Jarroba Tools

Analyze an IPv4 network from CIDR or IP+mask: network and broadcast addresses, first/last host, mask and wildcard, host count, class, private/special ranges, binary form and reverse PTR name.

Is this IP inside that CIDR network? Returns true/false.

Split a base network into variable-length subnets (VLSM) sized to the host counts you ask for.

Count tokens with a model's real tokenizer: o200k_base (GPT-4o and later), cl100k_base (GPT-4/3.5), p50k_base, r50k_base; qwen3 (Qwen3/Qwen2.5 family) and mistral-v3 (Mistral 7B v0.3 and similar), run locally. Claude's tokenizer is not public: claude-estimate is o200k × a measured factor, an estimate. Returns tokens, words, characters and % of the context window.

SHA-256, SHA-384 and SHA-512 (hex) of a UTF-8 string.

Decode a JSON Web Token WITHOUT verifying its signature — header, payload, expiry — and flag what makes it dangerous to accept (RFC 8725bis / RFC 9068): alg "none", no exp, exp that is not a NumericDate, alg differing only in letter case, a kid with path traversal or injection characters, a key or key URL carried in the header (jwk/jku/x5u), an access token without typ at+jwt, illegal characters. Give `expectedAlgorithm` (what your verifier uses) and, optionally, `key` to also catch algorithm confusion (HMAC verified with a public key) and HMAC secrets shorter than the hash. The key is only inspected locally, never sent anywhere.

Encode a string to URL-encoding, Base64 and HTML-escape (all three at once).

Try to decode a string from URL-encoding, Base64 and HTML entities.

Escape a string for a target context: javascript, json, sql, regex, html, url or css.

Unescape a string from a context (javascript, json, sql, regex, html, url, css).

Test a regex against a string: whether it matches, every match and its capture groups. Exact matching, not guessed.

Convert an instant between formats: Unix (s/ms), ISO 8601, human, log, and per-locale/timezone. Accepts a Unix number or a date string.

Next run times of a 5-field cron expression, as ISO dates. "When does this actually fire?" is a calculation LLMs routinely get wrong.

Convert a color between HEX, RGB and HSL. Accepts "#3498db", "rgb(52,152,219)", "hsl(...)" or CSS names.

Break a URL into protocol, host, port, path, query (parsed) and fragment.

Read Unix permissions: takes octal ("755") or symbolic ("rwxr-xr-x") and returns both forms plus the breakdown (user/group/other, setuid/setgid/sticky).

Structural differences between two JSON documents, by path: added / removed / changed / type changed.

Convert data sizes between SI multiples (kB/MB, base 1000) and IEC multiples (KiB/MiB, base 1024), and between bits and bytes. Settles the usual KB-vs-KiB confusion.

Encode bits with a Hamming (SEC) code: inserts the parity bits. Input is a string of 0s and 1s.

Detect and correct a single-bit error in a received Hamming word: whether there is an error, which bit, and the corrected data.

IEEE-754 representation of a decimal number in 32-bit (single) or 64-bit (double): sign, exponent, mantissa, raw bits, hex, and the value actually stored.

Show an integer in binary, octal, decimal and hex, plus its bit view (signed/unsigned, popcount, leading/trailing zeros) at the chosen width. Accepts decimal, 0x…, 0b…, 0o…

Evaluate a mathematical expression WITH UNITS and dimensional checking: "100 km/h to m/s", "5 km + 300 m", "70 kg to lbs", "det([[1,2],[3,4]])". Adding incompatible units is an error, not a silent number. Also flags results that are not finite (NaN, infinity).

Solve an equation in one unknown ("x^2 - 5x + 6 = 0", "sin(x) = 0.5") or a linear system (one equation per line). Says whether the answer is EXACT or an approximation, and over which interval it searched. Never invents a root it did not find.

Evaluate a multi-line calculation sheet and return the result of EVERY line. Variables carry downwards, units travel with the value, "#" starts a comment, "ans" is the previous result, and an error stays on its own line instead of killing the sheet. Declare currencies with "# @moneda USD = 1.08 EUR". Good for checking a quote or a budget line by line.

Differentiate an expression symbolically, exactly: "x^3 + 2x", "sin(x)*cos(x)", "x^x". Keeps units, so d/dx (3 m * x) is "3 m" and not 3. Can take higher-order derivatives and evaluate the result at a point. Says which name it read as a unit, and refuses to answer "0" when the variable is not in the expression.

Show the WORKED STEPS of a calculation, verified step by step: a linear or quadratic equation, a derivative (naming which rule applies), or Gaussian elimination on a linear system row by row. Each step comes with the name of the rule used. When it cannot explain a case it says so (covered: false) instead of inventing a plausible-looking derivation — useful when you have to show your work to a person.

Programmer's calculator on exact integers (BigInt): arithmetic (add/sub/mul/div/mod/pow) and bitwise (and/or/xor/nand/nor/xnor/shl/shr/sar/rol/ror). Returns the result in every base.

Parse a SemVer version (major.minor.patch + pre-release + build metadata).

Given a list of versions, which ones satisfy a SemVer range (^, ~, >=, <, x, …).

WCAG contrast ratio between two colors, and whether it passes AA/AAA for normal and large text. Accepts #rgb/#rrggbb, rgb(), hsl() or CSS names.

Convert data between formats: json, yaml, properties, env, csv, markdown.

Unicode details for every character in a string: code point (U+…), name/category, UTF-8/16 bytes, HTML entity, escapes.

Validate a JTD (Jarroba Tools Diagram) document: structure, allowed shapes and chart types, and edge references. Returns {ok, errors, warnings, summary}. Spec: public/jtd.md. Use it to check your JSON before handing it to anyone.

Render a JTD to SVG with no browser and no dev server, so you get the actual drawing back and can check it. Validates first. This is the one to use to SEE what you built.

Render a JTD to PNG with the app's REAL engine (full fidelity; only needed to check skins and effects), and measure it: nodes that overlap and labels cut short with an ellipsis, read from the engine — the defects that are easy to miss when looking at the image. Requires a checkout of the repo AND a running dev server. For everything else use diagram_svg, which needs neither.

Start an EMPTY JTD diagram in memory, discarding any previous one. Lets you build it piece by piece with diagram_add and look at it with diagram_preview, instead of writing the whole JSON in one shot.

Append the "nodes"/"edges"/"charts" of a JTD FRAGMENT (same format) to the diagram held in memory, on top of whatever is already there. Returns the new counts plus the warnings and errors of validating the result.

Return the COMPLETE JTD document built so far in memory, ready to save or paste into the web tool.

Takes no parameters.

Validate and DRAW (SVG) the diagram held in memory, so you can look at it and keep adding or fixing in a loop. This is the generate → look → correct cycle; a model cannot judge a diagram by reading its JSON.

Takes no parameters.

Run SPARQL 1.1 (SELECT/ASK/CONSTRUCT/DESCRIBE) over in-memory RDF — a real engine, not pattern matching. Accepts Turtle, N-Triples, N-Quads, TriG, JSON-LD or RDF/XML. Returns rows (SELECT), a boolean (ASK) or Turtle (CONSTRUCT/DESCRIBE).

Validate RDF data against its SHACL shapes (core subset): sh:targetClass + sh:path with minCount, maxCount, datatype, class and nodeKind. Returns whether it conforms plus every violation (node, property, constraint, message).

Validate a SEMANTIC LAYER document (term→predicate glossary + named SPARQL metrics) before trusting it: structure, required fields (term/target, name/sparql), metric names usable as identifiers, and uniqueness. Returns {ok, errors, warnings}. This is "semantics as code": define once, compute the same everywhere.

Run a NAMED metric from the semantic layer against RDF data: fills its {{param}} placeholders from `args` and executes the resulting SPARQL. Use it so "revenue" or "active users" is computed from the AGREED definition instead of a query you invented — the fix for "one number, three answers". Returns the effective SPARQL and the result, or which parameters are missing.

Detect whether a SQL script comes from MySQL/MariaDB, SQLite, SQL Server or Oracle and translate it to PostgreSQL, explaining every change with its line number. Changes that are NOT exact equivalents are flagged as such.

Run a DDL in an ephemeral PostgreSQL and return the REAL schema (tables, columns, keys, indexes, constraints) plus the design problems found: tables with no primary key, foreign keys with no index, money in floating point, timestamps without a time zone, types that do not match on the two sides of a relation, and redundant indexes. The schema is executed, not guessed with regular expressions.

Turn a DDL into Markdown documentation, DBML (dbdiagram.io) or a Mermaid erDiagram, with relations and their 1:1 / 1:N cardinality derived from the keys.

Turn a DDL into classes in your language: Java/JPA, TypeScript, Python (SQLAlchemy 2.0), C#/EF Core or Go. Types are respected — `numeric` becomes BigDecimal/decimal, never a double — and so is which fields are optional.

Find the foreign-key paths between two tables and return the SELECT with the JOINs already written. If the script carries data, every path is EXECUTED and they are ranked by the rows they actually return — a short path that yields zero rows joins nothing. Hub tables (related to almost everything) can be set aside, since they connect any pair without explaining anything.

Propose the missing foreign keys: find by name and type the columns that look like they point at another table, then CHECK each one against the rows, counting how many of its values actually exist on the other side. The percentage is counted rows, not a hunch. At 100% the relation holds and the returned ALTER TABLE cannot fail; with orphan rows PostgreSQL would reject it, so how many and which ones are reported.

Run the script in an ephemeral PostgreSQL and review row-level security, warning about the SILENT failures: RLS on with no policies, policies with RLS off, the owner bypassing them because FORCE is missing, a superuser role, or the missing GRANT/USAGE that makes "zero rows" not the policy's fault at all. Given a role and a table it also SIMULATES: it looks at the table through that role's eyes, inside a transaction that is rolled back, and reports how many rows it can see, update and delete.

Check a prompt against the rules that make it followable, in English or Spanish. kind "system" (an app's system prompt): explicit output contract, definition of done, what to do when the model does not know (the rule that prevents made-up answers), contradictions, vague or unverifiable requirements, prohibitions with no alternative, examples and context budget. kind "task" (a brief for an agent: "fix X in file Y"): deliverable, where to look, how to verify the result, what not to touch, definition of done. Both also flag an expert persona used to buy accuracy and shouting in capitals. Each finding says what to fix and, when a dated practice backs it, its id for practice_check. It does NOT judge whether the prompt is GOOD — that needs evals and a real model run — it is the deterministic layer underneath. Useful on prompts you write yourself.

Split a text on real boundaries (paragraph, else sentence, never mid-word) with the overlap you ask for, and optionally rank the chunks against a query with BM25. Use it to prepare a RAG corpus, or to see why a query fails to retrieve what it should. No model involved: this is the lexical half, the one that finds literal terms — a code, a surname, a version number — that an embedding dissolves.

Understand a log without reading it: detected format, number of EVENTS (a 40-line stack trace counts as one), breakdown by level, time range, the errors with their ROOT CAUSE resolved, and the most frequent patterns. Accepts a file PATH — that is how you look at a log that does not fit in your context, such as a CI log of hundreds of MB. Logs WRAPPED by whatever collected them (Docker json-file, CRI/Kubernetes `P`/`F` lines, `journalctl -o json`, OpenTelemetry OTLP JSON, AWS CloudTrail) are unwrapped first and the pieces the runtime split are joined back, so a stack trace spread over 40 records is one event; `wrapper` says which.

Cut a log down to a CHARACTER budget while keeping what matters: errors with their full stack trace, the window of what happened just before, and anything that appears only once or twice. Repeats are collapsed with their count ([xN]) and gaps are marked ([...N]). Use it to hand a big log to a model without spending the context on the same line repeated.

Group log lines into TEMPLATES (Drain algorithm): "connected to 10.0.0.1" and "connected to 10.0.0.7" are the same message. Turns a million lines into a few hundred readable things, each with its count, worst level and time range. Also returns the RARE ones (seen once or twice), which in a production log are usually what you were looking for.

Read an exception stack trace (Java/JVM, Python, Node, Go, .NET, Rust, Ruby or PHP) and answer the only question anyone asks it: WHERE TO LOOK. Follows the "Caused by" chain to the root cause, separates your code from the framework, and points at your first frame. Infers which package is yours from the trace itself if you do not say.

Check whether the log is WELL WRITTEN — not what happened in the system: secrets or personal data printed, one line flooding the file, timestamps with no time zone (which make two machines impossible to correlate), the clock going backwards, everything at the same level, no request id, payload dumps, and orphan stack traces with no error line. Every finding comes with its count and a sample; secrets are masked.

Convert a log from one format to another through OpenTelemetry's Logs Data Model: JSON, logfmt, syslog RFC 5424, CSV, OpenTelemetry or Elastic Common Schema. Tells you UP FRONT what the conversion loses — syslog only has eight severities and a text body, so coming down to it from JSON drops fields.

Split a text into claims and say, for each, whether it comes with a source and of what kind: peer-reviewed, preprint (arXiv and friends), registry/link, or self-published. Flags the ABSOLUTE claims with NO source at all, which is the expensive failure mode because they sound exactly as confident as the backed ones. It does NOT say whether something is true — it cannot — it says whether it is supported, which is a different thing. An arXiv DOI is still a preprint: registration is not review. Worth running on your own answer before you send it.

Review an eval suite and run it against the outputs you provide. The review catches what silently ruins a suite: assertions that CANNOT FAIL (an empty `contains`, a regex like `.*`, a case with no assertions) and ones that can never pass (requiring and forbidding the same thing, an inverted range). A suite with those scores 100% on day one and has measured nothing. Assertion types: contains, not-contains, regex, json, range, max-chars and supported (no absolute claim without a source). Calls no model: you pass the outputs in already produced.

Paste the `tools/list` response of an MCP server — yours, or a third party's you are evaluating whether to install — and check its catalogue quality: missing descriptions or annotations, a tool name that suggests it writes or deletes while its annotations say otherwise, context cost per tool (real BPE tokenization), and whether the top-level `instructions` field is set and fits under the ~2 KB some Tool Search clients trim. Add `serverJson`/`packageJson` to also catch the official MCP registry's own field-length and namespace-pattern limits, and a version mismatch between the two — the exact 422/403/400 errors this project hit publishing its own packages. This is NOT an access-security review: it does not evaluate what the tools are permitted to do, only how the catalogue is described. Add `approvedToolsListJson` (the tools/list you reviewed and approved earlier) to catch a "rug pull": tools added or removed since, descriptions that changed or gained poisoning signals, new parameters, and annotations that became less cautious.

Answer WHEN IT STARTED, which is what a log is really asked. Compares each pattern against ITSELF rather than against total volume — in a busy service everything rises at 9am and nothing has happened — and returns three different things: what SPIKED relative to its own normal and at what time; what is NEW, which did not exist before and is usually what a deploy left behind; and what STOPPED APPEARING, which raises no counter and is often the worse news.

What ELSE happened around a moment in time. Given an instant — the spike log_trends returned, or the time of an alert — find the patterns that cluster there and do not appear the same way in the rest of the log. Correlation is NOT causation, and what settles it is order: what started BEFORE comes first and is a candidate explanation; what came after is usually a consequence. Background noise is filtered out even when a narrow window lands on one of its bursts.

What sets a group of events APART from the rest of the log: the field=value pairs over-represented in the selection. E.g. of 300 errors, 92% have `version=2.4.1` against 4% of everything else — the deploy that broke it, found without reading 300 errors. Select by minimum level (default: errors), by text, or by one field=value; that selector is left out of the answer, since it would trivially top it. Fields that are unique per event (request ids, trace ids) are skipped: they identify, they do not distinguish. A difference in proportions, not causation.

Compare two CSV files by a KEY column, of ANY size: which rows are only in A, only in B, and which changed and in WHICH columns. Columns are matched by header name, so a re-exported file with reordered columns or rows is not "everything changed" (it is for a line diff). Both files are streamed from disk; only the keys of B are held in memory, so do not read them into your context — pass the paths. Quoted cells with commas or line breaks inside are handled (RFC 4180). Optionally writes the FULL difference, one row per changed cell (`estado,clave,columna,valor_a,valor_b`), to `outPath`.

Put a folder or a list of rotated logs into TIME ORDER, split into series. Rotation numbering runs BACKWARDS against time: `app.log.3.gz` is older than `app.log.1.gz`, and plain `app.log` is the newest; alphabetically `app.log.10` sorts before `app.log.9` while in time it comes after. Use this BEFORE reading several logs of one service, or you will read them backwards. Returns the paths already ordered, ready to feed to log_analyze one by one.

Validate a Jarroba Tools LOG PROFILE (the `logprofile: 1` JSON that configures the log tools: format, server time zone, own-code prefixes, rules and AI budget). Returns ALL errors at once, each with the exact field (`rules[2].pattern`) and what was expected, so you can fix them in one pass instead of one at a time. Format documented in `public/logprofile.md`.

Propose a LOG PROFILE from a real log: infers the format, the own-code prefix (read from the stack traces, which is where it is demonstrated) and a starting set of rules covering the most frequent errors and whatever floods the file. What it does NOT propose is the server time zone: that is not in the log, and inventing it shifts the entire timeline without anyone noticing. Accepts a file path.

M/M/c queue: with N resources, how many people wait, how long, and what fraction leaves without a place. With `waitingRoom` the model becomes M/M/c/K (finite waiting area — the realistic case); without it the queue is infinite. Output times are in MINUTES. Erlang and M/M/c are exactly the kind of arithmetic a model does "from memory" and gets wrong.

How many resources do you need? Returns the MINIMUM that meets your target (max wait, max turned away, or max utilization) and how the system behaves at that number. This is the question asked before building a place, not after.

Pure LOSS system (Erlang B): there is no waiting area, so whoever finds no free resource leaves. Car parks, workshop bays, phone lines, critical-care beds.

Simulate the queue customer by customer (discrete events, fixed seed, so the result is reproducible). Its job is to CROSS-CHECK the analytic answer: if the simulation and the formula disagree, one of them is wrong.

Which queues a RabbitMQ exchange delivers a message to, and why each binding matches or not: direct, topic (* and # words), fanout and headers (x-match all/any/all-with-x/any-with-x). Ported from RabbitMQ and calibrated against real 4.0.5 and 4.3.6 brokers (thousands of seeded cases, all equal). Unroutable means the message is dropped (or returned with mandatory). One difference: in headers, 1 and 1.0 are different values in RabbitMQ and equal here.

Does an AWS SNS subscription filter policy let this message through, and which key decided it: exact values, prefix, suffix, equals-ignore-case, wildcard, cidr, numeric ranges, anything-but, exists and $or, on MessageAttributes or on the JSON body (FilterPolicyScope=MessageBody). Also rejects what SNS would reject: more than 5 keys, more than 150 combinations, a policy over 256 KB. Built from the AWS documentation; there is no emulator to calibrate it against, and the answer says so.

The partition Kafka's default partitioner picks for a message key: murmur2 over the UTF-8 bytes, made positive, modulo the partition count — with the intermediate numbers so the result can be checked. Ported from Kafka 4.3.1 and checked against its murmur2 test vectors. Only for messages WITH a key (without one, Kafka uses the sticky partitioner, which is not deterministic).

How a Kafka consumer group splits partitions among its members with the classic protocol (the default in Kafka 4.3): range, roundrobin, sticky or cooperative-sticky, ported from Kafka 4.3.1 and checked against its tests. Returns each member's partitions, idle members and the order the assignor walked them; for the sticky strategies give each member's owned partitions (and generation) to see what moves, and with cooperative-sticky which partitions are revoked this round and handed over in the next. Not covered: rack awareness and the server-side assignors of KIP-848; sticky only when all members subscribe to the same topics.

Simulate `make` WITHOUT RUNNING ANYTHING: which targets would be rebuilt, in what order, and WHY, naming the file to blame. Answers the two questions no other tool answers: "why is it rebuilding this when I changed nothing?" and "why is it NOT rebuilding it?". With `project` it reads the Makefile and the REAL mtimes from disk; `touch` asks "what if I changed this file?" without changing it. The reasons use the same vocabulary as the Linux kernel's `make V=2`.

Review a Makefile and return the mistakes that actually bite, each with WHAT is wrong, HOW it breaks in practice and HOW to fix it: a recipe indented with spaces instead of a tab, a `cd` that does not persist to the next line, a `$` that make eats before the shell sees it, `$(shell ...)` inside a `=` variable (re-executed on every use), a pipeline without `pipefail`, a missing `.PHONY`, and a missing `.DELETE_ON_ERROR`. Calibrated NOT to complain about correct code: a well-written Makefile comes back with zero findings.

Generate a ready-to-use Makefile for a stack (node, python, go, rust, c, maven, gradle or generic). What it generates PASSES its own linter with zero findings: it always ships `.DELETE_ON_ERROR`, `SHELL := /bin/bash` with `.SHELLFLAGS := -eu -o pipefail -c`, and declared `.PHONY` targets — the three lines that are almost never there and that prevent the most expensive failures. With `withLogs`, targets record their output through `tee`, redirect stderr, timestamp the file name, and take the log directory as an order-only prerequisite.

Answer the question that decides whether `make` is giving you anything: is this Makefile a BUILD, or a script LAUNCHER? make exists in order NOT to redo what is already done — mtimes, a dependency graph, skipping what did not change — and most Makefiles today use none of it: they are `make test`, `make lint`, `make docker-up`, all .PHONY, all running every time. Here each target is classified WITH THE SIGNAL that decided it (including the signals that pointed the other way: a .PHONY whose recipe creates that very file is a bug waiting to happen), what make is giving you TODAY is measured, and with `convertTo` it is converted to just, Taskfile or npm scripts. Whatever cannot be converted is OMITTED with its reason, rather than emitting a recipe that would look the same and rebuild every time. Honest caveat: `make` is POSIX and is everywhere; just and task have to be installed.

Say which paths a `.gitignore` or `.dockerignore` ignores AND BY WHICH LINE — it is `git check-ignore -v` without git. And it does what no other tool does: it reads the SAME file as git and as Docker and points at where they do NOT decide the same. The two formats look alike and are not: a pattern with no slashes (`node_modules`) applies at any depth in git but ONLY at the root in Docker, so a `.dockerignore` copied from a `.gitignore` pulls into the build context exactly what you thought you had excluded. It also warns about the `!` that cannot work because its folder is already excluded, which is the number-one cause of "my exception does nothing".

What `mvn <command>` would actually run in THIS project, without running Maven: module by module (reactor order with -pl/-am/-amd), phase by phase, goal by goal, and WHERE each goal comes from — the packaging default binding, your pom (with line), the parent (e.g. spring-boot:repackage comes from spring-boot-starter-parent), or a profile. Also: what is declared but never runs and why, which profiles are active and why, what changes between Maven 3.10 and 4.0, and a pom review (duplicates that fail the build since 3.10, plugins without a version). Verified goal by goal against real `mvn` logs (Maven 3.10.0 and 4.0.0-rc-7) on 11 real cases. Unknown parents or plugins are reported, never guessed.

Read the output of `./gradlew <tasks> --dry-run` (or of a real build with --console=plain) and return the task order with each task's project, status (UP-TO-DATE, FROM-CACHE, NO-SOURCE, FAILED…) and its Maven equivalent. A build.gradle is code, so the task graph cannot be known without running Gradle: --dry-run computes it without executing anything. Note that Gradle interleaves tasks of different projects; Maven builds module by module.

Say which LAYERS of a Dockerfile would be rebuilt when given files change, and which come from cache. Dockerfile linters spot suspicious ordering patterns; this SIMULATES invalidation, which is a different thing: it needs to know which files exist and which changed. In Docker, when one layer is invalidated so is EVERY layer after it, so a `COPY . .` before the `RUN` that installs dependencies condemns you to reinstalling all of them every time you touch a line of code — and that shows up here as numbers. Respects the `.dockerignore`: what stays out of the context cannot invalidate anything.

Audit a test file and say, case by case, what it ACTUALLY checks: which ones assert about a value, which only check that something exists, which assert nothing at all, and which are disabled. Returns the EVIDENCE behind each verdict (the assertions it found) so you can check the checker. TypeScript, JavaScript, Python, Java and Go. Executes nothing. Run it on the tests you just wrote, BEFORE you hand them over: told to "make the tests pass", widening a matcher is cheaper than fixing the bug, and this is what notices.

Compare TWO versions of the same test file and say whether the change STRENGTHENED or WEAKENED the safety net: widened matchers (toBe -> toContain -> toBeGreaterThan), assertions that disappeared, and cases that stopped running. Call it on your own work after touching tests, and above all after fixing a red suite: reaching green by softening an assertion is cheaper than fixing the bug, and this is what catches it. Executes nothing.

Data sheet for an element by atomic number or symbol: name, mass, category, group/period/block, electronegativity, radius, ionization energy and electron affinity. Data that does NOT exist comes back as null, never as 0 — a noble gas has no electron affinity, and that is not "zero".

Electron configuration of a neutral element, full and noble-gas abbreviated, with its shells and valence. Flags whether the element is one of the 20 real ANOMALIES (Cr, Cu, Nb, Ru, Pd...) — exactly where the Madelung rule fails and a language model tends to get the rule right and the element wrong.

Electron configuration of an ION. Electrons leave from the HIGHEST n shell, not from the last orbital that was filled: Fe2+ is [Ar]3d6, not [Ar]3d4 4s2. This is the classic mistake and the one seen most often in generated answers.

Hydrogen spectral lines for a series (nLow=1 Lyman, 2 Balmer, 3 Paschen...). Gives the wavelength IN VACUUM and IN AIR, which are different numbers: H-alpha is 656.47 nm in vacuum and 656.28 in air, and confusing them is common. Uses the reduced-mass Rydberg constant (R_H), not R-infinity.

Carrier concentrations in a doped semiconductor at a given temperature: n, p, band gap (Varshni), intrinsic concentration and Fermi level. The minority carrier is computed as ni^2/majority to avoid the catastrophic cancellation that destroys precision when subtracting nearly equal dopings.

Energy curve between the two atoms of a measured diatomic molecule: bond length, well depth (De), REAL dissociation energy (D0) and zero-point energy. D0 is NOT De — the molecule is never at rest at the bottom of the well, not even at 0 K, and in H2 the difference is 0.27 eV. Covalent bonds use Morse, noble gases use Lennard-Jones.

A tight-binding chain of N atoms: the N levels it produces, the bandwidth, and the spacing between levels. Shows where a band COMES FROM — with 2 atoms the level splits in two (alpha +/- beta), and with many the spacing falls as 1/N until it drops below k_B*T, which is when talking about individual levels stops making sense.

Single-electron transistor: charging energy E_C, whether Coulomb blockade occurs, and why it does not when it fails. Checks BOTH conditions — E_C >> k_B*T and tunnel barriers above the resistance quantum R_K = h/e^2 ~ 25.8 kOhm. The second is almost never mentioned, and without it a design with perfect energy still does not blockade.

Why the transistor changed shape: natural length lambda and minimum gate length (5*lambda) for each architecture — planar, FD-SOI, FinFET, GAA nanosheet, nanowire, forksheet and CFET — at the SAME dimensions, which is what isolates the effect of geometry alone. It does not tabulate real process-node dimensions, because those are not public.

Exact pH of a mixture of acids, bases and salts by charge and mass balance — no "x is negligible", no "only the first dissociation" — with the speciation of each weak system and the textbook formula next to it, with its validity rule and how wrong it is here. Every constant comes with the paper or critical compilation it was taken from. Ideal solution at 25 °C. Give listSubstances: true (and no components) to get what it knows.

Titration of what is in the beaker with a titrant from the burette: every equivalence point (volume and pH), the indicators ranked by titration error for each, and the curve. Polyprotic acids, mixtures and weak/weak included, computed exactly. Every constant comes with the paper or critical compilation it was taken from.

Does a sparingly soluble salt precipitate in this solution (Q vs Ksp), and if it does — or if you add the solid in excess — the equilibrium: how much dissolves or precipitates and the final pH, with the basicity of the anion and the common ion taken into account; next to it the textbook formula, which ignores the pH (the CaCO₃ lesson). Every constant comes with the paper or critical compilation it was taken from.

Static noise margin (SNM) of a 6T SRAM cell by the butterfly method: two cross-coupled transfer curves and the side of the largest inscribed square. Returns the margin per mode (hold/read/write), the per-lobe split (which side would flip) and, optionally, the margin expressed in sigmas and the array failure probability. NOT the diagonal shortcut, which returns twice the correct value. First-order Shichman-Hodges: no body effect, no process variation, no parasitics — it shows why the margin moves, it is not a silicon signature.

SRAM read timing from dV = I*t/C: bit-line capacitance, signal needed, and how long before a 1 can be told from a 0. The signal needed is the amplifier sensitivity PLUS several sigmas of its offset, which usually dominates. Also returns the time for 1/2/4/8 banks. First-order: constant cell current, capacitance linear in cell count, no line resistance or column coupling. The reads-per-second figure is signal development only — a real read adds precharge, decoding and amplification.

IR drop across a power delivery grid: worst and mean voltage lost, and where the worst is. Solves the 2D resistive network (GV=I) with sparse conjugate gradient. Use it to compare frontside delivery (entry points further apart) against backside (spread out, lower-resistance metal) at the SAME load, which is the only comparison that means anything. First-order: uniform single-layer mesh, static and equal load per region, no inductive coupling, no switching. Real designs are signed off at 0.5-2.5 % of Vdd.

Standard-cell geometry from its height in TRACKS: height, area, tracks left free for routing, fins per transistor, density and power-rail resistance — plus what you gain and lose against another height. The rail resistance it returns is what ir_drop consumes. Warns when the height does not land on the routing grid, which misaligns pins when alternate rows are flipped to share a rail. Idealised geometry: no real design rules, no vias, no parasitic extraction.

Synchronous path analysis: setup and hold slack, and maximum frequency. The clock period appears ONLY in the setup check, so a setup failure is fixed by lowering the frequency and a hold failure is not — no speed makes it work. Skew enters both with opposite signs. With irDropV+vdd+vth it also derates the logic by voltage (alpha-power law), connecting power delivery to the clock. First-order: ONE path, delays as numbers, no process variation, no jitter, no temperature derating.

Compare the output of a REAL `make` run with what the simulation predicted, matching each command in the log to the Makefile rule that produced it. **What makes this useful, rather than any log analyzer, is the diff:** if make rebuilt something the simulation considered cached, that is the signature of an UNDECLARED DEPENDENCY — it raises no error, it just makes the build slower than it should be, or occasionally fails to rebuild what it should. Line-to-rule matching is APPROXIMATE and each match carries its confidence: recipes are echoed after variable expansion, a leading `@` suppresses them entirely, implicit rules produce commands that are not in the file, and with `-j` the output interleaves. make emits no timestamps, so nothing is said about how long anything took.

From a TYPE to the cases worth testing, with no model involved: equivalence partitions and boundary values derived from a TypeScript signature or a JSON Schema. For each parameter it returns the TECHNIQUE that applies and why — boundary values only mean something where there is an ordering, so they are NOT applied to a boolean or an enum. It adds the properties that can be asserted without knowing the domain, plus a fast-check test ready to paste. Use it BEFORE writing the tests, so you do not miss the cases everyone misses.

A project's DISABLED-test debt, WITH ITS AGE. Walks the folder, finds every `it.skip`, `xit`, `@Ignore`, `@pytest.mark.skip` or `t.Skip`, and dates it with `git blame`. None of those cases appears in a coverage report, because as far as the runner is concerned they do not exist: this is the debt nobody measures and the one that lasts longest — disabled 'to fix later', and later never comes. Sorted oldest first, which is what makes it actionable.

Convert an API collection between formats, entirely offline. Reads Postman v2.1, Insomnia, Bruno .bru, OpenAPI 3.x / Swagger 2.0 (JSON or YAML), a browser HAR, or curl commands - the format is detected. Writes Postman, Bruno (as a file tree) or curl. Reports what cannot be translated (Postman/Bruno scripts, file fields, Insomnia templates) instead of dropping it silently.

List the credentials hidden inside an API collection before you share it: tokens, cookies, API keys and passwords, with their location and a MASKED sample. An exported collection carries its secrets with it, and this is the file people attach to tickets. Heuristic by name: it masks what it recognises, it never claims a file is clean.

Turn a request into pasteable code in one of eleven targets: curl, fetch, axios, Python requests, HTTPie, Go, Java, C#, PHP, PowerShell or Rust. Emits the import lines and escapes per language, and gets right the things that are habitually wrong (in C# the Content-Type belongs to the content, not the headers; in Go an unused import does not compile).

Compare two OpenAPI specifications and say which changes BREAK a client that already exists - which is the question you actually ask before deploying, and the one a colour diff does not answer. Tells apart pairs that look identical in a diff: adding an OPTIONAL parameter breaks nothing, adding a REQUIRED one does; ADDING an enum value is safe, REMOVING one is not; dropping a query parameter is ignored, dropping a path one changes the URL. Every finding says why.

Will the browser send an OPTIONS preflight before this request, and WHY? Answers without touching the network. Half of "it works in curl but not in my page" is a preflight the server does not answer, and knowing which of the three things triggers it (the method, the Content-Type or a custom header) changes where to look. Also lists the headers the browser refuses to let a page set.

Evaluate "can this principal do this action on this scope, and WHY?" against a vendor-neutral identity/RBAC model that mirrors Azure RBAC, AWS IAM/Organizations, GCP Resource Manager or Kubernetes RBAC — each rule verified against the official docs (access.md). Returns a three-valued verdict — allowed / denied / indeterminate (an unmodelled condition would decide it) — with a step-by-step trace of which rule decided and why. Nothing is looked up online: you must pass the scenario data yourself in "world".

The dual of access_check: given a list of candidate principals, returns which of them can do this action on this scope — each with its own verdict and trace, same shape as access_check.

"What if" access diff: compares two versions of the same scenario (e.g. before/after removing a role assignment, or offboarding a principal) against a list of (principal, action, scope) checks, and reports who gains access and who loses it. A check that flips to/from "indeterminate" counts as neither a gain nor a loss — only a genuine allowed<->denied flip does.

Validate an architecture-simulation document (the archsim format, spec: archsim.md next to llms.txt). Checks the JSON shape, known node kinds and edge references, and builds the graph with the type defaults. Returns {ok, error?, summary: {nodes by kind, edges, queues without consumers}}. Use it before archsim_simulate or before handing the JSON to a person.

Simulate an architecture (archsim format) with the Architecture Simulator's engine: steady-state throughput, p50/p95 RESPONSE latency (it ends at the first queue) and PROCESSING latency, availability, bottleneck, infrastructure cost per hour, per-queue lag / "full in N s" / silently lost messages, per-node utilization, and the Report's findings. Optionally also runs a timed phase with a scenario (peak, DDoS, LLM outage) and reports the worst of it. Deterministic; nothing leaves the machine.

Check that Mermaid code actually parses, with Mermaid's own parser (the same version the Jarroba Tools web uses), before you hand it to someone to render. Returns the detected diagram type, or the parser error with its line, column and the tokens it expected — feed that back and fix the diagram, instead of guessing. Catches what models typically get wrong: unquoted labels with parentheses, `end` used as a node id, full-width punctuation, a `%` inside a pie value, an unknown diagram keyword. Covers every diagram type Mermaid knows (flowchart, sequence, class, state, ER, gantt, pie, mindmap, gitGraph, C4, architecture…). It parses only; it does not render.

Validate a JSON document against a JSON Schema — the check to run on your own structured output before handing it over, instead of eyeballing it. Supports draft 2020-12 (default), 2019-09 and draft-07, chosen from the schema's `$schema`; `format` (email, date-time, uri, uuid…) is enforced. Returns `valid` and, if not, EVERY error with the JSON Pointer of the offending value, the keyword that failed and its parameters. Remote `$ref`s are NOT fetched: an unresolvable reference is reported as a schema error.

Before proposing a PostgreSQL migration, MEASURE what each statement would lock, instead of guessing. Runs your schema (DDL + sample data) and then the migration in an ephemeral PostgreSQL (pglite, in memory) and reads, per statement: the strongest table lock actually taken (pg_locks), whether it rewrote the table, whether it scanned it in full, a risk level (lock mode × duration), and the safer rewrite when there is one — CREATE INDEX CONCURRENTLY, ADD CONSTRAINT … NOT VALID + VALIDATE, NOT NULL NOT VALID (PG 18), lock_timeout, new column + backfill instead of ALTER TYPE — with the SQL written out. Nothing touches a real database.

Run a SQL query against your schema in an ephemeral PostgreSQL (pglite, in memory) before you hand it over, instead of guessing whether a column exists: does it run, which columns it returns with their real PostgreSQL types, how many rows, a small sample — or Postgres's own error with its SQLSTATE and position. Runs inside a transaction that is rolled back, so an UPDATE or DELETE is safe to check. Give `compareWith` (e.g. a reference query, or the version before your rewrite) to check both return the same rows: they are also run on adversarial data (NULLs, duplicates, empty tables), and if they differ you get the smallest counter-example with its INSERT statements — the classic NOT IN with a NULL.

Audit a spreadsheet file (.xlsx, .xlsm, .ods, .xls) by RECALCULATING every formula and comparing it with the value saved in the file: cells whose saved value no longer matches its formula (stale or hand-overwritten results), real circular references, functions the recalculation engine does not support, and formula errors. Returns only the problem cells, each with sheet, address, formula, saved and recalculated value; healthy formulas are just counted. Reads the file from disk: pass its path.

Check Cedar authorization policies (the language of AWS Verified Permissions) with the official Cedar engine, instead of reasoning about them: parse errors with their location; validation against your schema if you give one (wrong attribute, wrong entity type, impossible conditions), and of your entities against it; and, for each request, allow or deny with the policies that decided it — so you can tell a missing permit from a forbid that wins, and see a forbid that errored and so did not apply (fails open). Policies may carry @id("…") to name them in the answer.

Before recommending a practice you learned in training, check whether it still holds: a curated, dated register of development and AI practices (still valid, superseded by what, anti-pattern, unnecessary since, or depends on the case), each with its evidence and how sure it is. Give `since` (your knowledge cutoff) to get only what changed after it. If the register has no entry, it says so instead of guessing — no entry means not reviewed, not "fine".

Analyse a conversion A/B (or A/B/n) test the way a statistician would, instead of eyeballing two percentages. Two variants: difference and relative lift with confidence intervals, the right test (two-proportion z, or Fisher's exact when counts are low), p-value, significance and winner, plus the Bayesian probability that the variant beats control (Beta(1,1) priors). More than two: an omnibus chi-square and every variant against control with Holm or Benjamini-Hochberg correction. Always checks sample ratio mismatch (SRM) against the planned split — a broken split invalidates the result, however good it looks.

Plan a conversion A/B test before running it: visitors per variant needed to detect a given relative lift (same formula as R's power.prop.test, two-sided), and how many days that takes with your traffic. Or the reverse: the smallest lift detectable with the visitors you can get.

Looking at an A/B test before it ends needs a stricter threshold per look, or false positives balloon. Returns the two-sided z boundary per look of a group-sequential design, Pocock or O'Brien-Fleming: equally spaced `looks`, or arbitrary `informationFractions` (Lan-DeMets alpha spending). Stop at look k only if |z| ≥ its boundary.

The four DORA delivery metrics (plus rework rate) from data you already have locally, without sending it anywhere: deployment frequency, lead time for changes, change failure rate and time to restore, computed from the JSON of `gh run list --workflow deploy.yml --branch main --limit 1000 --json databaseId,workflowName,headSha,displayTitle,conclusion,status,updatedAt` (or a CSV with a date column), optionally with `git log --first-parent --format=%H%x09%cI%x09%s main` for lead time. Says why each deploy counts as failed, and classifies the team against every State of DevOps report 2019-2024 — saying "ambiguous" or "between bands" when a report's table does not decide — plus the 2025 percentile.

Audit an OAuth 2.0 / OpenID Connect setup against RFC 9700 (OAuth 2.0 Security BCP), RFC 8414 and OIDC Discovery. Give an `authorizeUrl` (the /authorize request your app sends) to check PKCE present and S256, state and its entropy, nonce, PAR, redirect_uri over TLS / loopback / wildcards / fragments, secrets in the URL and scope breadth; and/or a `discoveryDocument` (the openid-configuration or oauth-authorization-server JSON, pasted — nothing is fetched) to check issuer, required fields, HTTPS endpoints, RS256, id_token alg "none", implicit and password grants, PKCE advertised (and "plain"), iss in responses, sender-constrained tokens and PAR. Each failed check carries its severity (must/should) and the RFC section.

Find what a model cannot see in a piece of text: invisible Unicode that smuggles instructions (tag characters U+E0000–E007F, the "ASCII smuggling" used against Copilot and in poisoned MCP/skill files), variation-selector and invisible-bit encodings, zero-width and bidi controls (Trojan Source), look-alike Cyrillic/Greek letters inside Latin words, and odd spaces. Returns every finding with UTF-16 offsets and codepoints, and DECODES the hidden message when it can. Run it on any text you are about to follow as instructions (a README, an issue, a tool description, a web page) — you cannot do this by reading it, because to you those characters are not there. Legitimate uses (emoji ZWJ sequences, flags, RTL scripts) are reported apart as `legitimate`.

Before pasting a log, a HAR file or any text into a ticket, chat or prompt: find the secrets and personal data in it (API keys, JWTs, session cookies, Authorization headers, passwords, cards, emails…). A HAR is read entry by entry, so each finding says in which request, header, cookie, query parameter or body it sits — the way the 2023 Okta support breach happened, through a HAR with live session tokens. Returns a short preview per finding (never the full secret) and `redacted`: the same content with every finding replaced, ready to paste.

Audit GitHub Actions workflows for the injection and supply-chain patterns behind real incidents: untrusted `${{ github.event.* }}` interpolated into `run:` or github-script (command/script injection), `pull_request_target` that checks out the fork's code with the repo's secrets ("pwn request"), actions pinned to a tag or branch instead of a commit SHA (tj-actions/changed-files, CVE-2025-30066, 23,000+ repos), `permissions: write-all`, hard-coded secrets, curl-pipe-to-shell and suspicious hosts. Each finding carries a rule id, severity, confidence (structural vs heuristic), file, line and job. Static analysis of the YAML you pass: nothing is fetched or run.

Audit the HTTP response headers of a site as you pasted them (from curl -I, DevTools or a HAR): an A+…F grade like /headers-audit; Content-Security-Policy (missing, unsafe-inline/eval, wildcards, missing object-src/base-uri/frame-ancestors), HSTS (missing, too short, invalid preload), nosniff, frame options, Referrer-Policy, the obsolete X-XSS-Protection, cookies without Secure/HttpOnly/SameSite, and a Server header that exposes the version. Nothing is requested over the network: it reads what you give it.

Check the authentication of an email and of a domain's mail records: paste the raw headers of a message (Authentication-Results, DKIM-Signature, From, Reply-To, Return-Path) and/or the DNS TXT records (v=spf1, v=DMARC1, v=DKIM1). Finds SPF/DKIM/DMARC failures, a Reply-To or Return-Path on another domain, a DKIM signature that does not cover From or only part of the body (l=), weak or revoked keys, SPF +all / ?all / more than 10 DNS lookups, and DMARC p=none or without reports. Verifies DKIM key strength locally; it does NOT query DNS — paste the records you want checked.

Audit a SAML message: paste it as raw XML, as the base64 of an HTTP-POST binding, or as the deflated+base64 SAMLRequest/SAMLResponse of a Redirect binding (a whole URL works). Finds a missing signature, weak signature or digest algorithms (SHA-1), duplicate IDs and a signature that references a different element than the one being read (signature wrapping), no NotOnOrAfter, expired, no AudienceRestriction, no InResponseTo, unencrypted assertions, a non-success status and secrets in attributes. Returns issuer, NameID and attributes too. It does NOT verify the signature cryptographically against a certificate.

Audit the configuration an AI coding agent runs with, before you trust a repo or install something: Claude Code settings (hooks, permissions like Bash(*), bypass mode, environment variables that redirect the API), MCP server configs for any client (shell servers, unpinned packages, privileged Docker, plain HTTP, auto-approval), VS Code tasks that run when a folder opens and auto-approve settings, Codex and Gemini CLI configs, environment files, and instruction text (CLAUDE.md, AGENTS.md, skills, subagents) carrying hidden Unicode, instruction-override or fake-authority phrasing, data leaks through image links, or download-and-execute commands. Findings that run WITHOUT anyone approving (a hook, a task on open) come first in `runsWithoutAsking`.

Which pods can actually reach which, according to the Kubernetes NetworkPolicies in the manifests you paste (multi-document YAML: Pods/Deployments/StatefulSets…, Services, Namespaces, NetworkPolicies) — computed, not guessed, and checked against netpol-analyzer. Returns the pairs that CAN connect with their ports (everything else is blocked), plus findings: policies or peers that select no pods, the namespaceSelector/podSelector split-list trap, Services selecting no pods or exposing a missing targetPort, missing ConfigMap/Secret/ServiceAccount, unreachable pods, hostNetwork pods. Give `from` and `to` ("namespace/name", or "external") to explain one pair: which policies isolate each side and which rule lets it through. Out of scope: AdminNetworkPolicy, CNI-specific policies, node traffic.

Check a regex for catastrophic backtracking (ReDoS) WITHOUT running it on any text: static analysis with recheck, the same engine the Jarroba Tools /regex page uses. Says whether the pattern is safe, exponential or polynomial (with its degree), which part of the pattern is to blame, and an attack string that triggers it. For the two shapes people type by accident — nested quantifiers like (a+)+ and (\w+\s?)+ — it proposes a rewrite, re-analyses it, and only offers it if it is actually better, saying what it becomes. Use it right after writing a regex that will run on untrusted input.

Will the cluster accept these Kubernetes manifests? Validates them against the OFFICIAL schema of the Kubernetes version you target (1.33–1.37; checked against kubeconform --strict): unknown fields with the one you probably meant (a typo in livenessProbe silently leaves the pod without a probe), wrong types ("80" where an integer goes), missing required fields, removed APIs with what to migrate to. And Pod Security Standards, ported from the official admission controller: the highest level each workload meets, what it violates (the controller's own check ids), and whether its namespace's pod-security.kubernetes.io labels would reject it. If you include RBAC (Roles, Bindings, ServiceAccounts), what each pod could do if compromised: read secrets, exec into pods, escalate…. And reliability checks in the style of kube-score (probes, resources, :latest images, replicas without a PodDisruptionBudget…), which do not affect acceptance. Not covered: CEL rules, formats, CRDs (reported as not validated). For who-can-reach-whom, use k8s_network_reach.

Compute the regulatory base (base reguladora) of a Spanish contributory retirement pension (General Scheme) from the monthly contribution bases, the way the law does it and models usually get wrong: BOTH systems while they coexist (the new one with its 2026-2036 calendar and the previous 300-month one, the higher wins), gaps filled with the minimum base (48 months at 100 %, then 50 %; improved for women under DT 41.ª), the older bases updated with the INE CPI, and the best months chosen. With the days contributed it also gives the percentage and the monthly pension. Each warning says what was assumed. It explains how the number is made; the official simulator of the Social Security has the full record.