QuassLabs API — MCP server

37 deterministic developer and delivery tools over one MCP endpoint. No LLM in the loop for most of them: they are scorers, linters, validators and calculators, so results are reproducible and cheap. Covers prompt-safety grading, AI-writing detection and rewriting, LLM selection and cost advice, ticket/story/PR/commit linting, sprint and SaaS metrics, log analysis, dependency hygiene, live vulnerability lookups and supply-chain scanning, CI workflow and SQL migration audits, agent card and skill linting, data cleanup, MCP tool linting, Mermaid diagram generation and offline rendering, and BLM land lookup.

Endpoint: https://api.quasslabs.com/mcp · Transport: streamable HTTP (stateless JSON-RPC 2.0) · Server version: 0.4.0

Documentation: https://docs.quasslabs.com

Try it without a key

tools/list is open, and six free tools run with no key at all: readability_grade, saas_metrics, model_advisor, tool_advisor, diagram_contrast and humanizer_score. No-key calls are limited to 10 a minute and 100 a day per network, and one per JSON-RPC batch.

claude mcp add --transport http quasslabs https://api.quasslabs.com/mcp

The checkers (regex_lint, openapi_diff, supply_chain_scan and the rest) need a free key: see "Getting a key" below.

Connect

With a key, every client sends the same thing: a Bearer qlk_... API key in the Authorization header. Hosts that reserve Authorization for themselves can send X-API-Key: qlk_... instead.

Claude Code

claude mcp add --transport http quasslabs https://api.quasslabs.com/mcp \
  --header "Authorization: Bearer qlk_YOUR_KEY"

Cursor (~/.cursor/mcp.json, or .cursor/mcp.json in a project)

{
  "mcpServers": {
    "quasslabs": {
      "url": "https://api.quasslabs.com/mcp",
      "headers": { "Authorization": "Bearer qlk_YOUR_KEY" }
    }
  }
}

Any other client that supports streamable HTTP

{
  "mcpServers": {
    "quasslabs": {
      "type": "http",
      "url": "https://api.quasslabs.com/mcp",
      "headers": { "Authorization": "Bearer qlk_YOUR_KEY" }
    }
  }
}

Or call it directly:

curl -sS -X POST https://api.quasslabs.com/mcp \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer qlk_YOUR_KEY' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"account","arguments":{"action":"balance"}}}'

Getting a key. Sign up at https://quasslabs.com/api, or from inside an agent with the account tool (action: "signup", no key needed). Either way you get an email with a one-time link, and the key is shown on quasslabs.com, never in the agent transcript. Every key gets 300 free credits each month.

Authentication

initialize, tools/list and ping are unauthenticated, so any client or registry can discover the catalogue without credentials. tools/call requires the API key, except the account tool's signup and checkout_status actions and the six free tools listed under "Try it without a key" (rate-limited per network). Keys are stored only as a SHA-256 hash, so a lost key cannot be recovered, only revoked and reissued.

Pricing

Prepaid credits, 1 credit = $0.01:

Buy a pack from inside an agent with the account tool (action: "buy_credits" returns a Stripe Checkout link for a human to pay), and check what is left with action: "balance". Each key's free monthly credits are spent before purchased credits and refill on the first day of each UTC month.

Failed calls are not billed: a call rejected before the tool runs (bad input, missing key, rate limit, insufficient credits) costs nothing, and a call that fails on our side (any 5xx) is refunded automatically. That includes supply_chain_scan archives that download but are rejected (not a ZIP, an unsafe path, too many entries, or too large once extracted): the archive is ch

... View full README on GitHub