Jarroba Tools · Test audit

io.github.Invarato由 GitHub 帳號 Invarato 發布v0.3.0更新於 Oct 30, 2026

Audits tests instead of writing them: what each one really asserts. 4 tools, local.

發布方自己的服務：audit.domains - Domain Valuation

已驗證STDIO僅桌面開發者工具資料與分析

服務詳細資訊

識別碼: io.github.Invarato/jarroba-tools-tests
傳輸: STDIO
執行環境: Desktop only
信任: Verified
發布於: Sep 16, 2026

安全提示

MCP 服務會接收對話中的工具呼叫請求，並可能執行外部操作。啟用前請先了解該服務能做什麼，並只授予它所需的權限。

註冊中心已驗證此條目所屬的 GitHub 帳號 Invarato。這並不表明該帳號就是產品方。

SourceWeft 的檢查只涵蓋條目是否完整、端點是否回應；不審查伺服器的程式碼，也不審查其工具的行為。

在 README 中新增徽章

向讀者展示該 MCP 服務已收錄於 SourceWeft，徽章連結到本頁。

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.Invarato%2Fjarroba-tools-tests.svg)](https://sourceweft.com/mcp/io.github.Invarato%2Fjarroba-tools-tests?utm_source=readme&utm_medium=badge)

概覽

AI 產生的概覽

本機 MCP 伺服器，用來稽核既有測試檔：每個測試真正斷言了什麼、一次改動是強化還是削弱測試、哪些案例被停用，且不執行任何程式碼。

可以做什麼: 逐一案例稽核測試檔：哪些斷言檢查具體值、哪些只檢查存在性、哪些完全沒有斷言、哪些被停用，並附上判斷依據。
比較同一測試檔的兩個版本，判斷改動是強化還是削弱了安全網。
依 TypeScript 型別或 JSON Schema 推導值得撰寫的案例，包含等價分割、邊界值與屬性測試。
透過 git blame 列出被停用的測試及其存在時間，最舊的排在前面。
適用情境: 當代理傾向以放寬比對器、刪除斷言或略過案例來讓測試變綠時，可用它從模型之外進行核查。也適合在宣稱完成前審查測試改動，或找出覆蓋率報告看不到的長期停用測試。
執行需求: 透過 stdio 在本機執行，通常以 npx 從 npm 套件啟動，因此需要 Node.js，首次下載需要網路。不需帳號、端點或 API 金鑰。環境變數 JARROBA_MCP_DOMAINS 用來選擇要發布哪些工具領域。test_debt 需要目標資料夾中有 git。

安裝前請注意

test_audit 與 test_debt 會讀取啟動它的主機能讀取的任何檔案路徑，因此權限等同於該主機。test_debt 會在指定資料夾中呼叫 git blame。不會上傳資料，也不執行測試，但此套件重新散布了第三方的 tree-sitter 語法。

安裝

在 SourceWeft 中

開啟儀表板中的 Jarroba Tools · Test audit，將其新增到工作區。
為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照儲存庫中的啟動說明。

README

@jarroba/mcp-tests

An MCP server that audits tests instead of writing them — and is meant to be pointed at your own work.

jsonc

// Claude Desktop, Cursor, Cline, VS Code…{ "mcpServers": { "jarroba-tests": { "command": "npx", "args": ["-y", "@jarroba/mcp-tests"] } } }

// Claude Desktop, Cursor, Cline, VS Code…{ "mcpServers": { "jarroba-tests": { "command": "npx", "args": ["-y", "@jarroba/mcp-tests"] } } }

4 tools · ~1.7k tokens of context · stdio, runs on your machine · nothing is uploaded.

Why this exists

Told to "make the tests pass", an agent has two roads: diagnose the bug, or widen the matcher / drop the assertion / skip the case. The second is cheaper, it produces green, and it looks like work.

A better model does not fix that, and neither does asking nicely in the prompt — the incentive is structural. It needs a judge outside the model. That is what this is: the only part of the Jarroba Tools catalogue whose purpose is to disagree with whoever calls it.

The tools


`test_audit`	Case by case, what a test file actually asserts: which assert about a value, which only check that something exists, which assert nothing at all, and which are disabled — with the evidence for each verdict, so you can check the checker. TypeScript, JavaScript, Python, Java, Go.
`test_diff_audit`	Compares two versions of the same file and says whether the change strengthened or weakened the safety net: widened matchers (`toBe` → `toContain` → `toBeGreaterThan`), assertions that vanished, cases that stopped running. Run it on your own diff before claiming you are done.
`test_cases`	From a type to the cases worth writing — equivalence partitions and boundary values from a TypeScript signature or a JSON Schema — saying which technique applies and why. Boundary values mean nothing without an ordering, so a boolean and an enum do not get them. Includes a `fast-check` property test, and the five cases that matter most if you only have time for five (which never start with the typical value).
`test_debt`	Every disabled test with its age, from `git blame`. None of these appears in a coverage report, because as far as the runner is concerned they do not exist — it is the debt nobody measures and the one that lasts longest. Sorted oldest first, which is what makes it actionable.

Executes nothing. No test is run, no code is evaluated: it parses with tree-sitter.

It does not accuse lightly

A matcher it does not recognize comes back as "indeterminate", never as "asserts nothing". When in doubt it abstains, because a false accusation is how a tool like this gets switched off. If your team has a home-made expect(), declare it in dialects and it stops hedging.

Measured against a labelled corpus in five languages (TypeScript, JavaScript, Python, Java, Go): 21 accusations, 21 of them true, zero false positives, and zero cases the parser failed to delimit. That is the honest size of the measurement — 21 accusations, not a benchmark — and it is re-run on every change, so it is a floor rather than a claim.

Privacy

Transport is stdio: your MCP host launches this as a subprocess and talks over stdin/stdout. There is no endpoint, no account and no telemetry. npx downloads the package from npm the first time; after that nothing goes out.

test_audit and test_debt accept file paths and read whatever the process that launched them can read, so they are exactly as privileged as your MCP host. test_debt also shells out to git blame in the folder you point it at — that is where the age comes from, and it is the one thing a browser could never do.

Want everything (90 tools: logs by path, databases on a real ephemeral PostgreSQL, JTD diagrams, SPARQL, make simulation)? @jarroba/mcp. Just the logs? @jarroba/mcp-logs.

MIT — see LICENSE. Source: github.com/Invarato/jarroba-mcp.

This package redistributes tree-sitter grammars (MIT, third-party); their notices are in dist/tree-sitter/NOTICE.txt.

來源：mcp/packages/tests/README.md，提交 b94171a