Qiniso — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Qiniso (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
<img src="docs/logo.svg" width="96" height="96" alt="Qiniso" />
The deterministic fact-verification layer for AI agents.
Verified, trustworthy data tools for AI agents. "Qiniso" means "truth" in Zulu.
Website · npm · MCP endpoint · MCP Registry
</div>
Agents confidently emit IBANs, phone numbers, domains, VAT numbers and crypto addresses that are subtly — and silently — wrong. Qiniso checks the structured facts an agent produces against checksums and curated authoritative data, so a bad value is caught instead of trusted.
It's the deterministic complement to the guardrail stack: security guardrails check whether output is safe, structure guardrails check it's well-formed, and hallucination guardrails ask another LLM if it's faithful to the prompt. None of them check whether a structured fact is actually correct against the real world — because that needs computation or curated data, not another model's opinion. That's Qiniso.
On arbitrary identifiers, a frontier LLM validates them wrong ~91% of the time, cold and silently. Qiniso: 0%.
Settings → Connectors → Add custom connector, and paste — no login, no key:
https://qiniso.qinisolabs.workers.dev/mcpStateless, reads no user data, requires no secrets.
Every check is also a typed function — no MCP required:
npm i @qinisolabs/qinisoimport { validateIban, validateVat } from "@qinisolabs/qiniso";
validateIban("GB82 WEST 1234 5698 7654 32");
// { valid: true, country: "United Kingdom", ... }| Domain | Tools |
|---|---|
| Identifiers | IBAN, payment card (Luhn + brand), ISBN-13, VIN, GTIN/UPC/EAN barcodes (+ GS1 country) |
| Web / network | TLD & domain (IANA root zone), IP, UUID, URL, email |
| Finance | ISIN, CUSIP, SEDOL, LEI, US ABA routing |
| Crypto | Ethereum (EIP-55), Bitcoin (Base58Check / Bech32) addresses |
| National & tax IDs | Brazil CPF/CNPJ, South Africa ID, Spain DNI/NIE, India Aadhaar, Italy, Poland, Netherlands, Belgium, Nordics, Portugal, Turkey, China, Germany Steuer-IdNr, France NIR, Switzerland AHV, Mexico CURP, Croatia OIB, Romania CNP, Bulgaria EGN, Estonia, Czech/Slovak rodné číslo, EU/UK VAT |
| Academic | ISBN-10, ISSN, ORCID |
| Locale | Phone (global), date parsing, currency, holidays (~200 countries), UK VAT-by-date |
| Addresses | UK/US address parsing |
Each tool wraps an authoritative method — a published checksum standard, an audited library (libphonenumber-js, jsvat, date-holidays, @noble/hashes), or curated reference data (the IANA root zone, UK VAT history).
A TypeScript monorepo. Each domain is a typed library in packages/*; the qiniso umbrella aggregates them and exposes one MCP server over three transports — stdio (local / npx), Streamable HTTP (self-host), and a Cloudflare Worker (the hosted edge endpoint). The same core powers the importable library.
npm install
npm run build
npm testApache-2.0
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.