Home / MCP registry index / io.github.JcJamet/ia-qa-toolbox
IA-QA — 152 QA & Dev Tools for AI Agents
io.github.JcJamet/ia-qa-toolbox in the official MCP registry.
Endpoint https://www.ia-qa.com/mcp. Source: github.com/ia-qa-com/mcp.
The registry describes it as: 152 free QA tools for agents: injection scan, evals, RAG, web audits. Smaller packs: /mcp/{pack}.
We read its 152 tools on 2026-10-27. Nothing in them matched our tool-poisoning rules. It also sets server instructions, text a client puts in front of the model on connect; those were read too.
A clean read means these rules found nothing, not that the server is harmless. A server can change its tools at any time, which is why the index reads it again every week.
Tools it advertises
get_testing_guidelines find_tool generate_test_cases jira_to_test_suite analyze_diff_bugs run_pr_gate_pipeline diff_mappings sandbox_scenario prompt_injection_scan hallucination_check run_eval_contract guardrail_test run_semantic_tests generate_ci_workflow redact_pii secret_scan needle_haystack_generate list_local_tests generate_html_report generate_eval_yaml validate_agent_trajectory metamorphic_check test_skill diff_text validate_mcp_response llm_output_validator compare_responses analyze_responses prompt_test_suite mcp_server_health_check mcp_server_evaluate llm_format_check consistency_check llm_json_schema_check response_quality_score toxicity_scan function_call_validate conversation_analyze mcp_schema_lint cot_analyzer ab_test_report similarity_score bias_detect run_vlm_test_suite multimodal_eval_guide run_vlm_test_suite_batch shield_analyze security_headers_check ssl_certificate_check cors_test cors_checker cookie_security_audit web_security_audit embedding_similarity rag_relevance_rank vector_similarity normalize_vector vector_quantize vector_stats bm25_score and 92 more
Run this server? Show the check in your README
The badge reflects the latest weekly read: 
[](https://lazaretto.dev/mcp-registry/io-github-jcjamet-ia-qa-toolbox)How this was checked
Lazaretto connects to the endpoint the way any MCP client does, asks the server to introduce itself and list its tools, and reads every name, description, parameter schema and server instruction for tool poisoning: hidden directive blocks, orders to read local secrets, parameters built to carry secrets or the conversation out, orders that redirect another server's tools, and invisible characters. It never calls a tool. What we found across the registry.
To run the same check every time Claude Code adds a server, install the free lazaretto-guard plugin. Browse every server in the index.