# QuassLabs API

> Deterministic developer and delivery tools, callable over REST or MCP. Prompt safety grading, AI-writing detection and rewriting, model selection and cost, diagram accessibility QA, dependency hygiene, log analysis, and agile/QA linting. Most endpoints are pure computation with no LLM in the request path.

Base URL: https://api.quasslabs.com
Auth: `Authorization: Bearer qlk_YOUR_API_KEY` on every request.
Credits: each successful call decrements the key's balance by the endpoint's cost. 429 is checked before credits and is never billed; 5xx is refunded.
MCP: POST https://api.quasslabs.com/mcp - JSON-RPC 2.0 over Streamable HTTP, stateless.

## Machine-readable

- [OpenAPI 3.1 spec](openapi.json): full request and response schemas for every endpoint.
- [OpenAI tool definitions](openai-tools.json): drop-in function-calling definitions.

## Guides

- [Getting started](guides/getting-started.md): get a key and make your first call.
- [Claude and MCP](guides/claude-mcp.md): connect from Claude, Claude Code, or any MCP host.
- [ChatGPT and OpenAI](guides/chatgpt.md): function calling and Custom GPT Actions.
- [Errors and limits](guides/errors.md): every error code, and what to do about each.

## Endpoints

- [POST /v1/acceptance-criteria-validator](reference/acceptance-criteria-validator.md): QA advisor: validate acceptance criteria quality. MCP tool `acceptance_criteria_validator`, 1 credit.
- [POST /v1/alignment-gate](reference/alignment-gate.md): Run an AI system prompt (and optional agent config) through a 45-criterion alignment/safety rubric. MCP tool `alignment_gate`, 2 credits.
- [POST /v1/blm-land-lookup](reference/blm-land-lookup.md): Look up Bureau of Land Management land status for a US coordinate: BLM ownership, jurisdiction, allowed activities (rockhounding, camping), permit requirements, and special designations (ACEC, Wilderness, WSA, NM/NCA). MCP tool `blm_land_lookup`, 1 credit.
- [POST /v1/coverage-check](reference/coverage-check.md): Scope-completeness advisor. MCP tool `coverage_check`, 1 credit.
- [POST /v1/defect-triage](reference/defect-triage.md): Bug-triage advisor. MCP tool `defect_triage`, 1 credit.
- [POST /v1/dependency-check](reference/dependency-check.md): Dependency-manifest hygiene check. MCP tool `dependency_check`, 1 credit.
- [POST /v1/diagram-contrast](reference/diagram-contrast.md): Diagram quality QA. MCP tool `diagram_contrast`, 1 credit.
- [POST /v1/humanize](reference/humanize.md): Rewrite text to remove AI-writing tells. MCP tool `humanize`, 1 credit.
- [POST /v1/humanizer-score](reference/humanizer-score.md): Detect AI-writing tells in text. MCP tool `humanizer_score`, 1 credit.
- [POST /v1/log-analyzer](reference/log-analyzer.md): Analyze a log file. MCP tool `log_analyzer`, 2 credits.
- [POST /v1/log-audit-creator](reference/log-audit-creator.md): Generate a concrete audit-logging spec for an app. MCP tool `log_audit_creator`, 2 credits.
- [POST /v1/model-advisor](reference/model-advisor.md): LLM selection + cost advisor. MCP tool `model_advisor`, 1 credit.
- [POST /v1/saas-metrics](reference/saas-metrics.md): SaaS health advisor. MCP tool `saas_metrics`, 1 credit.
- [POST /v1/sprint-health](reference/sprint-health.md): Sprint/delivery health advisor. MCP tool `sprint_health`, 1 credit.
- [POST /v1/ticket-lint](reference/ticket-lint.md): Full Jira-ticket quality linter (whole ticket, not just AC - use acceptance_criteria_validator for the deep AC pass). MCP tool `ticket_lint`, 1 credit.
- [POST /v1/uploads](reference/uploads.md): Get a presigned S3 PUT URL to upload a file (policy doc, config, log, up to 5MB) that a file-ingesting endpoint then reads by upload_id. MCP tool `uploads`, unmetered.
- [POST /v1/worklog-guardrail](reference/worklog-guardrail.md): Worklog/timesheet policy checker - run a batch of worklog entries through configurable guardrails BEFORE posting them to a time-tracking system. MCP tool `worklog_guardrail`, 1 credit.

## Optional

- POST /v1/keys: key issuance, documented in openapi.json. Requires the `admin` scope and refuses to grant it, so it is an operator endpoint, not a signup route.

## Known gaps

- There is no way to read a key's credit balance: no endpoint returns it and no response header carries it. Callers discover exhaustion via `402 insufficient_credits`.