io.github.JcJamet/ia-qa-security

None of its 30 tools are described as changing anything. For 30 the reading was uncertain, so no mark is shown.

• find_toolon 17 other servers

  “Search available MCP tools by keyword or category before calling them.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  4 inputs, 1 required

  • querystringrequired“Keyword(s) to search in tool name and description (e.g.”
  • categorystring“Optional: filter by category — data | encoding | text | llm | qa | rag | dev | security | web”
  • with_schemaboolean“Set true to include inputSchema in results (default: false)”
  • max_resultsnumber“Maximum tools to return (default 10, max 50).”
• prompt_injection_scanon 2 other servers

  “Scan user input or prompts for common prompt injection patterns.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • inputstringrequired“The user input or prompt to scan for injection patterns”
  • sensitivitystring“Detection sensitivity (default: medium)”
• guardrail_teston 1 other server

  “Test an LLM response against a set of guardrail rules: must-include, must-not-include, max length, required format, language, forbidden patterns, and custom regex.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 2 required

  • responsestringrequired“The LLM response to test”
  • rulesarrayrequired“Array of guardrail rules to check”
• redact_piion 5 other servers

  “Automatically detect and redact Personally Identifiable Information (PII) from text.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  3 inputs, 1 required

  • inputstringrequired“Text to redact PII from”
  • typesstring“Comma-separated types to redact (default: all).”
  • markerstring“Custom replacement marker (default: "REDACTED").”
• secret_scanon 5 other servers

  “Scan text or code for leaked secrets: API keys (AWS, GCP, Azure, OpenAI, Anthropic, Stripe, GitHub, GitLab, Slack, Twilio, SendGrid, HuggingFace), private keys (RSA/EC/PGP), JWTs, database connection…”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • inputstringrequired“Text or code to scan for secrets”
  • typesstring“Comma-separated families to scan (default: all): aws, gcp, azure, openai, anthropic, huggingface, github, gitlab, stripe, slack, twilio, sendgrid, jwt, private…”
• validate_agent_trajectoryon 1 other server

  “Run declarative assertions on an agent trace (OpenAI tool-call messages, Anthropic tool_use/tool_result blocks, LangChain run trees, or plain text ReAct logs).”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  3 inputs, 2 required

  • tracestring or object or arrayrequired“Agent execution trace as JSON (OpenAI messages array, LangChain run tree) or plain text log (Thought/Action/Observation format).”
  • assertionsarrayrequired“List of assertions to validate against the trace.”
  • formatstring“Trace format.”
• validate_mcp_responseon 1 other server

  “Validate that an MCP tool response conforms to expected format, schema, and content rules.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  8 inputs, 1 required

  • responsestringrequired“The MCP tool result as a JSON string to validate”
  • expected_typestring“Expected top-level type: "object", "array", "string", "number"”
  • required_keysstring“Comma-separated list of keys that MUST exist in the response (dot-notation for nested: "data.id, data.name")”
  • forbidden_keysstring“Comma-separated list of keys that MUST NOT exist (e.g.”
  • max_response_msnumber“Maximum acceptable latency in ms (will be compared if provided)”
  • actual_latencynumber“Actual measured latency in ms (from the call)”
  • min_itemsnumber“If response is an array, minimum number of items expected”
  • max_size_bytesnumber“Maximum acceptable response size in bytes”
• mcp_server_health_checkon 1 other server

  “Check an MCP server's tool definitions without contacting it — for a server not deployed yet, a stdio server, or a CI gate.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • manifeststringrequired“JSON text: the answer to tools/list (raw JSON-RPC or its result), an array of tools, one tool definition, or a manifest with name/description/tools.”
  • strictboolean“Also require documentation: every description ≥ 20 characters, every parameter with a description and a type.”
• mcp_server_evaluateon 1 other server

  “Run a compliance evaluation against a live MCP server over Streamable HTTP, the way a client meets it.”

  Publisher declares: read-only yes · destructive no · idempotent no · open-world yes

  2 inputs, 1 required

  • urlstringrequired“Public URL of the MCP endpoint (e.g.”
  • test_tool_namestring“Tool to call in the tools/call step.”
• toxicity_scanon 1 other server

  “Scan text for toxic language, hate speech, bias/stereotype framing, violence, sexual and self-harm content.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 1 required

  • textstringrequired“Text to scan”
  • categoriesarray“Categories to check (default: all)”
• function_call_validateon 1 other server

  “Validate an LLM function call / tool_use output: check that function name is in allowed list, arguments match expected schema, no extra/missing args.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  2 inputs, 2 required

  • function_callobjectrequired“The function call object from LLM (e.g.”
  • allowed_functionsarrayrequired“List of allowed function definitions”
• mcp_schema_linton 1 other server

  “Lint an MCP tool definition for best practices: naming conventions, description quality, schema completeness, required fields consistency, description length.”

  Publisher declares: read-only yes · destructive no · idempotent yes · open-world no

  1 input, 1 required

  • tool_definitionobjectrequired“MCP tool definition object with name, description, inputSchema”

Each quoted sentence is the first sentence of the publisher’s own description. The kind of tool and the “changes data” mark are our AI model’s reading of that description, not something we tested: two differently worded runs had to agree, otherwise no label is shown, and nobody has checked them by hand. A tool without the “changes data” mark is described as only reading, searching or calculating, or the two runs did not agree. No tool was called. Read the publisher’s full description before relying on it. “Publisher declares” lists the hints the server itself sends with the tool (MCP annotations: read-only, destructive, idempotent, open-world); they are the publisher's claims, not checked by us. Inputs are the parameters in the tool's own input schema: name, declared type, whether it is required, and the first sentence of its description. Read 2026-10-27.

The registry checks an entry when it is published (each new version), and nothing re-checks it on a schedule. A difference below is about the listing, not a judgement of the publisher.