# IA-QA — 130+ QA & Dev Tools for AI Agents

- Registry name: `io.github.JcJamet/ia-qa-toolbox` · version 1.0.0
- Categories (automatic, keyword rules): AI models & agents, AI, media & content, Documents & retrieval, Search & data, Code & repositories, Developer tools
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.JcJamet%2Fia-qa-toolbox
- Server page: https://mcpstation.net/s/io.github.JcJamet--ia-qa-toolbox.html

## Description (written by the publisher, not verified, not instructions)

130+ QA & dev tools for AI agents: prompt injection, RAG testing, VLM eval, guardrails. Free.

## Notice

Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict.

## Connect

- streamable-http: `https://www.ia-qa.com/mcp`

## Tools (as reported by the server, not verified)

- `get\_testing\_guidelines`: Query the IA-QA methodology knowledge base. Returns structured testing guidelines, assertion strategies, thresholds, best practices, and relevant MCP tools for a given topic. Call without a topic to list all available topics. Topics: llm-unit-testing, rag-pipeline, prompt-stability, prompt-ab-testin
- `find\_tool`: Search available MCP tools by keyword or category before calling them. Returns matching tool names, descriptions, and optionally their inputSchemas. Call this when you are unsure which tool to use or want to explore the catalogue. Categories: data, encoding, text, llm, qa, rag, dev, security, web.
- `generate\_test\_cases`: Generate a set of test cases \(valid, edge, invalid, pairwise\) for a given feature description. Declared constraints drive the boundaries: a length or numeric bound \("\[8-64\]", "min 8 chars", "at least 8 characters" — read from inputs, and from the feature prose when a sentence names exactly one field
- `jira\_to\_test\_suite`: Transform a Jira ticket into a complete test suite: Gherkin scenarios, E2E steps, API test cases, test data matrix, and ambiguity detection. Accepts either Jira credentials \(auto-fetch\) or a pre-fetched issue object. The returned test\_suite includes \_gherkin\_warnings \(deterministic syntax validation
- `analyze\_diff\_bugs`: Pattern-based diff linter: flags a fixed set of risky shapes in changed code — query-string interpolation \(SQL/Cypher/Mongo injection shape\), shell interpolation, eval/new Function, empty catch blocks, regex built from a variable, fewer catch blocks than before, and named authorization guards that d
- `run\_pr\_gate\_pipeline`: Review triage for a pull request. Takes a unified git diff \(\`git diff HEAD\`\) and returns: diff-lint findings with the lines that produced them, regression impact areas, a risk score 0–100 with the factors that built it \(churn, files touched, sensitive paths, whether any test file changed, lint sever
- `diff\_mappings`: Diff a baseline page mapping against a current one and return a CI-style verdict: PASS / FIX / BLOCK, plus per-element drift \(ok, renamed, healable, ambiguous, lost, added, rebound\). Pure and deterministic — provide two mappings as JSON with "elements" arrays of \{role, name, selector, context?\}. Use
- `sandbox\_scenario`: Get a ready-made selector-drift test case with a known-correct answer, for testing this MCP server or an agent workflow end to end. Each scenario is a real DOM capture of a deliberately breakable app, taken before and after one specific UI change \(a renamed label, two swapped buttons, a duplicated l
- `prompt\_injection\_scan`: Scan user input or prompts for common prompt injection patterns. Detects system prompt overrides, jailbreak attempts, role manipulation, encoding tricks, delimiter attacks \(chat-template tags \`\<\|im\_start\|\>\`/\`\[INST\]\`/\`\<\<SYS\>\>\` AND fake role headers imitating markdown or chat separators: "\#\#\# System:"
- `hallucination\_check`: Lexical hallucination check: verifies an LLM answer's words, numbers and polarity against the provided source/context. Fast, deterministic, no API key needed. Each answer sentence is aligned to its best-matching source sentence, so a number only counts as support when it sits on the SAME statement \(
- `run\_eval\_contract`: Parse a .ia-eval.yaml LLM test suite, call the specified LLM model for each scenario, run all configured scorers, and return a structured JSON report with per-scenario Pass/Fail verdicts and a Markdown summary. Use list\_local\_tests to discover available test files.
- `guardrail\_test`: Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex. Returns pass/fail per rule.
- `run\_semantic\_tests`: Semantic assertion primitive: compare actual vs expected text pairs using cosine similarity + ROUGE-L. Two modes: tfidf \(default, free, no API key\) or embeddings \(OpenAI text-embedding-3-small, BYOK, true semantic similarity\). Returns per-case PASS/FAIL verdicts and an overall verdict. CI-ready: pip
- `generate\_ci\_workflow`: Generate a ready-to-commit GitHub Actions workflow that gates a build on IA-QA. Two gate types, combinable: "eval\_contract" runs a .ia-eval.yaml through ia-qa-com/eval-action@v1 \(LLM quality gate, needs a provider API key as a repo secret\), and "cli\_checks" runs deterministic primitives via npx @ia-
- `redact\_pii`: Automatically detect and redact Personally Identifiable Information \(PII\) from text. Replaces emails, phone numbers, SSNs, credit cards, IP addresses, and JWT tokens with \[REDACTED\_TYPE\] placeholders. Safe to use before logging or sending to an LLM.
- `secret\_scan`: Scan text or code for leaked secrets: API keys \(AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace\), private keys \(RSA/EC/PGP\), JWTs, database connection strings, Bearer tokens, and Basic auth headers. Returns a list of findings with type, severity, line
- `needle\_haystack\_generate`: Generate a "needle in a haystack" test: embeds a target fact into a large block of filler text at a specified position. Use this to test LLM context window retrieval accuracy. Returns the full haystack, the question to ask, and metadata. No API key needed.
- `list\_local\_tests`: Discover .ia-eval.yaml LLM test suite files in the project directory. Scans CWD and standard sub-directories \(evals/, tests/, contracts/\). Returns file paths ready to pass to run\_eval\_contract.
- `generate\_html\_report`: Convert a run\_eval\_contract\(\) LLM Test Runner JSON result into a fully self-contained dark-themed HTML report with Pass/Fail badges, side-by-side Input/Output/Ground-Truth panels, evaluator score bars, and a radar chart. Returns the HTML as a string.
- `generate\_eval\_yaml`: Generate a complete .ia-eval.yaml evaluation contract from a plain-language description of what your LLM should do. Uses Groq openai/gpt-oss-20b \(server-side, no API key needed\). Returns ready-to-run YAML for the LLM Test Runner \(run\_eval\_contract\). Picks appropriate evaluators \(cosine\_similarity, c
- `validate\_agent\_trajectory`: Run declarative assertions on an agent trace \(OpenAI tool-call messages, Anthropic tool\_use/tool\_result blocks, LangChain run trees, or plain text ReAct logs\). No LLM call — deterministic. Assertion types: order \(tool A before B\), must\_call, must\_not\_call, max\_calls, min\_calls, no\_error, recovery \(a
- `metamorphic\_check`: Reference-free stability primitive: instead of comparing an answer to a ground truth, it checks that an assistant's answer stays INVARIANT when the QUESTION is transformed \(typo, casing, paraphrase, reordering, translation\). Catches the failure class no reference answer can expose — an assistant tha
- `test\_skill`: Test a SKILL.md in the open Agent Skills format \(https://agentskills.io/specification — read by Claude Code, Codex, GitHub Copilot, Cursor, Gemini CLI, OpenCode and others\) in two stages. \(1\) lint: the spec's frontmatter rules checked without a model \(name 1-64 chars, lowercase/digits/single hyphens
- `diff\_text`: Compute a unified line-by-line diff between two text strings \(LCS algorithm\). Returns added/removed/unchanged line counts and formatted diff hunks with configurable context lines \(0–20\). Use to compare versions of prompts, configs, code snippets, or any text where you need to see exactly what change
- `validate\_mcp\_response`: Validate that an MCP tool response conforms to expected format, schema, and content rules. Use this to QA-test any MCP server tool. Supply the tool's actual JSON result and a set of checks to perform.
- `llm\_output\_validator`: Validate an LLM response against QA criteria: format checks \(JSON, code, markdown\), content rules \(must-include, must-not-include\), length constraints, language detection, and safety patterns. Essential for QA testing LLM-powered features.
- `compare\_responses`: Compare two ALREADY-PRODUCED outputs \(e.g. model A vs model B on the same task\) side by side. Returns deterministic metrics \(token cosine, ROUGE-L, Jaccard, length/structure deltas, JSON diff\) and a verdict. If a \`reference\` \(ground truth\) is given, scores each output against it and picks the closer
- `analyze\_responses`: Semantically analyze N already-produced model outputs for the SAME task \(the MCP counterpart to the LLM Sandbox\). Without a reference: computes consensus — pairwise cosine agreement, the most-representative output, and the outlier. With a \`reference\` \(ground truth\): also ranks every output by closen
- `prompt\_test\_suite`: Define a test suite for a prompt: provide the system prompt, user prompt, and expected output criteria. Returns a test plan with scored rubric — use this as input for manual or automated LLM evaluation.
- `mcp\_server\_health\_check`: Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate. Paste the answer to tools/list \(raw JSON-RPC or its result\), a bare array of tools, one tool definition, or a manifest carrying name/description; input\_shape says which one was
- `mcp\_server\_evaluate`: Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it. Checks: initialize \(protocol version, serverInfo, Mcp-Session-Id carried afterwards\), notifications/initialized \(202\), tools/list with pagination, the spec's tool-definition rules, ping, an unknown
- `llm\_format\_check`: Validate that an LLM output matches an expected format: JSON, Markdown, code block, bullet list, numbered list, table, YAML, XML, or custom regex. Essential for structured output testing.
- `consistency\_check`: Compare multiple LLM responses to the same prompt and detect inconsistencies using Jaccard word-overlap similarity and fact drift \(number comparison\). Fast, deterministic, no API key needed. Limitations: relies on surface-level word matching — "Paris is the capital of France" vs "Paris is the French
- `llm\_json\_schema\_check`: Validate that an LLM JSON output matches a JSON Schema definition. Tests required fields, types, enums, nested objects, and arrays. Critical for function-calling and structured output testing.
- `response\_quality\_score`: Score an LLM response against the criteria you pass: coverage of expected\_keywords and compliance with max\_length. Returns a 0-100 score over the criteria actually measured — or total\_score null with the reason when none is given, because relevance and correctness cannot be read off word overlap \(a
- `toxicity\_scan`: Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content. Lexical + structural pattern matching \(identity term + predicate\), not a semantic classifier — returns per-category risk plus the named rules that fired, so every finding can be checked. Usefu
- `function\_call\_validate`: Validate an LLM function call / tool\_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args. For OpenAI function calling & MCP tool\_use testing.
- `conversation\_analyze`: Analyze a multi-turn conversation for context retention, topic drift, instruction following, and repetition. Accepts messages array \[\{role, content\}\]. Essential for chatbot QA.
- `mcp\_schema\_lint`: Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length. Returns actionable warnings.
- `cot\_analyzer`: Analyze a Chain-of-Thought \(CoT\) or reasoning trace from an LLM. Detects step count, logical flow, conclusion presence, backtracking, and estimates reasoning depth. Useful for o1/o3/DeepSeek-R1 evaluation.
- `ab\_test\_report`: Generate an A/B test report comparing two prompts or model configurations. Accepts arrays of scores and returns statistical comparison: mean, median, std deviation, winner, and improvement percentage.
- `similarity\_score`: Compute text similarity between reference and hypothesis using multiple metrics: Cosine \(BoW, TF-IDF\), Jaccard, ROUGE-1, ROUGE-2, ROUGE-L, and BLEU. No API key needed. Ideal for LLM eval \(expected vs actual\), RAG quality checks, and NLG benchmarking. Supports batch mode.
- `bias\_detect`: Analyse a set of LLM responses generated from the same prompt template but with different demographic variants \(gender, origin, age, tone\). Returns a bias score \(0-100\), sentiment analysis per variant, pairwise Jaccard similarity, and a human-readable verdict. No API key needed — runs entirely local
- `run\_vlm\_test\_suite`: Run a test suite against a Vision-Language Model \(VLM\) — send an image \(URL or base64\) + N test cases \(each with a question + assertion\) to GPT-4o, Claude 3.5, or Gemini. Returns per-case PASS/FAIL verdicts, a pass rate, an overall PASS/WARNING/FAIL verdict \(customizable threshold\), and latency stat
- `multimodal\_eval\_guide`: Unified tool for multimodal AI evaluation: set action=guide for reference thresholds/interpretation \(CLIP, FID, VQA\), or set action=clip\_score / fid\_score / vqa\_accuracy / pipeline to compute real metrics via HuggingFace Inference API and VLM BYOK calls. One tool for both reference and computation.
- `run\_vlm\_test\_suite\_batch`: Compare multiple VLMs on the same test suite in parallel — send an image \(URL or base64\) + N test cases to all models simultaneously. Returns per-model PASS/FAIL verdicts, pass rates, latency stats, and a comparison table. Assertion types: contains, not\_contains, json\_format, min\_length, max\_length,
- `shield\_analyze`: Run a comprehensive AI guardrail analysis on an LLM response. Orchestrates 7 deterministic safety checks plus an optional LLM-powered deep analysis in parallel: hallucination detection \(grounding score\), prompt injection scan on BOTH the response and the original prompt \(reported separately as check
- `security\_headers\_check`: Analyse the HTTP security headers of a public URL OR of raw response headers you paste in. Grades each header \(A–F\) for: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Opener-Policy, Cro
- `ssl\_certificate\_check`: Analyse the SSL/TLS certificate of any HTTPS host. Returns certificate subject, issuer, validity dates, days until expiry, protocol version, cipher suite, key exchange info, and an overall grade \(A+, A, B, C, F\). Detects expired, self-signed, and weak certificates. Use this to audit TLS posture befo
- `cors\_test`: Test a URL for CORS misconfigurations. Sends preflight \(OPTIONS\) requests with various Origin headers to detect: wildcard origins with credentials, origin reflection \(echoing any origin\), null origin acceptance, subdomain wildcard bypass, and missing Vary headers. Returns risk level \(safe/low/medium
- `cors\_checker`: Check the CORS configuration of a URL the same way a browser would. Returns the main response status, all Access-Control-\* headers, the tested origin, and the preflight OPTIONS response. Use this for direct CORS debugging, not just security auditing.
- `cookie\_security\_audit`: Audit the security attributes of cookies set by any URL. Fetches the URL and inspects all Set-Cookie headers for: HttpOnly, Secure, SameSite, Domain scope, Path scope, Max-Age/Expires, \_\_Host-/\_\_Secure- prefixes. Flags insecure patterns: missing HttpOnly on session cookies, missing Secure flag, Same
- `web\_security\_audit`: Run a comprehensive web security audit combining headers, SSL, CORS, and cookies checks — then use an LLM to produce a prioritised remediation plan. Orchestrates security\_headers\_check + ssl\_certificate\_check + cors\_test + cookie\_security\_audit in parallel, merges all findings, then asks an AI model
- `embedding\_similarity`: Compute text similarity using local algorithms \(Bag of Words, TF-IDF, Character N-grams\). No API key needed — runs entirely in-process. NOT real embeddings: for true semantic similarity with vector embeddings, use run\_semantic\_tests with mode="embeddings" and your OpenAI API key. Supports single pai
- `rag\_relevance\_rank`: Rank an array of text chunks by relevance to a query using TF-IDF scoring. Simulates retrieval ranking for RAG testing without needing embeddings or an API.
- `vector\_similarity`: Compute similarity/distance between two float vectors: cosine similarity, dot product, Euclidean and Manhattan distance. Essential for vector DB relevance scoring, embedding evaluation, and nearest-neighbor testing.
- `normalize\_vector`: L2-normalize a float vector \(produce a unit vector with norm=1\). Required by many vector DBs \(Pinecone, Qdrant cosine\). Supports batch normalization of up to 1000 vectors.
- `vector\_quantize`: Simulate int8 or int4 quantization of float32 embedding vectors. Reduces storage by 4x \(int8\) or 8x \(int4\). Returns quantized values, scale factor, and precision loss \(MSE\). Useful for understanding vector DB compression trade-offs.
- `vector\_stats`: Compute statistics for a float vector or matrix of vectors: mean, std, L2 norm, min, max, sparsity, top-K indices. Useful for debugging embedding quality and analyzing vector distributions in a vector DB.
- `bm25\_score`: Compute BM25 relevance score between a query and one or more documents. BM25 is the industry-standard keyword-based ranking algorithm used in Elasticsearch, OpenSearch, and Weaviate hybrid search. Returns ranked results with normalized scores.
- `build\_rag\_prompt`: Assemble a complete RAG \(Retrieval-Augmented Generation\) prompt from retrieved context chunks and a user query. Handles token budgeting, citation numbering, system instruction injection, and source attribution.
- `prompt\_template\_fill`: Fill a prompt template with variables. Supports \{\{variable\}\} syntax and \{\{\#if key\}\}...\{\{/if\}\} conditional blocks. Returns the filled prompt and lists unfilled variables.
- `few\_shot\_formatter`: Format few-shot examples for LLM prompts. Converts example pairs into formatted blocks. Supports chat format \(User/Assistant\), XML tags, Markdown, or plain text.
- `system\_prompt\_builder`: Build a structured system prompt from components: role, task, constraints, output format, tone, language, and examples. Generates a production-ready system prompt with token estimate.
- `rerank\_evaluate`: Evaluate RAG retrieval quality: rank passages against a query and compute Precision@k / Recall@k plus a PASS/FAIL CI verdict from ground-truth relevance labels. Three modes, all keyless except the last. \(1\) BYO scores — give each passage the \`score\` your own reranker produced \(Cohere, Jina, a self-h
- `count\_tokens`: Estimate the token count of a text string using the cl100k\_base approximation \(\~4 chars/token\). Call this BEFORE sending any text to an LLM API to check if it fits within the model context window and to estimate cost. Returns token estimate, character count, and word count.
- `truncate\_to\_tokens`: Truncate text to at most N tokens \(cl100k\_base: \~4 chars/token\) to avoid exceeding an LLM context window. Optionally keeps the end of the text instead of the start \(useful for keeping recent conversation history\). Reports whether truncation occurred and the estimated token count.
- `split\_chunks`: Split text into chunks of at most N tokens \(cl100k\_base: \~4 chars/token\) with optional overlap. Designed for RAG ingestion pipelines.
- `extract\_json\_from\_text`: Extract the first valid JSON object or array embedded in chaotic LLM output \(surrounded by markdown fences, prose, or explanatory text\). Handles \`\`\`json blocks and inline JSON. Call this whenever an LLM returns structured data mixed with explanation text instead of raw JSON.
- `estimate\_llm\_cost`: Estimate the API cost in USD for a given model and token counts. Supports all major 2024–2026 models: GPT-4o, GPT-4.1, o3, o4-mini, Claude Opus 4, Claude Sonnet 4/4.5, Gemini 2.5 Pro/Flash, DeepSeek V3/R1, Grok 3, and legacy models.
- `token\_budget\_calculator`: Plan token allocation across system prompt, user input, context/RAG chunks, and expected output. Warns if budget exceeds model context window. Supports 25+ models.
- `context\_window\_check`: Given an array of message objects \[\{role, content\}\], estimate total token usage and check if it fits in the target model's context window. Warns about truncation risk.
- `model\_info`: Get detailed specs for an AI model: context window, pricing per 1K tokens, knowledge cutoff, provider, multimodal support, reasoning capabilities, and feature list. Covers 30+ models from OpenAI, Anthropic, Google, DeepSeek, Meta, Mistral, Cohere, xAI.
- `compare\_models`: Compare 2-5 AI models side by side: context window, pricing, multimodal, reasoning capabilities, and provider. Returns a comparison table with a recommendation based on your use case.
- `list\_llm\_models`: List all LLM models available on ia-qa.com with their provider, API endpoint, and capabilities. Filter by provider name \(e.g. "Groq", "HuggingFace", "OpenAI"\) or return the full catalog. Use this to discover which models are available before calling an LLM API, or to compare providers.
- `llm\_generate`: Generate text using open-source LLM models hosted on Groq \(ultra-fast\) or HuggingFace Inference \(serverless\). No API key required — the server provides its own keys. Supported models: Qwen3 32B, Gemma 4 27B, Gemma 3 27B, Llama 3.3 70B, Llama 4 Scout, DeepSeek R1, Mistral Small 24B, and more. Use lis
- `optimize\_prompt\_tokens`: Compress an LLM prompt by removing filler words, verbose phrases, duplicate sentences, and unnecessary whitespace. Returns optimized text with token savings breakdown. 100% deterministic, no API key needed.
- `llm\_fit\_finder`: Find the best LLM for a given use case. Compares 30+ cloud API models and 12+ local models by cost, speed, benchmarks, features and VRAM requirements. Returns ranked recommendations with cost simulation. No API key needed.
- `post\_jira\_comment`: Post the output of jira\_to\_test\_suite as a formatted comment on the source Jira ticket. Converts Gherkin, E2E steps, API tests, and ambiguities into Atlassian Document Format \(ADF\). STATEFUL — creates a comment on the issue.
- `create\_confluence\_page`: Create a new Confluence page from the output of jira\_to\_test\_suite. Formats Gherkin, E2E steps, API tests, and test data as a properly structured Confluence page with code blocks and tables. STATEFUL — creates a new page in the specified space.
- `fetch\_jira\_issue`: Fetch a complete Jira issue: summary, description converted to Markdown, status, assignee, priority, labels, custom fields, and optionally comments and attachment metadata. BYOK — credentials transit in-memory only, never stored on ia-qa.com.
- `search\_jira\_issues`: Search Jira using JQL \(Jira Query Language\). Returns matching issues with key fields. Ideal for finding open bugs, sprint tickets, or issues by label/assignee/component. BYOK — credentials transit in-memory only, never stored.
- `fix\_gherkin`: Fix Gherkin syntax warnings from a jira\_to\_test\_suite result. Takes the current gherkin text and the \_gherkin\_warnings array, calls your LLM to fix ONLY the flagged issues \(adds missing Given/When/Then steps, etc.\), and returns the corrected Gherkin. Lightweight — uses \~300-500 tokens vs \~5k for a f
- `fetch\_confluence\_page`: Fetch a Confluence page and return its content as clean Markdown. Accepts a numeric page\_id or a full page URL. Optionally lists direct child pages. BYOK — credentials transit in-memory only, never stored.
- `identify\_caller`: Returns what the server knows about the current MCP client: clientInfo captured during initialize, User-Agent, and any \_meta fields sent with this request. Useful for debugging caller identification.
- `rate\_tool`: Give honest usage feedback on an IA-QA MCP tool. Provide a score \(1-5\) and a comment. Rate low \(1-2\) if the tool was wrong, irrelevant, or a poor fit; rate high \(4-5\) only if it genuinely solved your need. Ratings are aggregated on a public dashboard at /devtools/mcp-ratings. Skip rating routine suc
- `validate\_email`: Validate an email address against RFC 5322 syntax before storing it, sending a transactional email, or adding it to a mailing list. Returns \{ valid, email \} — use this to avoid bounces and malformed data.
- `minify\_js`: Minify a JavaScript snippet, function, class, or module up to 50 KB using Terser. Returns minified code and byte savings. Use when embedding scripts in HTML templates, report payloads, or injecting inline code programmatically.
- `decode\_jwt`: Decode a JWT \(JSON Web Token\) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exact expiry date. Use to inspect claims \(sub, iss, exp, roles\) during debugging or when integrating with an auth provider.
- `timestamp\_convert`: Convert between Unix timestamps \(seconds or milliseconds\) and ISO-8601 / UTC date strings. Auto-detects epoch vs. millisecond format. Omit input to get the current time. Returns iso, unix\_s, unix\_ms, utc, date, and time fields.
- `validate\_url`: Parse and validate a URL. Returns decomposed components: protocol, hostname, port, path, query parameters, hash, and origin.
- `check\_contrast\_ratio`: Calculate WCAG 2.1 contrast ratio between two colors. Returns ratio and compliance for AA/AAA normal and large text.
- `cron\_parse`: Parse a cron expression into a human-readable schedule description. Supports standard 5-field cron \(minute hour day month weekday\).
- `cron\_validator`: Validate a 5-field cron expression, explain the schedule, and preview the next execution times. Use this to debug cron jobs before they reach production. Returns parsed fields, a human-readable description, and upcoming ISO timestamps.
- `http\_status\_lookup`: Look up detailed information about any HTTP status code: class, name, description, cacheability, typical causes, and handling best practices. Covers every code in the IANA HTTP Status Code Registry \(1xx-5xx, including 226, 425, 451, 508, 511 and the WebDAV codes\) with its defining RFC; anything outs
- `parse\_http\_headers`: Parse a raw HTTP headers block into a structured JSON object. Detects multi-value headers, masks Authorization values, and optionally audits for missing security headers \(HSTS, CSP, X-Frame-Options, etc.\).
- `generate\_curl`: Generate a curl command from request parameters. Supports GET/POST/PUT/DELETE, custom headers, JSON body, and form data. Useful for documentation, sharing, and debugging API calls.
- `extract\_todos`: Extract TODO, FIXME, HACK, BUG, NOTE, OPTIMIZE, and custom tags from any source code or text. Returns line numbers, tag types, and message text. Essential for technical debt auditing.
- `detect\_secrets`: Scan code or config files for hardcoded secrets: AWS keys, GitHub tokens, OpenAI/Anthropic API keys, Stripe secrets, JWTs, database connection strings, and generic passwords. Returns findings with severity. Run before every commit.
- `count\_code\_lines`: Count lines of code: total, code lines, comment lines, blank lines, and comment density. Supports JS/TS, Python, Java/C/C++, Ruby, Go, Shell, HTML/XML, and CSS.

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html