F

www.ia-qa.com

https://www.ia-qa.com/mcp
45/100 · MCP Trust Grade · checked 4h ago · MCP 2025-06-18
Rug-pull watch: this server's tool surface has changed since baseline — last 13h ago. Continuously watched by wmcp.sh for drift & rug-pulls.

What it offers — 139 tools · Developer Tools

format_json

Format, validate, and pretty-print a JSON string. Returns the formatted JSON or a detailed parse error.

generate_uuid

Generate one or more cryptographically random UUID v4 identifiers. Use this when you need unique IDs for test fixtures, database records, session toke

hash_text

Compute a cryptographic hash of a text string. Use when you need to verify data integrity, generate content fingerprints, hash passwords (prefer SHA-2

count_tokens

Estimate the token count of a text string using the cl100k_base approximation (~4 chars/token). Call this BEFORE sending any text to an LLM API to che

base64_encode

Encode a UTF-8 string to Base64. Use when you need to embed binary data, multi-line text, or special characters safely inside JSON fields, HTTP header

base64_decode

Decode a Base64 string back to UTF-8 text. Use for inspecting Base64-encoded API responses, JWT payload claims, config file values, or attachment data

url_encode

Percent-encode a string for safe use in URLs. Call this before programmatically building query strings, path segments, or form-encoded bodies to preve

url_decode

Decode a percent-encoded URL string back to plain text. Use when parsing query parameters from raw URLs or when displaying encoded values to users.

generate_slug

Convert any string into a URL-friendly slug: lowercase, ASCII-normalized (é→e), special characters removed, spaces replaced with hyphens. Use for g

validate_email

Validate an email address against RFC 5322 syntax before storing it, sending a transactional email, or adding it to a mailing list. Returns { valid, e

minify_js

Minify a JavaScript snippet, function, class, or module up to 50 KB using Terser. Returns minified code and byte savings. Use when embedding scripts i

decode_jwt

Decode a JWT (JSON Web Token) and return its header and payload without verifying the signature. Also reports whether the token is expired and the exa

text_stats

Compute comprehensive statistics for any text: character count (with and without spaces), word count, line count, sentence count, paragraph count, and

generate_password

Generate a cryptographically secure random password using crypto.randomBytes. Configurable length (4–128), uppercase letters, digits, and symbols. U

parse_csv

Parse a CSV string into a JSON array of objects (or raw arrays). Handles RFC 4180 quoted fields, escaped quotes, and custom delimiters. Use when proce

color_convert

Convert a color between HEX, RGB, and HSL formats. Use when translating design tokens between CSS notations, verifying color accessibility, or normali

regex_test

Test a regular expression pattern against an input string and return all matches with their index positions and named capture groups. Use for validati

lorem_ipsum

Generate Lorem Ipsum placeholder text for UI mockups, design prototypes, or test data population. Configurable paragraphs (1–10), sentences per para

+121 more tools

Spec conformance20%100
Security (OWASP MCP)30%10
Reliability / performance20%92
Tool hygiene15%80
Transparency / provenance15%90

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

FAILMCP01 Tool "prompt_test_suite" description contains prompt-injection / hidden-instruction markup.
FAILMCP01 Tool "prompt_injection_scan" description contains prompt-injection / hidden-instruction markup.
FAILMCP01 Tool "token_budget_calculator" description contains prompt-injection / hidden-instruction markup.
FAILMCP01 Tool "system_prompt_builder" description contains prompt-injection / hidden-instruction markup.
FAILMCP08 Tool "detect_secrets" references sensitive file paths / secrets (exfiltration surface).
FAILMCP01 Tool "llm_generate" description contains prompt-injection / hidden-instruction markup.
FAILMCP08 Tool "secret_scan" references sensitive file paths / secrets (exfiltration surface).
FAILMCP01 Tool "run_vlm_test_suite" description contains prompt-injection / hidden-instruction markup.
FAILMCP01 Tool "multimodal_eval_guide" description contains prompt-injection / hidden-instruction markup.
FAILMCP01 Tool "run_vlm_test_suite_batch" description contains prompt-injection / hidden-instruction markup.
FAILMCP01 Tool "generate_eval_yaml" description contains prompt-injection / hidden-instruction markup.
FAILMCP01 Tool "test_skill" description contains prompt-injection / hidden-instruction markup.
FAILMCP08 Tool "env_parse" references sensitive file paths / secrets (exfiltration surface).
Grade another server

We re-grade www.ia-qa.com on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — www.ia-qa.com grade F
Share on X Open card image

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

MCP Trust Grade F · wmcp.sh
[![MCP Trust Grade F](https://wmcp.sh/mcp/grade/www.ia-qa.com/badge.svg)](https://wmcp.sh/mcp/grade/www.ia-qa.com)
<a href="https://wmcp.sh/mcp/grade/www.ia-qa.com"><img src="https://wmcp.sh/mcp/grade/www.ia-qa.com/badge.svg" alt="MCP Trust Grade F · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust
How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.