpoint, and capabilities. Filter by provider name (e.g. "Groq", "HuggingFace", "OpenAI") or return the full catalog. Use this to discover which models are available before calling an LLM API, or to compare providers.

Input parameters:

- `provider` (string): Filter by provider name (case-insensitive). E.g. "Groq", "HuggingFace", "OpenAI", "Anthropic", "Google", "DeepSeek", "xAI", "Ollama". Omit for full catalog.

Output parameters:

- `filter`
- `models`
- `providers`
- `total` (number)

### `llm_generate` (~352 tokens)

Generate text using open-source LLM models hosted on Groq (ultra-fast) or HuggingFace Inference (serverless). No API key required — the server provides its own keys. Supported models: Qwen3 32B, Gemma 4 27B, Gemma 3 27B, Llama 3.3 70B, Llama 4 Scout, DeepSeek R1, Mistral Small 24B, and more. Use list_llm_models to see the full catalog. Rate-limited to prevent abuse.

Input parameters:

- `max_tokens` (number): Maximum tokens to generate (default: 2048, max: 4096)
- `model` (string): Model ID (default: "qwen/qwen3-32b"). Server-keyed whitelist only — Groq: qwen/qwen3-32b, llama-3.3-70b-versatile, meta-llama/llama-4-scout-17b-16e-instruct, llama-3.1-8b-instant; HuggingFace: Qwen/Q…
- `prompt` (string, required): The user prompt / instruction to send to the model
- `system` (string): Optional system prompt to set context or persona
- `temperature` (number): Sampling temperature 0.0–1.5 (default: 0.7)

Output parameters:

- `content`
- `latency_ms` (number)
- `model`
- `provider`
- `usage`

### `rerank_evaluate` (~150 tokens)

Evaluate RAG retrieval quality using the NVIDIA neural reranker (nv-rerankqa-mistral-4b-v3). Ranks passages by semantic relevance to a query and computes Precision@k and Recall@k. Optionally accepts ground-truth relevance labels to produce a PASS/FAIL CI/CD verdict.

Input parameters:

- `passages` (array, required): Array of passage objects to rank (min 2, max 20)
- `query` (string, required): The search query or question to rank against
- `threshold` (number): Minimum Precision@k to PASS (0-1, default 0.5)
- `top_k` (integer): k for Precision@k evaluation (default 3)

Output parameters:

- `model` (string)
- `query` (string)
- `results` (array)
- `top_n` (number)

### `shield_analyze` (~248 tokens)

Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 6 deterministic safety checks plus an optional LLM-powered deep analysis in parallel: hallucination detection (grounding score), prompt injection scan, toxicity scan, output validation (PII/safety), guardrail rules, response quality scoring, and AI verdict (via Qwen, Gemma, Llama, etc.). Returns a unified PASS/FIX/BLOCK verdict with a 0-100 safety score, per-check results, and actionable fix recommendations. Use this as a single-call safety gate before surfacing any LLM output to users.

Input parameters:

- `model` (string): LLM model for AI-powered deep analysis (default: "qwen/qwen3-32b"). Set to "none" to skip LLM check. Supports any model from list_llm_models.
- `prompt` (string): Optional original prompt (used for quality scoring and injection detection)
- `response` (string, required): The LLM-generated response to analyze
- `rules` (array): Optional guardrail rules array (same format as guardrail_test tool)
- `source` (string): Optional reference/source text for hallucination grounding check

Output parameters:

- `checks` (object)
- `flags`
- `grade`
- `score`
- `verdict`

### `security_headers_check` (~265 tokens)

Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header (A–F) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Embedder-Policy. Returns an overall score (0–100), per-header grades, missing headers, and fix snippets for Express, Nginx, and Apache. For localhost/private targets the remote server cannot reach, pass the `headers` parameter instead of `url`.

Input parameters:

- `headers`: Optional, and sufficient on its own (no url needed). The response headers to grade, either as an object {"strict-transport-security": "max-age=...", ...} or as the raw header block pasted as a string…
- `url` (string): Optional. Full public URL to check (e.g. https://example.com). Omit it entirely when using `headers`. The server cannot reach localhost/private IPs.

Output parameters:

- `details`
- `fix`
- `grade`
- `header`
- `headers_checked` (number)
- `key`
- `missing`
- `missing_count` (number)
- `overall_grade`
- `score`
- `source`
- `url`
- `value`
- `weak`
- `weak_count` (number)
- `weight`

### `ssl_certificate_check` (~122 tokens)

Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key exchange info, and an overall grade (A+, A, B, C, F). Detects expired, self-signed, and weak certificates. Use this to audit TLS posture before production deployment or during security reviews.

Input parameters:

- `host` (string, required): Hostname to check (e.g. example.com). Do not include https:// prefix.
- `port` (number): Port number (default: 443)

Output parameters:

- `cipher` (object)
- `days_until_expiry` (number)
- `grade` (string)
- `host` (string)
- `is_expired` (boolean)
- `is_self_signed` (boolean)
- `issuer` (object)
- `issues` (array)
- `protocol` (string)
- `subject` (object)
- `valid_from` (string)
- `valid_to` (string)

### `cors_test` (~131 tokens)

Test a URL for CORS misconfigurations. Sends preflight (OPTIONS) and cross-origin requests with various Origin headers to detect: wildcard origins with credentials, origin reflection (echoing any origin), null origin acceptance, subdomain wildcard bypass, and missing Vary headers. Returns risk level (safe/low/medium/high/critical), per-test results, and fix recommendations. Essential for API security audits.

Input parameters:

- `origin` (string): Custom Origin header to test (default: tests multiple origins automatically)
- `url` (string, required): Full URL to test (e.g. https://api.example.com/endpoint)

Output parameters:

- `origins_tested` (number)
- `risk_level`
- `tests`
- `total_findings` (number)
- `url`

### `cors_checker` (~114 tokens)

Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-* headers, the tested origin, and the preflight OPTIONS response. Use this for direct CORS debugging, not just security auditing.

Input parameters:

- `method` (string): HTTP method to simulate (default: GET)
- `origin` (string): Origin header to simulate (default: https://yourdomain.com)
- `url` (string, required): Full URL to test, e.g. https://api.example.com/resource

Output parameters:

- `allHeaders`
- `corsHeaders`
- `method`
- `preflight`
- `status`
- `testedOrigin`
- `url`

### `webhook_endpoint_create` (~76 tokens)

Create a temporary webhook endpoint that captures incoming HTTP requests for one hour. Returns the webhook id, public URL, expiration timestamp, and current request count. Use together with webhook_endpoint_requests to inspect captured payloads.

Input parameters:

- `base_url` (string): Optional public base URL. Default: https://ia-qa.com/mcp/webhook

Output parameters:

- `expires_at` (string)
- `id`
- `request_count` (number)
- `retention_minutes` (number)
- `url` (string)

### `webhook_endpoint_requests` (~78 tokens)

Fetch the requests captured by a webhook created with webhook_endpoint_create. Returns the newest requests first with method, headers, query params, body payload, and timestamps.

Input parameters:

- `id` (string, required): Webhook id returned by webhook_endpoint_create
- `limit` (number): Maximum number of requests to return (1-100, default: 20)

Output parameters:

- `expires_at` (string)
- `id` (string)
- `request_count` (number)
- `requests` (array)

### `cookie_security_audit` (~126 tokens)

Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path scope, Max-Age/Expires, __Host-/__Secure- prefixes. Flags insecure patterns: missing HttpOnly on session cookies, missing Secure flag, SameSite=None without Secure, overly broad Domain, and excessive TTL. Returns per-cookie grades and an overall security score (0–100).

Input parameters:

- `url` (string, required): Full URL to audit (e.g. https://example.com/login)

Output parameters:

- `cookies` (array)
- `cookies_found` (number)
- `domain`
- `host_prefix`
- `httpOnly`
- `issues`
- `max_age`
- `message` (string)
- `name`
- `path`
- `sameSite`
- `score` (number)
- `secure`
- `secure_prefix`
- `url`

### `web_security_audit` (~201 tokens)

Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrates security_headers_check + ssl_certificate_check + cors_test + cookie_security_audit in parallel, merges all findings, then asks an AI model to: (1) rank vulnerabilities by real-world exploitability, (2) generate a remediation roadmap, (3) produce fix code snippets for the detected stack. Returns both raw audit data and the AI analysis. Use this as a one-click security posture assessment.

Input parameters:

- `api_key` (string): Your Groq or HuggingFace API key. Required to enable AI analysis.
- `model` (string): LLM model for AI analysis (default: "qwen/qwen3-32b"). Set to "none" to skip AI analysis.
- `url` (string, required): Full URL to audit (e.g. https://example.com)

Output parameters:

- `cookies` (array)
- `cookies_found` (number)
- `details`
- `fix`
- `grade`
- `header`
- `headers_checked` (number)
- `httpOnly`
- `issues`
- `key`
- `message` (string)
- `missing`
- `missing_count` (number)
- `name`
- `origins_tested` (number)
- `overall_grade`
- `risk_level`
- `sameSite`
- `score`
- `secure`
- `tests`
- `total_findings` (number)
- `url`
- `value`
- `weak`
- `weak_count` (number)
- `weight`

### `secret_scan` (~200 tokens)

Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line number, and a redacted preview. Use before committing code, sharing logs, or sending text to an LLM. 100% regex-based, zero network calls.

Input parameters:

- `input` (string, required): Text or code to scan for secrets
- `types` (string): Comma-separated types to scan (default: all). Options: aws, gcp, azure, openai, anthropic, stripe, github, gitlab, slack, twilio, sendgrid, huggingface, jwt, private_key, connection_string, bearer, b…

Output parameters:

- `findings`
- `findings_count` (number)
- `input_lines` (number)
- `risk_level`
- `secrets_found`
- `summary` (string)

### `similarity_score` (~206 tokens)

Compute text similarity between reference and hypothesis using multiple metrics: Cosine (BoW, TF-IDF), Jaccard, ROUGE-1, ROUGE-2, ROUGE-L, and BLEU. No API key needed. Ideal for LLM eval (expected vs actual), RAG quality checks, and NLG benchmarking. Supports batch mode.

Input parameters:

- `batch` (array): Batch mode: array of {reference, hypothesis} pairs.
- `hypothesis` (string): Hypothesis / actual text (LLM output)
- `metrics` (array): Metrics to compute (default: all). Options: "cosine_bow", "cosine_tfidf", "jaccard", "rouge1", "rouge2", "rougeL", "bleu"
- `reference` (string): Reference / expected text (ground truth)
- `threshold` (number): Optional pass/fail threshold (0-1). Applies to ROUGE-L F1 score.

Output parameters:

- `count` (number)
- `f1` (number)
- `mode` (string)
- `precision` (number)
- `recall` (number)
- `results`

### `needle_haystack_generate` (~171 tokens)

Generate a "needle in a haystack" test: embeds a target fact into a large block of filler text at a specified position. Use this to test LLM context window retrieval accuracy. Returns the full haystack, the question to ask, and metadata. No API key needed.

Input parameters:

- `needle` (string, required): The fact to hide (e.g. "The secret code is ALPHA-42")
- `position` (string): Where to insert the needle: "start", "middle", "end", "random" (default: "middle")
- `question` (string, required): The question to ask the LLM (e.g. "What is the secret code?")
- `tokens` (integer): Target haystack size in tokens (default: 5000, max: 100000)

Output parameters:

- `estimated_tokens`
- `haystack`
- `insert_block`
- `needle`
- `position`
- `question`
- `total_blocks` (number)

### `optimize_prompt_tokens` (~74 tokens)

Compress an LLM prompt by removing filler words, verbose phrases, duplicate sentences, and unnecessary whitespace. Returns optimized text with token savings breakdown. 100% deterministic, no API key needed.

Input parameters:

- `options` (object): Toggle optimization steps (all true by default)
- `text` (string, required): The prompt text to optimize

Output parameters:

- `optimized`
- `percent_saved` (string)
- `steps`
- `tokens_after`
- `tokens_before`
- `tokens_saved`

### `bias_detect` (~86 tokens)

Analyse a set of LLM responses generated from the same prompt template but with different demographic variants (gender, origin, age, tone). Returns a bias score (0-100), sentiment analysis per variant, pairwise Jaccard similarity, and a human-readable verdict. No API key needed — runs entirely locally.

Input parameters:

- `responses` (array, required): Array of variant responses to compare for bias

Output parameters:

- `avgSimilarity` (string)
- `biasScore`
- `lengthCV` (string)
- `minSimilarity` (string)
- `negative`
- `pairwiseSimilarities`
- `positive`
- `ratio`
- `sentimentVariance` (string)
- `sentiments`
- `verdict`

### `llm_fit_finder` (~254 tokens)

Find the best LLM for a given use case. Compares 30+ cloud API models and 12+ local models by cost, speed, benchmarks, features and VRAM requirements. Returns ranked recommendations with cost simulation. No API key needed.

Input parameters:

- `features` (array): Required features: vision, function_calling, json_mode, streaming, reasoning
- `max_budget` (number): Maximum monthly budget in USD (based on tokens_per_day)
- `mode` (string): cloud (API models) or local (Ollama/self-hosted). Default: cloud
- `quantization` (string): Quantization (only for mode=local): Q4_K_M | Q8_0 | FP16. Default: Q4_K_M
- `tokens_per_day` (number): Estimated daily token volume (default: 100000)
- `top_n` (number): Number of recommendations to return (default: 5)
- `use_case` (string): Primary use case: chatbot | code | rag | summarization | classification | reasoning | agents | multilingual
- `vram_gb` (number): GPU VRAM in GB (only for mode=local). Default: 16

Output parameters:

- `mode` (string)
- `quantization`
- `results` (array)
- `score` (number)
- `tokens_per_day`
- `total_matching` (number)
- `use_case`
- `vram_gb`

### `diff_mappings` (~199 tokens)

Diff a baseline page mapping against a current one and return a CI-style verdict: PASS / FIX / BLOCK, plus per-element drift (ok, renamed, healable, ambiguous, lost, added, rebound). Pure and deterministic — provide two mappings as JSON with "elements" arrays of {role, name, selector, context?}. Use the companion @ia-qa/self-healing package (npm install -g @ia-qa/self-healing) to capture mappings from your app via its local MCP server ia-qa-heal-mcp, or paste the snippet from ia-qa.com/devtools/selector-drift into your browser console.

Input parameters:

- `after` (object, required): Current page mapping: same shape as before, captured after the UI change.
- `before` (object, required): Baseline page mapping: { page, url, capturedAt, elements: [{role, name, selector, context?}] }. Captured before a UI change.

Output parameters:

- `added` (array)
- `counts` (object)
- `rows` (array)
- `verdict`

### `find_tool` (~197 tokens)

Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this when you are unsure which tool to use or want to explore the catalogue. Categories: data, encoding, text, llm, qa, rag, dev, security, web.

Input parameters:

- `category` (string): Optional: filter by category — data | encoding | text | llm | qa | rag | dev | security | web
- `max_results` (number): Maximum tools to return (default 10, max 50). Results are ranked by IDF-weighted relevance, so common words like "test" do not inflate the list.
- `query` (string, required): Keyword(s) to search in tool name and description (e.g. "cors", "token", "vector", "json")
- `with_schema` (boolean): Set true to include inputSchema in results (default: false)

Output parameters:

- `category`
- `count` (number)
- `hint`
- `query`
- `score`
- `tool`
- `tools` (array)
- `total_matches` (number)
- `truncated` (boolean)

### `list_local_tests` (~70 tokens)

Discover .ia-eval.yaml LLM test suite files in the project directory. Scans CWD and standard sub-directories (evals/, tests/, contracts/). Returns file paths ready to pass to run_eval_contract.

Input parameters:

- `dir` (string): Directory to scan (defaults to server CWD)

Output parameters:

- `count` (number)
- `dir` (string)
- `files` (array)

### `run_eval_contract` (~202 tokens)

Parse a .ia-eval.yaml LLM test suite, call the specified LLM model for each scenario, run all configured scorers, and return a structured JSON report with per-scenario Pass/Fail verdicts and a Markdown summary. Use list_local_tests to discover available test files.

Input parameters:

- `api_keys` (object): API keys to use for LLM generation (all optional — falls back to server env vars)
- `contract_path` (string): Absolute or relative path to a .ia-eval.yaml file (required unless inline_contract is provided)
- `inline_contract` (object): Raw contract object (alternative to contract_path). Must contain top-level "metadata" ({name, version, model?, provider?}), "expectations" ({min_score?}), and "scenarios" ([{id, input, ground_truth?}…
- `overrides` (object): Override contract defaults

Output parameters:

- `contract_path`
- `metadata` (object)
- `scenario_results`
- `summary` (object)
- `warnings`

### `generate_html_report` (~79 tokens)

Convert a run_eval_contract() LLM Test Runner JSON result into a fully self-contained dark-themed HTML report with Pass/Fail badges, side-by-side Input/Output/Ground-Truth panels, evaluator score bars, and a radar chart. Returns the HTML as a string.

Input parameters:

- `results` (object, required): The JSON object returned by run_eval_contract()

Output parameters:

- `html`

### `run_vlm_test_suite` (~301 tokens)

Run a test suite against a Vision-Language Model (VLM) — send an image (URL or base64) + N test cases (each with a question + assertion) to GPT-4o, Claude 3.5, or Gemini. Returns per-case PASS/FAIL verdicts, a pass rate, an overall PASS/WARNING/FAIL verdict (customizable threshold), and latency stats. Assertion types: contains, not_contains, json_format, min_length, max_length, semantic_contains (TF-IDF cosine similarity ≥ 0.4). BYOK: requires your own API key for the target provider.

Input parameters:

- `api_key` (string, required): API key for the model provider (OpenAI sk-, Anthropic sk-ant-, or Google AIzaSy...).
- `image_base64` (string): Base64-encoded image data (required unless image_url is provided).
- `image_mime_type` (string): MIME type of the image if using image_base64 (default: image/jpeg).
- `image_url` (string): Public URL of the image to evaluate (required unless image_base64 is provided).
- `model` (string, required): VLM model to use.
- `system_prompt` (string): Optional system prompt sent to the VLM.
- `test_cases` (array, required): Array of test cases to run.
- `threshold` (number): Pass rate threshold for overall verdict (default: 80, 0–100).

Output parameters:

- `failed` (number)
- `model` (string)
- `passed` (number)
- `results` (array)
- `total` (number)
- `verdict` (string)

### `multimodal_eval_guide` (~409 tokens)

Unified tool for multimodal AI evaluation: set action=guide for reference thresholds/interpretation (CLIP, FID, VQA), or set action=clip_score / fid_score / vqa_accuracy / pipeline to compute real metrics via HuggingFace Inference API and VLM BYOK calls. One tool for both reference and computation.

Input parameters:

- `action` (string): guide (default) = reference thresholds/interpretation. clip_score/fid_score/vqa_accuracy = compute that metric. pipeline = run all three.
- `api_key` (string): [vqa_accuracy] Your API key for the provider (BYOK).
- `clip` (object): [pipeline] {image_url, text} for CLIP.
- `fid` (object): [pipeline] {real_images, generated_images} for FID.
- `generated_images` (array): [fid_score] Array of generated image URLs.
- `image_base64` (string): [clip_score/vqa_accuracy] Base64-encoded image data.
- `image_mime_type` (string): [clip_score/vqa_accuracy] MIME type for base64 image.
- `image_url` (string): [clip_score/vqa_accuracy] Public URL of the image.
- `metric` (string): [guide only] Metric to explain.
- `model` (string): [vqa_accuracy] VLM model ID (default: gpt-4o).
- `real_images` (array): [fid_score] Array of real image URLs.
- `score` (number): [guide only] Optional score value to interpret.
- `system_prompt` (string): [vqa_accuracy] Optional system prompt.
- `test_cases` (array): [vqa_accuracy] Array of {question, accepted_answers} objects.
- `text` (string): [clip_score only] Text description to compare against the image.
- `vqa` (object): [pipeline] VQA config object (same inputs as vqa_accuracy).

Output parameters:

- `best_practices` (array)
- `comparison_table` (array)
- `errors`
- `metrics`
- `results`
- `web_tool` (string)

### `run_vlm_test_suite_batch` (~285 tokens)

Compare multiple VLMs on the same test suite in parallel — send an image (URL or base64) + N test cases to all models simultaneously. Returns per-model PASS/FAIL verdicts, pass rates, latency stats, and a comparison table. Assertion types: contains, not_contains, json_format, min_length, max_length, semantic_contains. BYOK: requires API keys for each provider.

Input parameters:

- `api_keys` (object, required): Map of model ID → API key. Example: { "gpt-4o": "sk-...", "claude-3-5-sonnet-20241022": "sk-ant-..." }
- `image_base64` (string): Base64-encoded image data (required unless image_url is provided).
- `image_mime_type` (string): MIME type of the image if using image_base64 (default: image/jpeg).
- `image_url` (string): Public URL of the image to evaluate (required unless image_base64 is provided).
- `models` (array, required): Array of model IDs to compare (runs in parallel).
- `system_prompt` (string): Optional system prompt sent to every VLM.
- `test_cases` (array, required): Array of test cases to run against every model.
- `threshold` (number): Pass rate threshold for overall verdict (default: 80, 0–100).

Output parameters:

- `suites` (array)
- `total_failed` (number)
- `total_passed` (number)
- `verdict` (string)

### `generate_eval_yaml` (~191 tokens)

Generate a complete .ia-eval.yaml evaluation contract from a plain-language description of what your LLM should do. Uses Groq llama-3.3-70b (server-side, no API key needed). Returns ready-to-run YAML for the LLM Test Runner (run_eval_contract). Picks appropriate evaluators (cosine_similarity, contains_check, hallucination_check, etc.) based on the task type.

Input parameters:

- `description` (string, required): Plain-language description of what the LLM under test should do. Be specific: describe inputs, expected behaviour, and constraints.
- `scenario_count` (number): Number of scenarios to generate (default: 5). Covers happy path + edge cases + adversarial.
- `system_prompt` (string): Optional system prompt of the LLM under test. Helps generate more accurate test cases.
- `task_type` (string): Optional task type hint to guide evaluator selection.

Output parameters:

- `model_used` (string)
- `scenario_count` (number)
- `task_type` (string)
- `yaml` (string)

### `generate_ci_workflow` (~458 tokens)

Generate a ready-to-commit GitHub Actions workflow that gates a build on IA-QA. Two gate types, combinable: "eval_contract" runs a .ia-eval.yaml through ia-qa-com/eval-action@v1 (LLM quality gate, needs a provider API key as a repo secret), and "cli_checks" runs deterministic primitives via npx @ia-qa/cli (secret scan, prompt-injection scan, security headers…) whose exit code fails the build. Deterministic template — no LLM call, no API key, same inputs give the same file. Returns the YAML, the secrets to create, and the remaining steps. Pair with generate_eval_yaml to produce the contract itself.

Input parameters:

- `cli_tools` (array): IA-QA tool names to run as deterministic gates, e.g. ["secret_scan","prompt_injection_scan"]. Tools with no known CI recipe get a --stdin step flagged in notes.
- `contract_path` (string): Path to the .ia-eval.yaml contract, relative to the repo root (default: evals/smoke.ia-eval.yaml). Only used when the gate includes eval_contract.
- `cron` (string): Cron expression when triggers include 'schedule' (default: '0 6 * * 1' — Mondays 06:00 UTC).
- `fail_on_fail` (boolean): Fail the build on a FAIL/PARTIAL verdict (default: true). Set false to report without gating.
- `gate` (string): Which gate to emit. eval_contract = LLM eval via the action (default). cli_checks = deterministic CLI assertions. both = CLI checks first, eval last.
- `min_score` (number): Override the contract min_score (0-100). Omit to use the value in the contract.
- `node_version` (string): Node version for the CLI steps (default: "20").
- `provider` (string): LLM provider the contract runs against — decides which repository secret the workflow wires (default: groq).
- `triggers` (array): Workflow triggers (default: push + pull_request).
- `workflow_name` (string): Workflow display name (default: "IA-QA Quality Gate").

Output parameters:

- `gate` (string)
- `next_steps` (array)
- `notes` (array)
- `path` (string)
- `secrets_required` (array)
- `yaml` (string)

### `validate_agent_trajectory` (~166 tokens)

Run declarative assertions on an agent trace (OpenAI tool-call messages, LangChain run trees, or plain text logs). No LLM call — deterministic. Assertion types: order (tool A before B), must_call, must_not_call, max_calls, min_calls, no_error, recovery (agent continues after error). Returns per-assertion PASS/FAIL, parsed steps, and an overall verdict. Use this to gate CI/CD on agent behavior correctness.

Input parameters:

- `assertions` (array, required): List of assertions to validate against the trace.
- `format` (string): Trace format. auto (default) detects automatically.
- `trace` (required): Agent execution trace as JSON (OpenAI messages array, LangChain run tree) or plain text log (Thought/Action/Observation format).

Output parameters:

- `assertions` (array)
- `failed` (number)
- `passed` (number)
- `steps` (array)
- `total` (number)
- `verdict` (string)

### `run_semantic_tests` (~216 tokens)

Semantic assertion primitive: compare actual vs expected text pairs using cosine similarity + ROUGE-L. Two modes: tfidf (default, free, no API key) or embeddings (OpenAI text-embedding-3-small, BYOK, true semantic similarity). Returns per-case PASS/FAIL verdicts and an overall verdict. CI-ready: pipe the JSON verdict field to gate a build.

Input parameters:

- `api_key` (string): OpenAI API key — required only when mode is embeddings.
- `cases` (array, required): Array of (actual, expected) pairs to evaluate.
- `mode` (string): tfidf (default): fast, free, lexical. embeddings: OpenAI text-embedding-3-small, true semantic similarity, requires api_key.
- `require_all` (boolean): If true (default), all cases must pass for overall PASS. If false, at least one case passing returns PASS.
- `thresholds` (object): Pass/fail thresholds (defaults: cosine 0.75, rouge_l 0.5).

Output parameters:

- `failed` (number)
- `mode` (string)
- `passed` (number)
- `results` (array)
- `total` (number)
- `verdict` (string)

### `get_testing_guidelines` (~141 tokens)

Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testing, embedding-quality, eval-framework, semantic-testing, auto-testing, security, api-testing, ci-cd, multimodal, llm-data-security, agent-observability, pro-tips, learning-paths, golden-dataset.

Input parameters:

- `topic` (string): The testing topic to retrieve guidelines for. Omit to get the full list of available topics.

Output parameters:

- `available_topics` (array)
- `keywords` (array)
- `tip` (string)
- `topic`
- `usage` (string)

### `test_skill` (~255 tokens)

Validate a SKILL.md definition (Cursor / GitHub Copilot / Windsurf) by auto-generating trigger-positive and trigger-negative scenarios, running each through the model with the skill injected as a system prompt, and scoring trigger accuracy + step adherence. Returns a PASS/FIX/BLOCK verdict with per-scenario breakdown. Uses Groq llama-3.3-70b by default (server key, no api_key needed). Pass api_key + model to use your own provider.

Input parameters:

- `api_key` (string): API key for the chosen model provider. Not required when using the default Groq model.
- `model` (string): LLM model ID to use for both scenario generation and testing (e.g. gpt-4o-mini, claude-3-5-haiku-20241022). Defaults to llama-3.3-70b-versatile (Groq, server key).
- `scenario_count` (number): Number of test scenarios to generate: half trigger-positive, half trigger-negative. Default: 6.
- `skill_md` (string, required): Full content of the SKILL.md file to test. Must include a name, a "Use when:" trigger description, and at least one step.

Output parameters:

- `scenarios` (array)
- `score` (number)
- `step_adherence` (number)
- `trigger_accuracy` (number)
- `verdict` (string)

### `identify_caller` (~71 tokens)

Returns what the server knows about the current MCP client: clientInfo captured during initialize, User-Agent, and any _meta fields sent with this request. Useful for debugging caller identification.

Input parameters:

- `_meta` (object): Optional self-identification. Keys: agent (string), model (string), version (string).

Output parameters:

- `effective_agent` (string)
- `meta_override` (object)
- `note` (string)
- `session` (object)

### `yaml_to_json` (~102 tokens)

Parse a YAML string and return the equivalent JSON value. The reverse of json_to_yaml. Supports nested objects, arrays, anchors, aliases, multi-document streams, and all scalar types. Use when processing config files, CI/CD pipeline definitions, or OpenAPI specs authored in YAML.

Input parameters:

- `input` (string, required): YAML string to parse
- `multi` (boolean): If true, parse all documents in a multi-document stream and return an array (default: false)

Output parameters:

- `count` (number)
- `documents`
- `json`

### `env_parse` (~93 tokens)

Parse a .env file content into a JSON object. Handles quoted values (single and double), inline comments, export prefix, and escaped sequences (\n, \t inside double quotes). Returns all key-value pairs. Use in CI/CD pipelines, agent config loaders, or when processing dotenv files programmatically.

Input parameters:

- `input` (string, required): .env file content to parse (e.g. the output of `cat .env`)

Output parameters:

- `count` (number)
- `vars`

### `json_schema_generate` (~134 tokens)

Infer a JSON Schema (draft-07) from a sample JSON value. Detects types, required fields, array item shapes, nested objects, and common string formats (email, uri, date, date-time, uuid). Returns a ready-to-use schema compatible with json_schema_validate. Use when you have a sample API response or LLM output and want to auto-generate a validation schema for CI/CD testing.

Input parameters:

- `input` (string, required): Sample JSON value (object, array, or scalar) to infer the schema from
- `required_all` (boolean): Mark all detected object properties as required (default: true)

Output parameters:

- `format`
- `items` (object)
- `schema` (object)
- `type` (string)

### `format_table` (~99 tokens)

Convert a JSON array of objects into a Markdown table. Automatically detects columns, aligns headers, and fills missing keys with empty cells. Use when an agent needs to present structured data — tool results, model comparisons, test reports — as a readable table in a response or document.

Input parameters:

- `columns` (array): Column names and order (default: all keys from first row)
- `input` (string, required): JSON array of objects to convert to a Markdown table

Output parameters:

- `columns` (number)
- `rows` (number)
- `table` (string)

### `openapi_validate` (~124 tokens)

Validate the structure of an OpenAPI 3.x specification (JSON or YAML). Checks required top-level fields (openapi, info.title, info.version, paths), validates each operation (responses, operationId uniqueness), detects undeclared $ref components, and flags missing 2xx responses. Returns a PASS/FAIL verdict, a 0–100 compliance score, and a list of errors and warnings with JSON-pointer locations. Use before publishing an API spec or generating SDK code.

Input parameters:

- `input` (string, required): OpenAPI 3.x specification as a JSON or YAML string

Output parameters:

- `errors`
- `score` (number)
- `stats` (object)
- `verdict`
- `warnings`

### `post_jira_comment` (~141 tokens)

Post the output of jira_to_test_suite as a formatted comment on the source Jira ticket. Converts Gherkin, E2E steps, API tests, and ambiguities into Atlassian Document Format (ADF). STATEFUL — creates a comment on the issue.

Input parameters:

- `issue_key` (string, required): Jira issue key, e.g. "PROJ-123"
- `jira_base_url` (string, required): Atlassian base URL
- `jira_email` (string, required): Atlassian account email
- `jira_token` (string, required): Atlassian API token
- `test_suite` (object, required): The test_suite object from jira_to_test_suite result

Output parameters:

- `comment_id` (string)
- `comment_url` (string)
- `success` (boolean)

### `create_confluence_page` (~237 tokens)

Create a new Confluence page from the output of jira_to_test_suite. Formats Gherkin, E2E steps, API tests, and test data as a properly structured Confluence page with code blocks and tables. STATEFUL — creates a new page in the specified space.

Input parameters:

- `confluence_base_url` (string, required): Atlassian base URL
- `confluence_email` (string, required): Atlassian account email
- `confluence_token` (string, required): Atlassian API token
- `issue_key` (string): Source Jira issue key (for the page title and source link)
- `issue_url` (string): Source Jira issue URL (added as a link in the page)
- `parent_page_id` (string): Optional parent page ID — page will be created as a child of this page
- `space_key` (string, required): Confluence space key where the page will be created, e.g. "QA", "ENG"
- `test_suite` (object, required): The test_suite object from jira_to_test_suite result
- `title` (string): Page title. Defaults to "Test Plan: {issue_key}"

Output parameters:

- `page_id` (string)
- `page_url` (string)
- `success` (boolean)
- `title` (string)

### `fetch_jira_issue` (~201 tokens)

Fetch a complete Jira issue: summary, description converted to Markdown, status, assignee, priority, labels, custom fields, and optionally comments and attachment metadata. BYOK — credentials transit in-memory only, never stored on ia-qa.com.

Input parameters:

- `fields` (array): Specific Jira field names to return. Omit for all standard fields.
- `include_attachments` (boolean): Include attachment metadata list (default: false)
- `include_comments` (boolean): Include issue comments, up to 20 (default: true)
- `issue_key` (string, required): Jira issue key, e.g. "PROJ-123"
- `jira_base_url` (string, required): Atlassian base URL, e.g. "https://mycompany.atlassian.net"
- `jira_email` (string, required): Atlassian account email
- `jira_token` (string, required): Atlassian API token (from id.atlassian.com > Security > API tokens)

Output parameters:

- `assignee` (string)
- `description` (string)
- `key` (string)
- `labels` (array)
- `priority` (string)
- `reporter` (string)
- `status` (string)
- `summary` (string)
- `type` (string)
- `url` (string)

### `search_jira_issues` (~200 tokens)

Search Jira using JQL (Jira Query Language). Returns matching issues with key fields. Ideal for finding open bugs, sprint tickets, or issues by label/assignee/component. BYOK — credentials transit in-memory only, never stored.

Input parameters:

- `fields` (array): Fields per issue. Default: summary, status, assignee, priority, issuetype, labels, created, updated
- `jira_base_url` (string, required): Atlassian base URL, e.g. "https://mycompany.atlassian.net"
- `jira_email` (string, required): Atlassian account email
- `jira_token` (string, required): Atlassian API token
- `jql` (string, required): JQL query string, e.g. "project = PROJ AND status = Open AND assignee = currentUser() ORDER BY priority DESC"
- `max_results` (number): Max issues to return (default: 10, max: 50)

Output parameters:

- `issues` (array)
- `jql` (string)
- `returned` (number)
- `total` (number)

### `jira_to_test_suite` (~384 tokens)

Transform a Jira ticket into a complete test suite: Gherkin scenarios, E2E steps, API test cases, test data matrix, and ambiguity detection. Accepts either Jira credentials (auto-fetch) or a pre-fetched issue object. The returned test_suite includes _gherkin_warnings (deterministic syntax validation — empty if clean). Requires BYOK LLM key (OpenAI, Anthropic, etc.).

Input parameters:

- `api_key` (string, required): Your LLM provider API key (OpenAI sk-, Anthropic sk-ant-, Google AIzaSy-, etc.).
- `confluence_pages` (array): Optional array of pre-fetched Confluence page objects from fetch_confluence_page, used as documentation context.
- `issue` (object): Pre-fetched issue object from fetch_jira_issue, OR a mock object with fields: key, summary, description (plain text or Markdown), status, issue_type, priority, labels, comments. Use this for offline/…
- `issue_key` (string): Jira issue key to fetch automatically, e.g. "PROJ-123". Required if issue is not provided.
- `jira_base_url` (string): Atlassian base URL. Required for auto-fetch mode.
- `jira_email` (string): Atlassian account email. Required for auto-fetch mode.
- `jira_token` (string): Atlassian API token. Required for auto-fetch mode.
- `max_tokens` (integer): Maximum tokens for the LLM response. Default: 8192. Increase for large tickets with many ACs; decrease to reduce cost on simple tickets.
- `model` (string, required): LLM model to use, e.g. "gpt-4o-mini", "claude-3-5-haiku-20241022", "gemini-2.0-flash".

Output parameters:

- `issue_key` (string)
- `issue_url` (string)
- `latency_ms` (number)
- `model_used` (string)
- `summary` (string)
- `test_suite` (object)
- `tokens_used` (number)

### `fix_gherkin` (~290 tokens)

Fix Gherkin syntax warnings from a jira_to_test_suite result. Takes the current gherkin text and the _gherkin_warnings array, calls your LLM to fix ONLY the flagged issues (adds missing Given/When/Then steps, etc.), and returns the corrected Gherkin. Lightweight — uses ~300-500 tokens vs ~5k for a full regeneration. Requires BYOK LLM key.

Input parameters:

- `api_key` (string, required): Your own LLM provider API key (BYOK) — OpenAI "sk-…", Anthropic "sk-ant-…", Google "AIzaSy…", or Groq "gsk_…". There is no server-side key for this tool: if you do not have one, do not call it and do…
- `gherkin` (string, required): The current Gherkin text from the jira_to_test_suite result (test_suite.gherkin).
- `model` (string, required): LLM model to use for the fix, e.g. "gpt-4o-mini". Must belong to the provider whose key you passed in api_key.
- `warnings` (array, required): The _gherkin_warnings array from the jira_to_test_suite result.

Output parameters:

- `fixed_gherkin` (string)
- `latency_ms` (number)
- `model_used` (string)
- `remaining_warnings` (array)
- `warnings_after` (number)
- `warnings_before` (number)

### `fetch_confluence_page` (~200 tokens)

Fetch a Confluence page and return its content as clean Markdown. Accepts a numeric page_id or a full page URL. Optionally lists direct child pages. BYOK — credentials transit in-memory only, never stored.

Input parameters:

- `confluence_base_url` (string, required): Atlassian base URL, e.g. "https://mycompany.atlassian.net"
- `confluence_email` (string, required): Atlassian account email (same credentials as Jira)
- `confluence_token` (string, required): Atlassian API token
- `include_children` (boolean): List direct child pages (id + title) (default: false)
- `page_id` (string): Confluence page ID (numeric string), e.g. "123456789"
- `page_url` (string): Full Confluence page URL (alternative to page_id), e.g. "https://mycompany.atlassian.net/wiki/spaces/ENG/pages/123456789"

Output parameters:

- `children` (array)
- `markdown` (string)
- `page_id` (string)
- `title` (string)
- `url` (string)

### `rate_tool` (~237 tokens)

Give honest usage feedback on an IA-QA MCP tool. Provide a score (1-5) and a comment. Rate low (1-2) if the tool was wrong, irrelevant, or a poor fit; rate high (4-5) only if it genuinely solved your need. Ratings are aggregated on a public dashboard at /devtools/mcp-ratings. Skip rating routine successes — we want signal, not praise. Example: rate_tool({ tool_name: "format_json", score: 2, comment: "Tried to pretty-print a JSON5 file, it rejected trailing commas — not usable for my case." })

Input parameters:

- `comment` (string): Strongly encouraged — explain what you were trying to do and whether the tool got you there. Be specific about what was missing, wrong, or a poor fit. This is the most valuable part of the rating (ma…
- `score` (number, required): Rating from 1 (poor) to 5 (excellent)
- `tool_name` (string, required): Name of the MCP tool to rate (e.g. "format_json", "shield_analyze")

Output parameters:

- `comment`
- `message` (string)
- `ok` (boolean)
- `rated_at` (string)
- `score`
- `tool_name`

## Diagnostics

Captured diagnostic sections: TLS, DNSSEC, Authorisation, Transports. The full working is on the page: https://verifymcp.io/servers/jcjamet-ia-qa-toolbox/www#diagnostics

## Score history

- 2026-08-03: 76
- 2026-08-02: 76
- 2026-08-01: 75
- 2026-07-31: 75
- 2026-07-30: 72
- 2026-07-29: 71
- 2026-07-28: 71
- 2026-07-27: 70
- 2026-07-26: 69

## Links

- Remote endpoint: https://www.ia-qa.com/mcp
- Repository: https://github.com/jcjamet/ia-qa
- Changelog RSS feed: https://verifymcp.io/servers/jcjamet-ia-qa-toolbox/www/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/jcjamet-ia-qa-toolbox/www/changelog.json
- HTML version of this page: https://verifymcp.io/servers/jcjamet-ia-qa-toolbox/www