Connect

8 clients · secrets stay placeholders

JSON (mcpServers)Claude CodeCodexOpenCodeCursorVS CodeGemini CLIGoose

{
  "mcpServers": {
    "quasslabs": {
      "type": "http",
      "url": "https://api.quasslabs.com/mcp",
      "headers": {
        "Authorization": "Bearer ${QUASSLABS_TOKEN}"
      }
    }
  }
}

claude mcp add --transport http quasslabs https://api.quasslabs.com/mcp --header "Authorization: Bearer ${QUASSLABS_TOKEN}"

[mcp_servers.quasslabs]
url = "https://api.quasslabs.com/mcp"
bearer_token_env_var = "QUASSLABS_TOKEN"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "quasslabs": {
      "type": "remote",
      "url": "https://api.quasslabs.com/mcp",
      "enabled": true,
      "headers": {
        "Authorization": "Bearer {env:QUASSLABS_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "quasslabs": {
      "type": "http",
      "url": "https://api.quasslabs.com/mcp",
      "headers": {
        "Authorization": "Bearer ${QUASSLABS_TOKEN}"
      }
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=quasslabs&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vYXBpLnF1YXNzbGFicy5jb20vbWNwIiwiaGVhZGVycyI6eyJBdXRob3JpemF0aW9uIjoiQmVhcmVyICR7UVVBU1NMQUJTX1RPS0VOfSJ9fQ%3D%3D"
}

{
  "servers": {
    "quasslabs": {
      "type": "http",
      "url": "https://api.quasslabs.com/mcp",
      "headers": {
        "Authorization": "Bearer ${QUASSLABS_TOKEN}"
      }
    }
  }
}

{
  "mcpServers": {
    "quasslabs": {
      "httpUrl": "https://api.quasslabs.com/mcp",
      "headers": {
        "Authorization": "Bearer ${QUASSLABS_TOKEN}"
      }
    }
  }
}

extensions:
  "quasslabs":
    enabled: true
    name: "quasslabs"
    type: streamable_http
    uri: "https://api.quasslabs.com/mcp"
    headers:
      "Authorization": "Bearer ${QUASSLABS_TOKEN}"
    timeout: 300

Placeholders to fill from your own secret store: ${QUASSLABS_TOKEN}. The registry never accepts secret values.

Quality 75 / 100good

protocol75 · weight 25

warn
protocol.modernnewest supported version is 2025-06-18; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
n/a
protocol.statelessonly applies to 2026-07-28 servers
pass
protocol.transportstreamable HTTP
n/a
protocol.list_ttlonly applies to 2026-07-28 servers

authorizationn/a · weight 15

n/a
auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
n/a
auth.secret_in_urlno templated URL

tool hygiene88 · weight 30

pass
tools.descriptionsevery tool has a description
warn
tools.description_length7 tools have descriptions over 1,024 characters, which crowds the context
pass
tools.schemasevery tool has an object input schema
pass
tools.annotations37 of 37 tools declare readOnlyHint or destructiveHint
pass
tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
warn
tools.token_costabout 16,832 tokens to load every tool
pass
tools.api_dumptools are not a one-to-one API dump
pass
tools.hidden_textno hidden text in tool names, descriptions, schemas or annotations

stability50 · weight 15

warn
stability.changes46 tool changes in 30 days
fail
stability.rug_pull2 tools kept their name but changed most of their description in 30 days; review before trusting them
pass
stability.new_linksno tool change named a new site

dependenciesn/a · weight 15

n/a
deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

37 tools, about 16,832 tokens to load them all · tool set 56ed0c77562c · tools last changed 2026-11-09 · checked 2026-11-14 07:03 UTC

Tool changes

2026-11-09sql_migration_lintadded
Static lint of a SQL migration file (Postgres or MySQL) for operations that lock or rewrite live tables or break running application code. Flags CREATE INDEX without CONCURRENTLY and concurrent index builds inside a transaction, foreign key, CHECK and UNIQUE constraints added without NOT VALID or USING INDEX, SET NOT NULL without a validated CHECK, column type changes, NOT NULL columns added without a default, volatile or serial defaults that rewrite the table, dropped or renamed columns and tables, VACUUM FULL and CLUSTER, DELETE or UPDATE without WHERE, TRUNCATE, a missing lock_timeout, MySQL ALTERs without ALGORITHM/LOCK, and type advice (jsonb, text, identity, timestamptz). Tables created earlier in the same file are treated as new and skipped by lock and rewrite rules. The SQL is tokenized, never executed: no database is contacted, so table sizes and existing column types are unknown, and SQL inside strings, comments and function bodies is not linted. Up to 400 KB of SQL and 5,000 statements. Rules adapted from squawk and strong_migrations. Deterministic, no LLM.
2026-11-09skill_lintadded
Static lint of an agent instruction file: an Agent Skills SKILL.md (YAML frontmatter plus markdown body) or an AGENTS.md / CLAUDE.md style file. For skills, checks the frontmatter against the Agent Skills specification: name present, lowercase-hyphenated, at most 64 characters and free of reserved words; description present, at most 1,024 characters, with no XML tags, written in the third person and saying when to use the skill; license, compatibility, metadata and allowed-tools typed correctly; unknown keys. For both kinds, flags an empty or over-long body (over 500 lines or about 5,000 tokens), skipped heading levels, Windows backslash paths, referenced files missing from an optional sibling file list, references nested more than one folder deep, hidden or bidi characters, credentials (reported by pattern name and line, never echoed), and unsafe instructions such as curl piped to a shell, rm -rf on root or home, git --no-verify, --dangerously-* flags, bypassing permission prompts, sending ~/.ssh, ~/.aws or .env to a URL, and prompt-injection phrases; a match inside a negated or quoted sentence is downgraded to a warning. Text up to 300 KB, 512 KB request. The text is never executed, links are never fetched and referenced files are never read. Deterministic, no LLM.
2026-11-09data_transformadded
Five deterministic data utilities behind one tool, chosen by operation. csv_normalize: sniffs the delimiter, strips the BOM and normalises line endings, snake_cases headers (duplicates renamed), pads or trims ragged rows, drops empty rows and optionally duplicate rows, and returns CSV or JSON rows (max 200,000 cells, 1,000 columns, 64 KB per cell). json_shape: infers a JSON Schema (draft 2020-12) from 1-1,000 samples, with required, enum and format only where every sample supports them (max depth 32, 200,000 nodes). json_extract: evaluates up to 50 paths from a safe JSONPath subset ($, .key, ['key'], [n], [-n], [*], .*, ..key); filters, scripts, slices and unions are rejected, and each path returns at most 10,000 matches. unit_convert: exact rational conversion within one dimension (length, mass, volume, temperature, time, data, speed, area, pressure, energy), rounded to 12 significant digits, single or up to 1,000 per batch. text_dedupe: exact, normalized (NFKC, casefold, whitespace and edge punctuation) or near-duplicate (3-word-shingle Jaccard) removal over up to 50,000 strings, 2 MB total (near mode 5,000). 2 MB request body. Caller content is never executed or evaluated and nothing is fetched. Deterministic, no LLM.
2026-11-09agent_card_lintadded
Static lint of an A2A (Agent2Agent) Agent Card, the JSON an agent publishes at /.well-known/agent-card.json. Checks conformance with A2A v1.0.1 and the 0.3 field names (both dialects accepted): required fields present and typed, URLs absolute https (http allowed for localhost), input and output modes that look like MIME types, skills with id, name, description and tags, duplicate skill ids, and security requirements that reference declared schemes. Scores discoverability: skill descriptions too short (under 20 chars) or too long (over 1,024) to route on, near-duplicate skills, missing examples or provider. Flags prompt-injection phrasing aimed at the model reading the card and hidden zero-width, bidi or tag characters (reported as U+XXXX, never echoed raw). Optionally checks an x402 payment declaration: every accepts entry needs scheme, network, payTo, asset, resource (https) and a sane atomic amount; x402 findings are reported separately and do not affect the card score. 512 KB request; first 200 skills, 50 items per list, 100 x402 entries. URLs are parsed, never fetched, and card signatures are not verified. Deterministic, no LLM.
2026-11-09actions_auditadded
Static security audit of GitHub Actions workflow files. Flags template injection (attacker-controlled github.* contexts such as a PR title or branch name expanded inside run: or actions/github-script), pull_request_target and workflow_run triggers and the pwn-request pattern of checking out the pull request head under them, actions and reusable workflows not pinned to a full 40-character commit SHA, container images not pinned by digest, missing or write-all GITHUB_TOKEN permissions, secrets used under untrusted triggers or passed with secrets: inherit, actions/checkout persisting credentials, self-hosted runners on public repositories, curl or wget piped to a shell, hardcoded credentials (reported by kind and line, never echoed), jobs with no timeout-minutes, and caching in release or tag-publish workflows. Up to 50 files of 256 KB each, 1 MB request body; YAML anchors and aliases are rejected. Nothing referenced is fetched, so pinned SHAs are not checked to exist and called actions are not audited. Rules follow zizmor and GitHub's Actions hardening guide. Deterministic, no LLM.
2026-11-09dependency_checkchangeddescription, input schema, annotations
before
Lint dependency manifests for hygiene: unpinned, wildcard or unbounded versions, missing lockfiles, git/URL deps, non-https indexes, install scripts, dependency-confusion names, plus a small static snapshot of famous compromised versions (not a live CVE feed). Use this for a few manifests you can paste; use supply_chain_scan instead for a whole repo ZIP, other lockfiles or MCP configs. Send exactly one of manifests (1-20 files) or upload_id + filename; neither or both is 400 manifests_xor_upload_id_required. Reads package.json, package-lock.json, requirements.txt, pyproject.toml, Pipfile, go.mod, Gemfile, composer.json, pubspec.yaml; other files become an unsupported_file finding. Read-only, deterministic, no network, nothing installed or run. Free (0 credits), Bearer key required. Returns findings with severity, category and fix, a 0-100 score, grade A-F and per-severity counts.
after · 56% of words in common
Check dependency manifests. Price: free by default; with live: true, 2 credits up to 50 packages, +1 per further 50, max 5 (200 packages). Default: offline hygiene lint for unpinned, wildcard or unbounded versions, missing lockfiles, git/URL deps, non-https indexes, install scripts, dependency-confusion names, plus a static snapshot of famous compromised versions. live: true adds, per package, known vulnerabilities from OSV.dev (exact versions only), latest version, licence and deprecation from deps.dev, and one verdict: PASS, REVIEW or FAIL (FAIL at fail_on severity or above, a denied licence, or a compromised version). Use this for manifests you can paste; use supply_chain_scan for a whole repo ZIP or MCP configs. Send exactly one of manifests (1-20 files) or upload_id + filename. Reads package.json, package-lock.json, requirements.txt, pyproject.toml, Pipfile, go.mod, Gemfile, composer.json, pubspec.yaml. Nothing is installed or run. Bearer key required. Returns hygiene findings, a 0-100 score and grade A-F, and with live: true a live section with the verdict, per-package results and source attribution. Upstream outages are refunded (503 upstream_unavailable).
2026-11-08buy_creditsremoved
Get a Stripe Checkout link to top up the credits on the API key you are calling with. Starter pack: $5 for 500 credits. Pro pack: $20 for 2500 credits. 1 credit = $0.01. Give the returned checkout_url to a human to complete payment in a browser; the credits are added to this key automatically once the payment succeeds, usually within seconds. Calling this tool does not charge anything and costs no credits.
2026-11-08feedbackremoved
Submit free-text feedback about the API - a bug, a feature request, a docs gap, a billing question, or anything else. Tied to your key so we can follow up, but not billed and not a support-ticket SLA. Auth required; not billed.
2026-11-08uploadsremoved
Get a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id. Two-step: call this, PUT your file to the returned url, then pass upload_id to the consuming endpoint. Uploads auto-expire in 1 day and are readable only by your key. Auth required; not billed.
2026-11-08humanizeremoved
Rewrite text to remove AI-writing tells. POST prose and get it back with the mechanical tells fixed (AI vocabulary swapped for plain words, filler phrases stripped, em-dash overuse reduced, significance inflation deflated) plus a change log, before/after ai-ness scores, and a residual list of tells that need human judgment (not auto-rewritten). Code fences, inline code, URLs, and quotes are never touched. Deterministic, no LLM. Sister to humanizer_score (the detector).

Showing the latest 10. Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 100 / 100

provenance100

liveness100

freshness100

hygiene100

+repository +namespace-matches-repo +dns-namespace +website +reachable +uptime-100% +updated-5d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remote	auth	reachable	uptime 30d	p50	protocol	last ok
`https://api.quasslabs.com/mcp` streamable-http	none	yes	100%	265 ms	2025-06-18	2026-11-14

Tools (37)

`acceptance_criteria_validator`read-only	QA advisor: validate acceptance criteria quality. POST a list of AC (or a story) and get per-AC problems (vague/untestable, non-atomic, no observable outcome) + a missing-coverage flag if there is no failure-path AC, plus a 0-100 score and pass/needs_work verdict. Tells you exactly what to fix. Deterministic, no LLM.
`account`	Everything about your QuassLabs API account, chosen by `action`. Free: no action costs credits. "signup" (no API key needed): request a free key for an email address. A confirmation link is emailed; a human opens it on quasslabs.com to see the key, which is never returned to the agent. The key comes with 300 free credits a month. Always answers status check_email, whether or not the address already has a key. Needs email, accept_terms (true, after the human has agreed to https://quasslabs.com/api/terms) and terms_version. "balance" (API key required): what the calling key can spend - purchased credit_balance, free_credits left this UTC month, when they reset, plan and key_id. Daily free-tier caps still apply, so a free call can return 429 free_tier_busy while free_credits is above 0. Use it before a batch of paid calls or after a 402 insufficient_credits. "buy_credits" (API key required): a Stripe Checkout link for a human to pay in a browser; starter pack $5 for 500 credits, pro pack $20 for 2500. Credits land on this key once payment succeeds. "checkout_status" (no API key needed): whether a checkout session from buy_credits has been paid and its credits granted.
`actions_audit`read-only	Static security audit of GitHub Actions workflow files. Flags template injection (attacker-controlled github.* contexts such as a PR title or branch name expanded inside run: or actions/github-script), pull_request_target and workflow_run triggers and the pwn-request pattern of checking out the pull request head under them, actions and reusable workflows not pinned to a full 40-character commit SHA, container images not pinned by digest, missing or write-all GITHUB_TOKEN permissions, secrets used under untrusted triggers or passed with secrets: inherit, actions/checkout persisting credentials, self-hosted runners on public repositories, curl or wget piped to a shell, hardcoded credentials (reported by kind and line, never echoed), jobs with no timeout-minutes, and caching in release or tag-publish workflows. Up to 50 files of 256 KB each, 1 MB request body; YAML anchors and aliases are rejected. Nothing referenced is fetched, so pinned SHAs are not checked to exist and called actions are not audited. Rules follow zizmor and GitHub's Actions hardening guide. Deterministic, no LLM.
`agent_card_lint`read-only	Static lint of an A2A (Agent2Agent) Agent Card, the JSON an agent publishes at /.well-known/agent-card.json. Checks conformance with A2A v1.0.1 and the 0.3 field names (both dialects accepted): required fields present and typed, URLs absolute https (http allowed for localhost), input and output modes that look like MIME types, skills with id, name, description and tags, duplicate skill ids, and security requirements that reference declared schemes. Scores discoverability: skill descriptions too short (under 20 chars) or too long (over 1,024) to route on, near-duplicate skills, missing examples or provider. Flags prompt-injection phrasing aimed at the model reading the card and hidden zero-width, bidi or tag characters (reported as U+XXXX, never echoed raw). Optionally checks an x402 payment declaration: every accepts entry needs scheme, network, payTo, asset, resource (https) and a sane atomic amount; x402 findings are reported separately and do not affect the card score. 512 KB request; first 200 skills, 50 items per list, 100 x402 entries. URLs are parsed, never fetched, and card signatures are not verified. Deterministic, no LLM.
`alignment_gate`read-only	Run an AI system prompt (and optional agent config) through a 45-criterion alignment/safety rubric. Returns a letter grade (A-F), numeric score, per-flag remediation, and a pass/fail verdict.
`blm_land_lookup`read-only	Look up Bureau of Land Management land status for a US coordinate: BLM ownership, jurisdiction, allowed activities (rockhounding, camping), permit requirements, and special designations (ACEC, Wilderness, WSA, NM/NCA).
`commit_hygiene`read-only	Deterministic commit-message hygiene checker: conventional-commit format, vague-subject detection, subject-length limit, a same-message secret-pattern scan (AWS keys, private key headers, Slack/GitHub tokens, inline password=/secret= style credentials - checked against the message text only, never a diff), and an oversized-commit warning from caller-supplied insertions/deletions. POST one commit or a batch (max 200). Deterministic, no LLM, no network.
`convert_diagram`read-only	Make Mermaid diagrams portable. Takes HTML containing <div class="mermaid"> blocks (or a raw Mermaid source) and returns the same document with every diagram pre-rendered to inline SVG and the Mermaid CDN runtime stripped. A CDN-backed diagram only renders if the reader can fetch and run the runtime; inline SVG needs neither, so the output survives offline readers, email clients, Notion/Confluence (which strip <script>), and PDF export. Rendering happens on our infrastructure; diagram content is not sent to any third party.
`coverage_check`read-only	Scope-completeness advisor. POST a brief (or requirements[]) + your stories[] and get a coverage score + the gaps (requirements no story covers), orphan stories (possible scope creep), and missing structural buckets (auth/CRUD/error-states/tests). Tells you what the scope is missing. Deterministic, no LLM.
`create_upload`	Get a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id. Two-step: call this, PUT your file to the returned url, then pass upload_id to the consuming endpoint. Uploads auto-expire in 1 day and are readable only by your key. Auth required; not billed.
`data_transform`read-only	Five deterministic data utilities behind one tool, chosen by operation. csv_normalize: sniffs the delimiter, strips the BOM and normalises line endings, snake_cases headers (duplicates renamed), pads or trims ragged rows, drops empty rows and optionally duplicate rows, and returns CSV or JSON rows (max 200,000 cells, 1,000 columns, 64 KB per cell). json_shape: infers a JSON Schema (draft 2020-12) from 1-1,000 samples, with required, enum and format only where every sample supports them (max depth 32, 200,000 nodes). json_extract: evaluates up to 50 paths from a safe JSONPath subset ($, .key, ['key'], [n], [-n], [], ., ..key); filters, scripts, slices and unions are rejected, and each path returns at most 10,000 matches. unit_convert: exact rational conversion within one dimension (length, mass, volume, temperature, time, data, speed, area, pressure, energy), rounded to 12 significant digits, single or up to 1,000 per batch. text_dedupe: exact, normalized (NFKC, casefold, whitespace and edge punctuation) or near-duplicate (3-word-shingle Jaccard) removal over up to 50,000 strings, 2 MB total (near mode 5,000). 2 MB request body. Caller content is never executed or evaluated and nothing is fetched. Deterministic, no LLM.
`defect_triage`read-only	Bug-triage advisor. POST one bug report (or a list) and get severity (critical/high/medium/low), category, whether it has repro steps, and what info is missing (no repro / no expected-vs-actual / no environment). For a list: priority ranking + likely-duplicate clusters. Deterministic, no LLM.
`dependency_check`read-only	Check dependency manifests. Price: free by default; with live: true, 2 credits up to 50 packages, +1 per further 50, max 5 (200 packages). Default: offline hygiene lint for unpinned, wildcard or unbounded versions, missing lockfiles, git/URL deps, non-https indexes, install scripts, dependency-confusion names, plus a static snapshot of famous compromised versions. live: true adds, per package, known vulnerabilities from OSV.dev (exact versions only), latest version, licence and deprecation from deps.dev, and one verdict: PASS, REVIEW or FAIL (FAIL at fail_on severity or above, a denied licence, or a compromised version). Use this for manifests you can paste; use supply_chain_scan for a whole repo ZIP or MCP configs. Send exactly one of manifests (1-20 files) or upload_id + filename. Reads package.json, package-lock.json, requirements.txt, pyproject.toml, Pipfile, go.mod, Gemfile, composer.json, pubspec.yaml. Nothing is installed or run. Bearer key required. Returns hygiene findings, a 0-100 score and grade A-F, and with live: true a live section with the verdict, per-package results and source attribution. Upstream outages are refunded (503 upstream_unavailable).
`describe_diagram`read-only	Turn a plain-English description into Mermaid diagram source. Describe the flow, system, schema or timeline you want ("a login flow with an OAuth branch and a failure path") and get back complete, valid Mermaid - no need to know the syntax. The mermaid field of the response is directly usable as the mermaid_source input of convert_diagram, so describe -> render is a two-call pipeline. Generation runs on our infrastructure via AWS Bedrock; your description is not sent to any third-party service beyond that.
`diagram_contrast`read-only	Diagram quality QA. Catch and fix the things that ruin diagrams: (1) unreadable label contrast - POST a mermaid/SVG or HTML diagram, get every WCAG-AA failure (incl. mermaid <style>-block label colors, with unresolvable fills flagged honestly, not false-passed) + auto-corrected colors; (2) harden a mermaid SOURCE before it renders - rewrites every fill/label pair and remaps fills no label color can rescue, which scanning cannot do because a per-node style line overrides the theme block; (3) HTML-looks-fine-but-prints-broken - checks for the print-color-adjust/page-break gotchas and returns the fix CSS; (4) arrows crossing objects - returns the ELK-renderer config + layout rules that minimize crossings. Pure deterministic - no AI, no rate limit.
`estimate_sanity`read-only	Deterministic classifier for story/task hour estimates against benchmarks: flags each estimate in_range, borderline, over, under, or unbenchmarked. Supply either an explicit {min, max} range per type (benchmarks) or a list of historical actual hours per type (historical) that this endpoint derives a mean/stdev variance band from - explicit ranges win when both are given for the same type. No benchmark numbers are built in; a type with neither input is reported unbenchmarked, never guessed at. POST one estimate or a batch (max 200). Deterministic, no LLM.
`humanizer_score`read-only	Detect AI-writing tells in text. POST prose and get a 0-1 ai_ness score + band (low/medium/high) + the EXACT patterns that fired (AI vocabulary, significance inflation, promotional language, filler phrases, negative parallelism, rule-of-three, em-dash overuse) with sample spans. Explainable, not an opaque classifier - every point is a named, located pattern. Deterministic, no LLM. The rewrite is a separate step.
`humanize_text`read-only	Rewrite text to remove AI-writing tells. POST prose and get it back with the mechanical tells fixed (AI vocabulary swapped for plain words, filler phrases stripped, em-dash overuse reduced, significance inflation deflated) plus a change log, before/after ai-ness scores, and a residual list of tells that need human judgment (not auto-rewritten). Code fences, inline code, URLs, and quotes are never touched. Deterministic, no LLM. Sister to humanizer_score (the detector).
`log_analyzer`read-only	Analyze a log file. POST raw log text (or an upload_id from the create_upload tool, up to 5MB) and get: level breakdown + time range, error clusters (messages normalized so variable ids/numbers collapse into one signature, with counts + first/last seen + a sample), a timeline, detected anomalies (error spikes, retry storms, new error signatures, log gaps/outages, level-ratio shifts) with evidence, and templated recommendations. Handles JSON-lines and plain formats (ISO8601/syslog/CLF/epoch timestamps). Deterministic, single-pass, no LLM.
`log_audit_creator`read-only	Generate a concrete audit-logging spec for an app. POST your feature list (and optional compliance targets: soc2/hipaa/gdpr/pci) and get a full audit-event catalog (namespaced event names, actor/target/required fields, PII flags, retention), a canonical event envelope schema, a storage plan (append-only, access control, alerting), and per-framework compliance notes. A dev team can implement it directly. Deterministic, no LLM. Retention/compliance figures are common-practice defaults to verify with counsel.
`mcp_tool_lint`read-only	Static review of MCP tool definitions, as returned by a server's tools/list, for how well a model can choose and call them. Flags missing, too-short or vague descriptions; parameters with no description or type; free-form objects and arrays without items; required fields that are not declared; duplicate, case-colliding or near-identical tools; missing or contradictory annotations (readOnlyHint, destructiveHint and friends); tool-poisoning phrasing that tells the model to override its instructions or hide actions from the user; and hidden zero-width, bidi or tag characters. Also estimates the token cost of the whole tool list. Nothing is fetched and no tool is called; the score is a heuristic for usability, not a security guarantee. Deterministic, no LLM.
`model_advisor`read-only	LLM selection + cost advisor. POST a task description (+ optional volume/tokens/constraints like local-only or cheap) and get a recommended model + fallback chain + do-not-use (with reasons), the complexity tier, and per-run + monthly cost. A maintained model+price catalog. Deterministic, no LLM. Tells the AI/user which model to use and what it costs.
`openapi_diff`read-only	Compares a base and a head OpenAPI 3.x spec (JSON object, or a JSON or YAML string) from the API consumer's point of view and lists what would break existing clients: removed operations or 2xx responses, new required parameters or request properties, optional-to-required changes, narrowed request enums and tightened constraints, removed or now-optional response properties, widened response enums, type changes, and newly required security. Additive changes are reported as info. Matches operations by method and path template, so renaming a path parameter is not a change. Local $refs are resolved; remote refs are never fetched. Suggests the semver bump and says whether the head version already reflects it. Deterministic, no LLM.
`pr_description_lint`read-only	Deterministic PR description quality linter: flags a missing/too-short body, absent test evidence, absent stated rationale, an unstructured long body, and - only for PRs that look like bugfixes (title prefix fix/bug/hotfix/patch, or an explicit is_bugfix flag) - missing repro steps. Optionally requires a linked issue/ticket reference. Single PR only, no batch. Deterministic, no LLM.
`rate_call`destructive	Rate a specific prior metered call - thumbs up or down, plus an optional comment - keyed by the request_id that call's response reported. Works for any metered tool, so you can tell us when a result was wrong, unhelpful, or missed something. Resubmitting the same request_id overwrites your previous rating rather than adding a second one. Auth required; not billed - rating a call you already paid for should not cost more.
`readability_grade`read-only	Deterministic Flesch Reading Ease and Flesch-Kincaid Grade Level for a block of text, plus word/sentence/syllable counts and a plain-language reading-ease band (very_easy through very_confusing). Syllable counting is the standard vowel-group heuristic (same approximation used by textstat and most open readability tools), not a dictionary lookup. Optionally pass target_grade to get an on_target flag (within +/-2.0 grade levels). Different metric family from humanizer_score - this is pure readability statistics, not AI-writing-tell detection. Deterministic, no LLM.
`regex_lint`read-only	Static safety analysis of a regular expression plus an English explanation of what it matches. Parses the pattern into an AST and flags the structures that cause catastrophic backtracking (ReDoS): nested unbounded quantifiers like (a+)+, repeated alternations whose branches can start with the same character like (a\|ab)*, adjacent unbounded quantifiers over overlapping character sets like \d+\d+, and implausibly large bounded repeats. The pattern is COMPILED but never EXECUTED against input - running a caller-supplied regex is itself the denial-of-service vector. Detection is a structural heuristic, so a risk of "none" means no known dangerous shape was found, not a proof of safety. Deterministic, no LLM.
`saas_metrics`read-only	SaaS health advisor. POST your MRR/customers (+ optional churn/CAC/margin/growth) and get ARR/ARPA/LTV/CAC/payback/Rule-of-40/NRR/GRR computed, each with a health tag, plus an overall grade + a ranked "what to fix first" focus list. Deterministic math + advisory, no LLM.
`send_feedback`	Submit free-text feedback about the API - a bug, an idea, a docs gap, a billing question, or anything else. Missing a tool? Use kind tool_request to tell us what you needed, with an optional tool_description. Tied to your key so we can follow up, but not a support-ticket SLA. Auth required; not billed.
`skill_lint`read-only	Static lint of an agent instruction file: an Agent Skills SKILL.md (YAML frontmatter plus markdown body) or an AGENTS.md / CLAUDE.md style file. For skills, checks the frontmatter against the Agent Skills specification: name present, lowercase-hyphenated, at most 64 characters and free of reserved words; description present, at most 1,024 characters, with no XML tags, written in the third person and saying when to use the skill; license, compatibility, metadata and allowed-tools typed correctly; unknown keys. For both kinds, flags an empty or over-long body (over 500 lines or about 5,000 tokens), skipped heading levels, Windows backslash paths, referenced files missing from an optional sibling file list, references nested more than one folder deep, hidden or bidi characters, credentials (reported by pattern name and line, never echoed), and unsafe instructions such as curl piped to a shell, rm -rf on root or home, git --no-verify, --dangerously-* flags, bypassing permission prompts, sending ~/.ssh, ~/.aws or .env to a URL, and prompt-injection phrases; a match inside a negated or quoted sentence is downgraded to a warning. Text up to 300 KB, 512 KB request. The text is never executed, links are never fetched and referenced files are never read. Deterministic, no LLM.
`sprint_health`read-only	Sprint/delivery health advisor. POST 1-24 sprints (committed/completed points, optional per-ticket estimate-vs-actual data) and get computed metrics each with a good/warn/bad health tag: velocity avg + trend + stability, commitment reliability, spillover rate, mid-sprint scope change, estimate accuracy (median + chronic-overrun pct), and WIP concentration per assignee. Plus an overall grade and a ranked what-to-fix-first focus list. Pure math + advisory, no LLM.
`sql_migration_lint`read-only	Static lint of a SQL migration file (Postgres or MySQL) for operations that lock or rewrite live tables or break running application code. Flags CREATE INDEX without CONCURRENTLY and concurrent index builds inside a transaction, foreign key, CHECK and UNIQUE constraints added without NOT VALID or USING INDEX, SET NOT NULL without a validated CHECK, column type changes, NOT NULL columns added without a default, volatile or serial defaults that rewrite the table, dropped or renamed columns and tables, VACUUM FULL and CLUSTER, DELETE or UPDATE without WHERE, TRUNCATE, a missing lock_timeout, MySQL ALTERs without ALGORITHM/LOCK, and type advice (jsonb, text, identity, timestamptz). Tables created earlier in the same file are treated as new and skipped by lock and rewrite rules. The SQL is tokenized, never executed: no database is contacted, so table sizes and existing column types are unknown, and SQL inside strings, comments and function bodies is not linted. Up to 400 KB of SQL and 5,000 statements. Rules adapted from squawk and strong_migrations. Deterministic, no LLM.
`story_lint`read-only	Deterministic structural quality linter for user stories - a sibling to ticket_lint but scoped to story-writing concepts any team recognizes: narrative completeness (As-a/I-want-to/So-that/Summary), acceptance criteria presence, duplicate/unknown dependency IDs, a "Manage X" story with no CRUD split, list stories missing a pagination mention. An OPTIONAL rate_config unlocks team-specific checks (screen-vs-narrative match, hour-rate-per-screen tolerance, required risk level by story type, milestone-code format, required companion story types per milestone) - omit it and only the universal checks run. No house rates or milestone conventions are hardcoded. POST one story or a batch (max 50). Deterministic, no LLM.
`supply_chain_scan`read-only	Scan a whole repo archive (a ZIP of manifests, lockfiles and MCP server configs) for packages, MCP servers and extensions listed in a known-compromise catalog (Bumblebee threat intel). Use this for a repo, many lockfiles or MCP configs; use dependency_check instead to lint a few pasted manifests for pinning and hygiene. Send exactly one of archive_base64 or archive_url; neither or both is 400 exactly_one_of_archive_base64_or_archive_url. Read-only: the ZIP is sent to QuassLabs (archive_url is fetched server-side), unpacked to a temp dir deleted after the call, never executed or installed. 5 credits. Failed calls are not billed: input, fetch and archive errors (invalid_ecosystems, not_a_zip, unsafe_path_in_archive, too_many_entries, archive_expands_too_large) are rejected before any charge, and 5xx is refunded. Bearer key required. Returns verdict CLEAR or FINDINGS, findings with severity, source_file and remediation, and scanned counts; CLEAR is not a guarantee of safety.
`ticket_lint`read-only	Full Jira-ticket quality linter (whole ticket, not just AC - use acceptance_criteria_validator for the deep AC pass). POST one ticket or a batch (max 50) and get per-ticket findings with severity + concrete fixes: missing/weak summary or description, missing AC or estimate, bugs without repro/expected-vs-actual/environment, missing epic link, points-vs-hours mismatch, oversized estimates to split, urgent-but-thin tickets. Returns score, grade, and a ready/needs_work verdict per ticket plus batch summary. Type-aware rules (story/bug/task/epic/subtask), strict profile available. Deterministic, no LLM.
`tool_advisor`read-only	Which QL-API endpoint fits this task. POST a task description and get the ranked endpoint(s) that best match, each with a confidence label (high/medium/low). Deterministic keyword matching over this platform's own endpoint catalog, no LLM. Pairs with model_advisor (which itself is one of the recommendable endpoints, so a "which model" task surfaces it) - call them independently and chain the results yourself; optionally pass a prior model_advisor result's rationale in as `context` to bias matching.
`worklog_guardrail`read-only	Worklog/timesheet policy checker - run a batch of worklog entries through configurable guardrails BEFORE posting them to a time-tracking system. Checks: rounding increment (default 0.25h, float-safe), per-entry min/max, per-author daily totals, duplicates, over-estimate alerts (never suggests inflating hours or estimates - flags to PM instead), future dates, weekends, immutable-author edit protection, missing description/ticket. Returns pass/warnings/blocked verdict + per-entry violations with fixes + hour totals by author and date. Caller supplies the reference date - fully deterministic, no LLM.

Schemas: list_tools.

Similar MCP servers

Official server.json

{
  "name": "com.quasslabs/api",
  "_meta": {
    "io.modelcontextprotocol.registry/publisher-provided": {
      "auth": "Bearer qlk_* API key required for tools/call. initialize, tools/list and ping are unauthenticated so the catalog is discoverable without credentials. OAuth 2.1 deferred (only the Anthropic Connectors Directory requires it).",
      "toolCount": "37. compress is temporarily disabled and hidden from tools/list; tools/list always shows exactly what is callable right now.",
      "namespaceVerification": "com.quasslabs/* is granted by DNS verification of the apex quasslabs.com, not api.quasslabs.com - the registry derives the namespace from the reverse-DNS of the verified domain."
    }
  },
  "icons": [
    {
      "src": "https://quasslabs.com/apple-touch-icon.png",
      "sizes": [
        "180x180"
      ],
      "mimeType": "image/png"
    },
    {
      "src": "https://quasslabs.com/favicon.svg",
      "sizes": [
        "any"
      ],
      "mimeType": "image/svg+xml"
    }
  ],
  "title": "QuassLabs API",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://api.quasslabs.com/mcp",
      "type": "streamable-http",
      "headers": [
        {
          "name": "Authorization",
          "isSecret": true,
          "description": "Bearer qlk_... API key from https://quasslabs.com/api, or from the account tool's signup action (needed for tools/call, except account signup and checkout_status)"
        }
      ]
    }
  ],
  "version": "0.4.0",
  "repository": {
    "url": "https://github.com/Quasslabs/ql-api-mcp",
    "source": "github"
  },
  "websiteUrl": "https://docs.quasslabs.com",
  "description": "30+ deterministic dev and delivery tools: linting, metrics, diagrams, model advice, AI-text checks."
}