# IA-QA Security — 30 tools (io.github.JcJamet/ia-qa-security): tool descriptions scored

- tools/list taken: 2026-11-02 (UTC)
- From: [Official MCP Registry](https://registry.modelcontextprotocol.io/v0/servers/io.github.JcJamet%2Fia-qa-security/versions/latest)
- Connected to: https://www.ia-qa.com/mcp/security
- Repository: https://github.com/ia-qa-com/mcp
- Scoring rules: v2
- Tools: 30
- Average: 67.7 / 100 (Cloudy)
- Near-identical pairs: 0

This page shows how IA-QA Security — 30 tools (io.github.JcJamet/ia-qa-security)'s tool descriptions scored, the issues found and the names of its tools and parameters. The descriptions are the server's own: read them where the copy came from.

Forecall asked the URL this server lists in the official MCP Registry for its tools/list once, on the date above, without calling any tool. The server may have changed since.

## Across the server

- Minor: 30 tools. Above 25, models start to tell tools apart less well.
- Minor: The server's instructions are 2129 characters. Claude Code reads only the first 2,048 by default (Codex 0.154.0 reads them whole). Put what the server is for first.

## Tools

- `generate_hmac`: 54 / 100
  - Major: Says nothing about when to use it, or when not to.
  - Minor: String arguments with no constraint or example: message, secret.
- `validate_url`: 57 / 100
  - Major: Says nothing about when to use it, or when not to.
- `redact_pii`: 58 / 100
  - Major: Says nothing about when to use it, or when not to.
  - Minor: The description mentions none of its 3 or more arguments.
- `mcp_schema_lint`: 60 / 100
- `parse_http_headers`: 61 / 100
  - Major: Says nothing about when to use it, or when not to.
- `shield_analyze`: 61 / 100
  - Major: Says nothing about when to use it, or when not to.
  - Minor: Arguments without a description: rules[].type, rules[].value, rules[].label.
  - Minor: String arguments with no constraint or example: rules[].type, rules[].value, rules[].label.
- `bias_detect`: 62 / 100
  - Major: Says nothing about when to use it, or when not to.
- `function_call_validate`: 64 / 100
  - Major: Says nothing about when to use it, or when not to.
  - Minor: Arguments without a description: allowed_functions[].name, allowed_functions[].required_args, allowed_functions[].optional_args.
  - Minor: String arguments with no constraint or example: allowed_functions[].name.
  - Minor: The description mentions none of its 3 or more arguments.
- `detect_secrets`: 65 / 100
  - Major: Says nothing about when to use it, or when not to.
- `mcp_server_health_check`: 65 / 100
- `web_security_audit`: 65 / 100
  - Major: Says nothing about when to use it, or when not to.
- `guardrail_test`: 66 / 100
  - Minor: Arguments without a description: rules[].type.
  - Minor: String arguments with no constraint or example: rules[].label.
- `ssl_certificate_check`: 67 / 100
- `cookie_security_audit`: 68 / 100
  - Major: Says nothing about when to use it, or when not to.
- `latency_benchmark`: 68 / 100
  - Major: Says nothing about when to use it, or when not to.
- `secret_scan`: 68 / 100
  - Major: Says nothing about when to use it, or when not to.
- `cors_checker`: 70 / 100
- `generate_password`: 70 / 100
  - Minor: No `required` list, so every argument is optional.
- `http_status_lookup`: 70 / 100
- `prompt_injection_scan`: 70 / 100
- `toxicity_scan`: 70 / 100
  - Minor: String arguments with no constraint or example: text.
- `validate_agent_trajectory`: 71 / 100
  - Minor: Arguments without a description: assertions, assertions[].id.
  - Minor: String arguments with no constraint or example: assertions[].id, assertions[].before, assertions[].after.
- `validate_mcp_response`: 71 / 100
- `decode_jwt`: 73 / 100
- `hash_text`: 73 / 100
  - Minor: String arguments with no constraint or example: input.
- `cors_test`: 75 / 100
- `find_tool`: 75 / 100
- `security_headers_check`: 77 / 100
  - Minor: No `required` list, so every argument is optional.
- `mcp_server_evaluate`: 78 / 100
- `rate_tool`: 78 / 100

Is your server listed here and you would rather it were not? Email support@forecall.dev, and we will take it off within 7 days.

[All scored servers](https://forecall.dev/en/servers)