Jarroba Tools · Test audit

io.github.Invarato由 GitHub 账号 Invarato 发布v0.3.0更新于 Oct 30, 2026

Audits tests instead of writing them: what each one really asserts. 4 tools, local.

发布方自己的服务：audit.domains - Domain Valuation

已验证STDIO仅桌面开发者工具数据与分析

服务详情

标识符: io.github.Invarato/jarroba-tools-tests
传输: STDIO
运行时: Desktop only
信任: Verified
发布于: Sep 16, 2026

安全提示

MCP 服务会接收对话中的工具调用请求，并可能执行外部操作。启用前请先了解该服务能做什么，并只授予它所需的权限。

注册中心已验证此条目所属的 GitHub 账号 Invarato。这并不表明该账号就是产品方。

SourceWeft 的检查只涵盖条目是否完整、端点是否响应；不审查服务器的代码，也不审查其工具的行为。

在 README 中添加徽章

向读者展示该 MCP 服务已收录于 SourceWeft，徽章链接到本页。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.Invarato%2Fjarroba-tools-tests.svg)](https://sourceweft.com/mcp/io.github.Invarato%2Fjarroba-tools-tests?utm_source=readme&utm_medium=badge)

概览

AI 生成的概览

本地 MCP 服务器，用于审计已有测试文件：每个测试真正断言了什么、一次改动是加强还是削弱了测试、哪些用例被禁用，且不执行任何代码。

可以做什么: 逐个用例审计测试文件：哪些断言检查具体值、哪些只检查存在性、哪些完全没有断言、哪些被禁用，并给出判断依据。
比较同一测试文件的两个版本，判断改动是加强还是削弱了安全网。
根据 TypeScript 类型或 JSON Schema 推导值得编写的用例，包括等价类划分、边界值和属性测试。
借助 git blame 列出被禁用的测试及其存在时长，最旧的排在前面。
适用场景: 当智能体倾向于通过放宽匹配器、删除断言或跳过用例来让测试变绿时，可用它从模型之外进行核查。也适合在宣称完成前审查测试改动，或找出覆盖率报告里看不到的长期禁用测试。
运行要求: 通过 stdio 在本机运行，通常用 npx 从 npm 包启动，因此需要 Node.js，首次下载需要网络。无需账号、端点或 API 密钥。环境变量 JARROBA_MCP_DOMAINS 用于选择发布哪些工具域。test_debt 需要目标文件夹中有 git。

安装前请注意

test_audit 和 test_debt 会读取启动它的宿主所能读取的任意文件路径，因此权限等同于该宿主。test_debt 会在指定文件夹中调用 git blame。不会上传数据，也不执行测试，但该包重新分发了第三方的 tree-sitter 语法。

安装

在 SourceWeft 中

打开控制台中的 Jarroba Tools · Test audit，将其添加到工作区。
为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照仓库中的启动说明。

README

@jarroba/mcp-tests

An MCP server that audits tests instead of writing them — and is meant to be pointed at your own work.

jsonc

// Claude Desktop, Cursor, Cline, VS Code…{ "mcpServers": { "jarroba-tests": { "command": "npx", "args": ["-y", "@jarroba/mcp-tests"] } } }

// Claude Desktop, Cursor, Cline, VS Code…{ "mcpServers": { "jarroba-tests": { "command": "npx", "args": ["-y", "@jarroba/mcp-tests"] } } }

4 tools · ~1.7k tokens of context · stdio, runs on your machine · nothing is uploaded.

Why this exists

Told to "make the tests pass", an agent has two roads: diagnose the bug, or widen the matcher / drop the assertion / skip the case. The second is cheaper, it produces green, and it looks like work.

A better model does not fix that, and neither does asking nicely in the prompt — the incentive is structural. It needs a judge outside the model. That is what this is: the only part of the Jarroba Tools catalogue whose purpose is to disagree with whoever calls it.

The tools


`test_audit`	Case by case, what a test file actually asserts: which assert about a value, which only check that something exists, which assert nothing at all, and which are disabled — with the evidence for each verdict, so you can check the checker. TypeScript, JavaScript, Python, Java, Go.
`test_diff_audit`	Compares two versions of the same file and says whether the change strengthened or weakened the safety net: widened matchers (`toBe` → `toContain` → `toBeGreaterThan`), assertions that vanished, cases that stopped running. Run it on your own diff before claiming you are done.
`test_cases`	From a type to the cases worth writing — equivalence partitions and boundary values from a TypeScript signature or a JSON Schema — saying which technique applies and why. Boundary values mean nothing without an ordering, so a boolean and an enum do not get them. Includes a `fast-check` property test, and the five cases that matter most if you only have time for five (which never start with the typical value).
`test_debt`	Every disabled test with its age, from `git blame`. None of these appears in a coverage report, because as far as the runner is concerned they do not exist — it is the debt nobody measures and the one that lasts longest. Sorted oldest first, which is what makes it actionable.

Executes nothing. No test is run, no code is evaluated: it parses with tree-sitter.

It does not accuse lightly

A matcher it does not recognize comes back as "indeterminate", never as "asserts nothing". When in doubt it abstains, because a false accusation is how a tool like this gets switched off. If your team has a home-made expect(), declare it in dialects and it stops hedging.

Measured against a labelled corpus in five languages (TypeScript, JavaScript, Python, Java, Go): 21 accusations, 21 of them true, zero false positives, and zero cases the parser failed to delimit. That is the honest size of the measurement — 21 accusations, not a benchmark — and it is re-run on every change, so it is a floor rather than a claim.

Privacy

Transport is stdio: your MCP host launches this as a subprocess and talks over stdin/stdout. There is no endpoint, no account and no telemetry. npx downloads the package from npm the first time; after that nothing goes out.

test_audit and test_debt accept file paths and read whatever the process that launched them can read, so they are exactly as privileged as your MCP host. test_debt also shells out to git blame in the folder you point it at — that is where the age comes from, and it is the one thing a browser could never do.

Want everything (90 tools: logs by path, databases on a real ephemeral PostgreSQL, JTD diagrams, SPARQL, make simulation)? @jarroba/mcp. Just the logs? @jarroba/mcp-logs.

MIT — see LICENSE. Source: github.com/Invarato/jarroba-mcp.

This package redistributes tree-sitter grammars (MIT, third-party); their notices are in dist/tree-sitter/NOTICE.txt.

来源：mcp/packages/tests/README.md，提交 b94171a