QuassLabs API

Run an AI system prompt (and optional agent config) through a 45-criterion alignment/safety rubric. Returns a letter grade (A-F), numeric score, per-flag remediation, and a pass/fail verdict.

Look up Bureau of Land Management land status for a US coordinate: BLM ownership, jurisdiction, allowed activities (rockhounding, camping), permit requirements, and special designations (ACEC, Wilderness, WSA, NM/NCA).

Diagram quality QA. Catch and fix the things that ruin diagrams: (1) unreadable label contrast - POST a mermaid/SVG or HTML diagram, get every WCAG-AA failure (incl. mermaid <style>-block label colors, with unresolvable fills flagged honestly, not false-passed) + auto-corrected colors; (2) harden a mermaid SOURCE before it renders - rewrites every fill/label pair and remaps fills no label color can rescue, which scanning cannot do because a per-node style line overrides the theme block; (3) HTML-looks-fine-but-prints-broken - checks for the print-color-adjust/page-break gotchas and returns the fix CSS; (4) arrows crossing objects - returns the ELK-renderer config + layout rules that minimize crossings. Pure deterministic - no AI, no rate limit.

Detect AI-writing tells in text. POST prose and get a 0-1 ai_ness score + band (low/medium/high) + the EXACT patterns that fired (AI vocabulary, significance inflation, promotional language, filler phrases, negative parallelism, rule-of-three, em-dash overuse) with sample spans. Explainable, not an opaque classifier - every point is a named, located pattern. Deterministic, no LLM. The rewrite is a separate step.

SaaS health advisor. POST your MRR/customers (+ optional churn/CAC/margin/growth) and get ARR/ARPA/LTV/CAC/payback/Rule-of-40/NRR/GRR computed, each with a health tag, plus an overall grade + a ranked "what to fix first" focus list. Deterministic math + advisory, no LLM.

QA advisor: validate acceptance criteria quality. POST a list of AC (or a story) and get per-AC problems (vague/untestable, non-atomic, no observable outcome) + a missing-coverage flag if there is no failure-path AC, plus a 0-100 score and pass/needs_work verdict. Tells you exactly what to fix. Deterministic, no LLM.

Scope-completeness advisor. POST a brief (or requirements[]) + your stories[] and get a coverage score + the gaps (requirements no story covers), orphan stories (possible scope creep), and missing structural buckets (auth/CRUD/error-states/tests). Tells you what the scope is missing. Deterministic, no LLM.

Bug-triage advisor. POST one bug report (or a list) and get severity (critical/high/medium/low), category, whether it has repro steps, and what info is missing (no repro / no expected-vs-actual / no environment). For a list: priority ranking + likely-duplicate clusters. Deterministic, no LLM.

LLM selection + cost advisor. POST a task description (+ optional volume/tokens/constraints like local-only or cheap) and get a recommended model + fallback chain + do-not-use (with reasons), the complexity tier, and per-run + monthly cost. A maintained model+price catalog. Deterministic, no LLM. Tells the AI/user which model to use and what it costs.

Which QL-API endpoint fits this task. POST a task description and get the ranked endpoint(s) that best match, each with a confidence label (high/medium/low). Deterministic keyword matching over this platform's own endpoint catalog, no LLM. Pairs with model_advisor (which itself is one of the recommendable endpoints, so a "which model" task surfaces it) - call them independently and chain the results yourself; optionally pass a prior model_advisor result's rationale in as `context` to bias matching.

Rewrite text to remove AI-writing tells. POST prose and get it back with the mechanical tells fixed (AI vocabulary swapped for plain words, filler phrases stripped, em-dash overuse reduced, significance inflation deflated) plus a change log, before/after ai-ness scores, and a residual list of tells that need human judgment (not auto-rewritten). Code fences, inline code, URLs, and quotes are never touched. Deterministic, no LLM. Sister to humanizer_score (the detector).

Dependency-manifest hygiene check. POST package manifests (package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, composer.json, pubspec.yaml, lockfiles) or an upload_id and get findings with severity + concrete fixes: wildcard/unbounded versions, missing lockfiles, unpinned installs, non-https indexes, install-script risks, dependency-confusion signals, and matches against a static snapshot of famously compromised packages. NOT a live CVE feed - pair with npm audit / pip-audit / osv-scanner for that. Deterministic, no network, no LLM.

Generate a concrete audit-logging spec for an app. POST your feature list (and optional compliance targets: soc2/hipaa/gdpr/pci) and get a full audit-event catalog (namespaced event names, actor/target/required fields, PII flags, retention), a canonical event envelope schema, a storage plan (append-only, access control, alerting), and per-framework compliance notes. A dev team can implement it directly. Deterministic, no LLM. Retention/compliance figures are common-practice defaults to verify with counsel.

Analyze a log file. POST raw log text (or an upload_id from the uploads tool, up to 5MB) and get: level breakdown + time range, error clusters (messages normalized so variable ids/numbers collapse into one signature, with counts + first/last seen + a sample), a timeline, detected anomalies (error spikes, retry storms, new error signatures, log gaps/outages, level-ratio shifts) with evidence, and templated recommendations. Handles JSON-lines and plain formats (ISO8601/syslog/CLF/epoch timestamps). Deterministic, single-pass, no LLM.

Full Jira-ticket quality linter (whole ticket, not just AC - use acceptance_criteria_validator for the deep AC pass). POST one ticket or a batch (max 50) and get per-ticket findings with severity + concrete fixes: missing/weak summary or description, missing AC or estimate, bugs without repro/expected-vs-actual/environment, missing epic link, points-vs-hours mismatch, oversized estimates to split, urgent-but-thin tickets. Returns score, grade, and a ready/needs_work verdict per ticket plus batch summary. Type-aware rules (story/bug/task/epic/subtask), strict profile available. Deterministic, no LLM.

Deterministic structural quality linter for user stories - a sibling to ticket_lint but scoped to story-writing concepts any team recognizes: narrative completeness (As-a/I-want-to/So-that/Summary), acceptance criteria presence, duplicate/unknown dependency IDs, a "Manage X" story with no CRUD split, list stories missing a pagination mention. An OPTIONAL rate_config unlocks team-specific checks (screen-vs-narrative match, hour-rate-per-screen tolerance, required risk level by story type, milestone-code format, required companion story types per milestone) - omit it and only the universal checks run. No house rates or milestone conventions are hardcoded. POST one story or a batch (max 50). Deterministic, no LLM.

Deterministic classifier for story/task hour estimates against benchmarks: flags each estimate in_range, borderline, over, under, or unbenchmarked. Supply either an explicit {min, max} range per type (benchmarks) or a list of historical actual hours per type (historical) that this endpoint derives a mean/stdev variance band from - explicit ranges win when both are given for the same type. No benchmark numbers are built in; a type with neither input is reported unbenchmarked, never guessed at. POST one estimate or a batch (max 200). Deterministic, no LLM.

Deterministic PR description quality linter: flags a missing/too-short body, absent test evidence, absent stated rationale, an unstructured long body, and - only for PRs that look like bugfixes (title prefix fix/bug/hotfix/patch, or an explicit is_bugfix flag) - missing repro steps. Optionally requires a linked issue/ticket reference. Single PR only, no batch. Deterministic, no LLM.

Deterministic commit-message hygiene checker: conventional-commit format, vague-subject detection, subject-length limit, a same-message secret-pattern scan (AWS keys, private key headers, Slack/GitHub tokens, inline password=/secret= style credentials - checked against the message text only, never a diff), and an oversized-commit warning from caller-supplied insertions/deletions. POST one commit or a batch (max 200). Deterministic, no LLM, no network.

Deterministic Flesch Reading Ease and Flesch-Kincaid Grade Level for a block of text, plus word/sentence/syllable counts and a plain-language reading-ease band (very_easy through very_confusing). Syllable counting is the standard vowel-group heuristic (same approximation used by textstat and most open readability tools), not a dictionary lookup. Optionally pass target_grade to get an on_target flag (within +/-2.0 grade levels). Different metric family from humanizer_score - this is pure readability statistics, not AI-writing-tell detection. Deterministic, no LLM.

Static safety analysis of a regular expression plus an English explanation of what it matches. Parses the pattern into an AST and flags the structures that cause catastrophic backtracking (ReDoS): nested unbounded quantifiers like (a+)+, repeated alternations whose branches can start with the same character like (a|ab)*, adjacent unbounded quantifiers over overlapping character sets like \d+\d+, and implausibly large bounded repeats. The pattern is COMPILED but never EXECUTED against input - running a caller-supplied regex is itself the denial-of-service vector. Detection is a structural heuristic, so a risk of "none" means no known dangerous shape was found, not a proof of safety. Deterministic, no LLM.

Sprint/delivery health advisor. POST 1-24 sprints (committed/completed points, optional per-ticket estimate-vs-actual data) and get computed metrics each with a good/warn/bad health tag: velocity avg + trend + stability, commitment reliability, spillover rate, mid-sprint scope change, estimate accuracy (median + chronic-overrun pct), and WIP concentration per assignee. Plus an overall grade and a ranked what-to-fix-first focus list. Pure math + advisory, no LLM.

Worklog/timesheet policy checker - run a batch of worklog entries through configurable guardrails BEFORE posting them to a time-tracking system. Checks: rounding increment (default 0.25h, float-safe), per-entry min/max, per-author daily totals, duplicates, over-estimate alerts (never suggests inflating hours or estimates - flags to PM instead), future dates, weekends, immutable-author edit protection, missing description/ticket. Returns pass/warnings/blocked verdict + per-entry violations with fixes + hour totals by author and date. Caller supplies the reference date - fully deterministic, no LLM.

Get a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id. Two-step: call this, PUT your file to the returned url, then pass upload_id to the consuming endpoint. Uploads auto-expire in 1 day and are readable only by your key. Auth required; not billed.

Submit free-text feedback about the API - a bug, a feature request, a docs gap, a billing question, or anything else. Tied to your key so we can follow up, but not billed and not a support-ticket SLA. Auth required; not billed.

Get a Stripe Checkout link to top up the credits on the API key you are calling with. Starter pack: $5 for 500 credits. Pro pack: $20 for 2500 credits. 1 credit = $0.01. Give the returned checkout_url to a human to complete payment in a browser; the credits are added to this key automatically once the payment succeeds, usually within seconds. Calling this tool does not charge anything and costs no credits.

Rate a specific prior metered call - thumbs up or down, plus an optional comment - keyed by the request_id that call's response reported. Scoped for now to rating compress calls, so you can tell us when a compression was too aggressive or dropped something it shouldn't have. Resubmitting the same request_id overwrites your previous rating rather than adding a second one. Auth required; not billed - rating a call you already paid for should not cost more.

Scan package manifests, lockfiles, and MCP server configs for known supply-chain compromises. The only scanner treating MCP configuration as a security surface. Returns findings with severity and remediation.

Turn a plain-English description into Mermaid diagram source. Describe the flow, system, schema or timeline you want ("a login flow with an OAuth branch and a failure path") and get back complete, valid Mermaid - no need to know the syntax. The mermaid field of the response is directly usable as the mermaid_source input of convert_diagram, so describe -> render is a two-call pipeline. Generation runs on our infrastructure via AWS Bedrock; your description is not sent to any third-party service beyond that.

Make Mermaid diagrams portable. Takes HTML containing <div class="mermaid"> blocks (or a raw Mermaid source) and returns the same document with every diagram pre-rendered to inline SVG and the Mermaid CDN runtime stripped. A CDN-backed diagram only renders if the reader can fetch and run the runtime; inline SVG needs neither, so the output survives offline readers, email clients, Notion/Confluence (which strip <script>), and PDF export. Rendering happens on our infrastructure; diagram content is not sent to any third party.