Jarroba Tools · Test audit

io.github.InvaratoPublished by GitHub account Invaratov0.3.0Updated Oct 30, 2026

Audits tests instead of writing them: what each one really asserts. 4 tools, local.

The publisher's own server: audit.domains - Domain Valuation

VerifiedSTDIODesktop onlyDeveloper ToolsData & Analytics

Overview

AI-generated overview

Local MCP server that audits existing test files — what they really assert, how a diff changed them, and which cases are disabled — without running anything.

What you can do
  • Audit a test file case by case: which assertions check a value, which only check existence, which assert nothing, and which are disabled, each with evidence.
  • Compare two versions of a test file and judge whether the change strengthened or weakened the safety net.
  • Derive the cases worth writing from a TypeScript type or JSON Schema, with equivalence partitions, boundary values and a property test.
  • List disabled tests with their age from git blame, oldest first.
When to use it
Useful when an agent is tempted to make tests pass by widening matchers, dropping assertions or skipping cases, and you want an outside check on the test suite. Also handy for reviewing a test diff before declaring work done, or for finding long-disabled tests that coverage reports never show.
Requirements
Runs locally over stdio, typically launched with npx from the npm package, so Node.js and network access for the first download are needed. No account, endpoint or API key. The JARROBA_MCP_DOMAINS environment variable selects which tool domains are published. test_debt needs git available in the target folder.
Before you install
test_audit and test_debt read any file path the launching host can read, so the server is as privileged as that host. test_debt runs git blame in the folder you point it at. Nothing is uploaded and no tests are executed, but the package redistributes third-party tree-sitter grammars.

Installation

In SourceWeft

  1. Open Jarroba Tools · Test audit in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@jarroba/mcp-tests

An MCP server that audits tests instead of writing them — and is meant to be pointed at your own work.

bash
claude mcp add jarroba-tests -- npx -y @jarroba/mcp-tests
jsonc
// Claude Desktop, Cursor, Cline, VS Code…{ "mcpServers": { "jarroba-tests": { "command": "npx", "args": ["-y", "@jarroba/mcp-tests"] } } }

4 tools · ~1.7k tokens of context · stdio, runs on your machine · nothing is uploaded.

Why this exists

Told to "make the tests pass", an agent has two roads: diagnose the bug, or widen the matcher / drop the assertion / skip the case. The second is cheaper, it produces green, and it looks like work.

A better model does not fix that, and neither does asking nicely in the prompt — the incentive is structural. It needs a judge outside the model. That is what this is: the only part of the Jarroba Tools catalogue whose purpose is to disagree with whoever calls it.

The tools

test_auditCase by case, what a test file actually asserts: which assert about a value, which only check that something exists, which assert nothing at all, and which are disabled — with the evidence for each verdict, so you can check the checker. TypeScript, JavaScript, Python, Java, Go.
test_diff_auditCompares two versions of the same file and says whether the change strengthened or weakened the safety net: widened matchers (toBe → toContain → toBeGreaterThan), assertions that vanished, cases that stopped running. Run it on your own diff before claiming you are done.
test_casesFrom a type to the cases worth writing — equivalence partitions and boundary values from a TypeScript signature or a JSON Schema — saying which technique applies and why. Boundary values mean nothing without an ordering, so a boolean and an enum do not get them. Includes a fast-check property test, and the five cases that matter most if you only have time for five (which never start with the typical value).
test_debtEvery disabled test with its age, from git blame. None of these appears in a coverage report, because as far as the runner is concerned they do not exist — it is the debt nobody measures and the one that lasts longest. Sorted oldest first, which is what makes it actionable.

Executes nothing. No test is run, no code is evaluated: it parses with tree-sitter.

It does not accuse lightly

A matcher it does not recognize comes back as "indeterminate", never as "asserts nothing". When in doubt it abstains, because a false accusation is how a tool like this gets switched off. If your team has a home-made expect(), declare it in dialects and it stops hedging.

Measured against a labelled corpus in five languages (TypeScript, JavaScript, Python, Java, Go): 21 accusations, 21 of them true, zero false positives, and zero cases the parser failed to delimit. That is the honest size of the measurement — 21 accusations, not a benchmark — and it is re-run on every change, so it is a floor rather than a claim.

Privacy

Transport is stdio: your MCP host launches this as a subprocess and talks over stdin/stdout. There is no endpoint, no account and no telemetry. npx downloads the package from npm the first time; after that nothing goes out.

test_audit and test_debt accept file paths and read whatever the process that launched them can read, so they are exactly as privileged as your MCP host. test_debt also shells out to git blame in the folder you point it at — that is where the age comes from, and it is the one thing a browser could never do.

More

Want everything (90 tools: logs by path, databases on a real ephemeral PostgreSQL, JTD diagrams, SPARQL, make simulation)? @jarroba/mcp. Just the logs? @jarroba/mcp-logs.

MIT — see LICENSE. Source: github.com/Invarato/jarroba-mcp.

This package redistributes tree-sitter grammars (MIT, third-party); their notices are in dist/tree-sitter/NOTICE.txt.

Source: mcp/packages/tests/README.md at commit b94171a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

10
  1. v0.3.0LatestOct 29, 2026
  2. v0.2.0Oct 23, 2026
  3. v0.1.11Oct 21, 2026
  4. v0.1.10Oct 18, 2026
  5. v0.1.9Oct 9, 2026
  6. v0.1.7Oct 2, 2026
  7. v0.1.6Sep 29, 2026
  8. v0.1.5Sep 26, 2026
  9. v0.1.4Sep 16, 2026
  10. v0.1.2Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

Other Audit integrations

audit.domains - Domain Valuation

domains.auditOfficial publisher

Deterministic domain-name valuation: fair-value intervals, comparable recorded sales, availability checks, and a verified for-sale listing market.

Streamable HTTPWeb executable
Web Search & Scraping27 toolsNov 1, 2026

Revenue Agent — OpenAPI Audit & Change Detection

news.prhOfficial publisher

A remote MCP endpoint that audits OpenAPI specifications and detects API changes, charging $0.10 USDC per analysis via x402 on Base.

Streamable HTTPWeb executable
Finance2 toolsOct 24, 2026

Zovo Dependency Audit

Published by GitHub account theluckystrike

Audits pasted npm and PyPI dependency manifests for known vulnerabilities, licenses and outdated versions, returning Markdown, CSV and PDF reports.

Streamable HTTPWeb executable
Developer Tools2 toolsNov 8, 2026

SEO Audit & Broken Link Checker

Published by GitHub account prometheus-maker

An Apify-hosted MCP server that audits a website's pages for SEO metadata and finds broken links and images, returning per-page scores.

Streamable HTTPWeb executableAuth
Web Search & ScrapingCredential requiredNov 7, 2026

FinePrint AI Legal Risk & Contract Audit MCP Server

Published by GitHub account RitualDev-Lab

Local in-memory scanner that grades legal contracts, NDAs and leases for risk and drafts redline amendments for coding agents.

STDIODesktop only
Files & StorageNot validated yetNov 7, 2026