# Canli Validation (npm · canli-validation-mcp)

Deflated Sharpe and PBO checks. A verdict is not admission to anything and is not a forecast.

- Trust score: 81/100 (high trust)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-27

## Components

- remote · `canlicapital.com`: 74/100, [markdown](https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canlicapital.md), [page](https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canlicapital)
- npm · `canli-validation-mcp`: 81/100 (this document), [markdown](https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canli-validation-mcp.md), [page](https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canli-validation-mcp)

## Channel facts

- Registry: `npm`
- Package: `canli-validation-mcp`
- Version: `0.9.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-27.

- **Supply Chain Security**: 63/100
  - No malware found by supply-chain analysis.
  - Known CVEs could not be checked: the version this server declares is not published in its registry.
  - No install/post-install scripts declared.
  - Dependency health could not be checked: the version this server declares is not published in its registry.
- **Provenance & Transparency**: 100/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to arhancanli/canlicapital).
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 79/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 2756 tokens (~172/item across 16 items; 14 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 70/100
  - Stability observed for 21 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
  - Structured output schemas are declared (100% of tools); any adoption earns full credit.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 14 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 16 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Canli Validation MCP server?

Canli Validation runs locally as an npm package, launched with npx -y canli-validation-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add arhancanli-canli-validation-mcp -- npx -y canli-validation-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "arhancanli-canli-validation-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "canli-validation-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "arhancanli-canli-validation-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "canli-validation-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add arhancanli-canli-validation-mcp -- npx -y canli-validation-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "arhancanli-canli-validation-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "canli-validation-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add arhancanli-canli-validation-mcp --command npx --arg -y --arg canli-validation-mcp
```

### Hermes

```yaml
mcp_servers:
  arhancanli-canli-validation-mcp:
    command: "npx"
    args: ["-y", "canli-validation-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "arhancanli-canli-validation-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "canli-validation-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add arhancanli-canli-validation-mcp -t stdio -c npx -a -y canli-validation-mcp
```

### Other

```json
{
  "mcpServers": {
    "arhancanli-canli-validation-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "canli-validation-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-27 (score 81, −10)

- [security regression] Known CVEs: pass → unverified
- [functional regression] Schema quality: 168 → 189
- [functional regression] Schema quality: 168 → 190
- [functional regression] Dependency health: 0.85 → unverified
- [functional improvement] Dependency health: 0.85 → 1.00
- [functional] First check of Tool coverage: 100
- [functional] Package version: 0.7.0 → 0.9.0
- [functional] Package version: 0.7.0 → 0.8.2
- [functional] Package version: 0.7.0 → 0.8.1
- [functional] Package version: 0.7.0 → 0.8.0
- [functional] Package version: 0.7.0 → 0.7.1

### 2026-09-26 (score 91, +15)

- [security improvement] Known CVEs: unverified → pass
- [functional regression] Schema quality: pass → fail
- [functional improvement] Tool coverage: 0% → 100%
- [functional improvement] Dependency health: unverified → 0.85
- [functional] Schema quality: fair → excellent
- [functional] Package version: 0.5.0 → 0.7.0
- [functional] Package version: 0.5.0 → 0.6.0

### 2026-09-25 (score 76, +2)

- [security regression] Known CVEs: pass → unverified
- [security improvement] Provenance: fail → pass
- [security] The attested source repository moved: arhancanli/canlicapital
- [functional regression] Schema quality: 786 → 1027
- [functional regression] Schema quality: 786 → 939
- [functional regression] Dependency health: 0.85 → unverified
- [functional] First check of Schema quality: 100
- [functional] Package version: 0.2.0 → 0.5.0
- [functional] Package version: 0.2.0 → 0.4.0
- [functional] Package version: 0.2.0 → 0.3.1
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-09-24 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-09-22 (score 73, +1)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.50 → unverified
- [functional regression] Schema quality: 644 → 786
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.2 → 0.2.0

### 2026-09-21 (score 72, +11)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.85

### 2026-09-20 (score 61, −10)

- [security regression] Known CVEs: pass → unverified
- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.43 → unverified
- [functional regression] Capabilities: pass → unverified
- [functional regression] Dependency health: 0.85 → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.1 → 0.1.2

### 2026-09-18 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (14)

### `get_key` (~109 tokens)

Get a free validation key

Issue a free validation key for this session. Rarely needed: the first validation issues one itself unless CANLI_KEY or local mode is set, and the read tools need none. Quotas: 1000 validations per key per UTC day, 5 keys per client per UTC day, 1048576 bytes per validation request, 1024 bytes per key revocation request, 20000 observations per series, 200 variants per matrix.

Input parameters:

- `label` (string): Name for the key.

Output parameters:

- `data` (object)
- `error`
- `key_present` (boolean)
- `key_source` (string)
- `note` (string)

### `validate_deflated_sharpe` (~301 tokens)

Validate deflated Sharpe

Deflated Sharpe ratio: the probability (0 to 1) that the selected strategy's Sharpe beats the best that luck gives across the variants tried, with the probabilistic Sharpe and that luck benchmark. Send the seven statistics or a return series. With every variant's returns use validate_overfitting; luck as a trial count, validate_luck_trials; a multiple-testing haircut, validate_haircut_sharpe. A deflated Sharpe or overfitting probability above or below any threshold is not admission to anything and is not a forecast.

Input parameters:

- `cross_trial_sharpe_sd_annualized` (number): Standard deviation of annualized Sharpe across those trials.
- `effective_independent_trials` (integer): Independent variants tried before choosing this one.
- `non_excess_kurtosis` (number): Kurtosis, not excess kurtosis; 3 if Normal.
- `observations` (integer): Number of return observations.
- `observed_sharpe_annualized` (number): Annualized Sharpe as observed.
- `periods_per_year` (number): Periods per year: 252 daily, 365 crypto, 52 weekly, 12 monthly.
- `returns` (array): Periodic returns as fractions (0.01 = 1%), oldest first; replaces the Sharpe, observations, skew and kurtosis.
- `skew` (number): Skewness of returns; 0 if Normal.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `validate_overfitting` (~169 tokens)

Validate overfitting (CSCV)

Probability of backtest overfitting (0 to 1) by CSCV: how often the in-sample best variant falls below the out-of-sample median. Needs every variant's returns (periods by variants); with summary statistics only, use validate_deflated_sharpe. A deflated Sharpe or overfitting probability above or below any threshold is not admission to anything and is not a forecast.

Input parameters:

- `matrix` (array, required): Returns as fractions, one row per period, one column per variant.
- `max_combinations` (integer): Most splits evaluated, up to 2000 (default).
- `n_splits` (integer): Even number of blocks, at least 2; default 16.
- `seed` (number): Sampling seed; default 42.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `validate_paper_evidence` (~98 tokens)

Validate paper evidence

Whether a paper or simulated performance record meets canli.paper-evidence.v0, with a JSON pointer per failure. Checks structure and required disclosures, not whether the returns are good. This verdict is about the series exactly as submitted. The service never saw the data source, its costs, survivorship, or any lookahead in how the series was built.

Input parameters:

- `record` (object, required): A canli.paper-evidence.v0 record.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `validate_breadth` (~154 tokens)

Validate breadth ceiling

Book Sharpe ceiling from adding sleeves of this quality and correlation, the Sharpe at a sleeve count, and the sleeves a target needs. For portfolio construction; it validates no single strategy. This verdict is about the series exactly as submitted. The service never saw the data source, its costs, survivorship, or any lookahead in how the series was built.

Input parameters:

- `average_pairwise_correlation` (number, required): Average correlation between sleeves, -1 to 1.
- `sleeve_sharpe` (number, required): Annualized Sharpe of one sleeve.
- `sleeves` (integer): Sleeve count, for that book's Sharpe.
- `target` (number): Target book Sharpe, for the sleeves it needs.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `validate_track_record` (~242 tokens)

Minimum track record length

Minimum track record length (observations and years) for an observed Sharpe to beat a benchmark at a confidence level; with observations, the record's probabilistic Sharpe so far. For live or paper records; to size a backtest for its trials, use validate_backtest_length. A deflated Sharpe or overfitting probability above or below any threshold is not admission to anything and is not a forecast.

Input parameters:

- `benchmark_sharpe_annualized` (number): Annualized Sharpe to beat; default 0.
- `confidence` (number): Between 0 and 1; default 0.95.
- `non_excess_kurtosis` (number, required): Kurtosis, not excess kurtosis; 3 if Normal.
- `observations` (integer): Record length so far, for its probabilistic Sharpe.
- `observed_sharpe_annualized` (number, required): Annualized Sharpe as observed.
- `periods_per_year` (number, required): Periods per year: 252 daily, 365 crypto, 52 weekly, 12 monthly.
- `skew` (number, required): Skewness of returns; 0 if Normal.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `validate_backtest_length` (~166 tokens)

Minimum backtest length

Minimum backtest length (years) before the best of N independent trials is not expected to reach a target Sharpe by luck; with backtest_years, the most trials those years allow. For planning a search; once it has a result, use validate_deflated_sharpe. A deflated Sharpe or overfitting probability above or below any threshold is not admission to anything and is not a forecast.

Input parameters:

- `backtest_years` (number): Backtest length in years, for the most trials it allows.
- `effective_independent_trials` (integer): Independent trials tried (backtests, parameter sets, ideas).
- `target_sharpe_annualized` (number): In-sample annualized Sharpe you would call a discovery; default 1.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `validate_haircut_sharpe` (~262 tokens)

Haircut Sharpe ratio

Haircut Sharpe for multiple testing (Harvey and Liu 2015): the Sharpe a single test would have needed, by Bonferroni and independent tests, and with the other tests' Sharpes, Holm and BHY. For the probability the Sharpe is real, use validate_deflated_sharpe. A deflated Sharpe or overfitting probability above or below any threshold is not admission to anything and is not a forecast.

Input parameters:

- `autocorrelation` (number): Lag-1 autocorrelation of returns, -1 to 1; default 0. Corrects the annualized Sharpe (Lo 2002).
- `observations` (integer, required): Return observations behind the Sharpe.
- `observed_sharpe_annualized` (number, required): Annualized Sharpe as observed.
- `other_sharpe_ratios_annualized` (array): Annualized Sharpes of the other tests over the same observations; adds Holm and BHY.
- `periods_per_year` (number, required): Periods per year: 252 daily, 365 crypto, 52 weekly, 12 monthly.
- `tests` (integer): Tests run, this one included; gives the Bonferroni and independent-test haircuts.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `validate_luck_trials` (~245 tokens)

Luck-equivalent trials

How many skill-less strategies a search would need for its best to reach this Sharpe by luck (Monte Carlo), and with a trial count, the chance it did. States luck as the best of N random tries; for the probability the Sharpe is real, use validate_deflated_sharpe. A deflated Sharpe or overfitting probability above or below any threshold is not admission to anything and is not a forecast.

Input parameters:

- `autocorrelation` (number): Lag-1 autocorrelation of returns, -1 to 1; default 0. Corrects the annualized Sharpe (Lo 2002).
- `effective_independent_trials` (integer): Independent trials tried; adds the chance the best reached this Sharpe by luck.
- `observations` (integer, required): Return observations behind the Sharpe.
- `observed_sharpe_annualized` (number, required): Annualized Sharpe as observed.
- `periods_per_year` (number, required): Periods per year: 252 daily, 365 crypto, 52 weekly, 12 monthly.
- `skew` (number): Skewness; below -0.5 the reading warns the counts are too generous.

Output parameters:

- `computed` (string)
- `data` (object)
- `error`
- `limits` (array)
- `note` (string)
- `receipt`

### `audit_backtest` (~391 tokens)

Audit a backtest

One-call audit of a strategy's returns: deflated Sharpe, minimum track record and, with every variant's returns, the probability of backtest overfitting, each the matching validator's result with its own receipt. Point returns_file at the backtest's CSV or JSON instead of pasting long series. Prefer it to calling the validators one by one; one validation per check. A deflated Sharpe or overfitting probability above or below any threshold is not admission to anything and is not a forecast.

Input parameters:

- `benchmark_sharpe_annualized` (number): Annualized Sharpe to beat; default 0.
- `confidence` (number): Between 0 and 1; default 0.95.
- `cross_trial_sharpe_sd_annualized` (number, required): Standard deviation of annualized Sharpe across those trials.
- `effective_independent_trials` (integer, required): Independent variants tried before choosing this one.
- `n_splits` (integer): Even number of blocks, at least 2; default 16.
- `periods_per_year` (number, required): Periods per year: 252 daily, 365 crypto, 52 weekly, 12 monthly.
- `returns` (array): Periodic returns as fractions (0.01 = 1%), oldest first; replaces the Sharpe, observations, skew and kurtosis.
- `returns_column`: Column name or 1-based position, when returns_file has several numeric columns.
- `returns_file` (string): Path to a CSV or JSON of the returns on this machine (not on the hosted endpoint), instead of returns.
- `variants` (array): Optional returns of every variant tried (this one included), one row per period, one column per variant; adds the overfitting check.
- `variants_file` (string): Path to a CSV or JSON with one numeric column per variant, instead of variants.

Output parameters:

- `checks` (object)
- `error`
- `limits` (array)
- `not_run` (object)
- `note` (string)
- `readings` (object)

### `get_receipt` (~92 tokens)

Get a receipt

Fetch a stored verdict by receipt id to re-read it. No key; verify_receipt checks it is genuine. The receipt is content-hashed, reproducible from the open-source core it names, and signed with Ed25519 by a key published at https://canlicapital.com/.well-known/canli-receipt-keys.json.

Input parameters:

- `id` (string, required): Receipt id from a validation result.

Output parameters:

- `data` (object)
- `error`
- `limits` (array)

### `verify_receipt` (~128 tokens)

Verify a receipt

Verify a receipt offline: its Ed25519 signature against the bundled canlicapital.com key, its output hash and its id. Send an id to fetch it first, or the receipt itself. The receipt is content-hashed, reproducible from the open-source core it names, and signed with Ed25519 by a key published at https://canlicapital.com/.well-known/canli-receipt-keys.json.

Input parameters:

- `id` (string): Receipt id from a validation result.
- `receipt` (object): A receipt as get_receipt returns it, to verify without fetching.

Output parameters:

- `checks`
- `error`
- `key_id` (string|null)
- `meaning` (string)
- `receipt_id` (string|null)
- `valid` (boolean)

### `service_status` (~66 tokens)

Service status

Whether the validation API is up, with its quotas; check after a timeout before resubmitting. No key. This verdict is about the series exactly as submitted. The service never saw the data source, its costs, survivorship, or any lookahead in how the series was built.

Output parameters:

- `data` (object)
- `error`
- `limits` (array)

### `company_financial_history` (~184 tokens)

Company financial history (SEC)

SEC-reported financial history for one company in the canlicapital.com reference, by cik or ticker: without a concept, the histories available; with one, observations newest first with accession, form, filed date and unit, plus the source's SHA-256. For point-in-time values use canli-fundamentals-mcp. Public company accounting reference, not market prices, returns, an investment recommendation, or ALPHAC performance. Validate a separately constructed return series with the validation API; accounting values are not returns.

Input parameters:

- `cik` (string): SEC CIK; send cik or ticker.
- `concept` (string): us-gaap concept such as Assets; omit to list them.
- `limit` (integer): Most observations, newest first; default 40.
- `ticker` (string): Ticker such as AAPL; send ticker or cik.

Output parameters:

- `claim_boundary` (string)
- `company` (object)
- `error`
- `histories` (array)
- `history` (object)
- `source` (object)

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canli-validation-mcp#diagnostics

## Score history

- 2026-09-27: 81
- 2026-09-26: 91
- 2026-09-25: 76
- 2026-09-24: 74
- 2026-09-23: 73
- 2026-09-22: 73
- 2026-09-21: 72
- 2026-09-20: 61
- 2026-09-19: 71
- 2026-09-18: 71
- 2026-09-17: 70
- 2026-09-16: 70
- 2026-09-15: 69
- 2026-09-14: 69
- 2026-09-13: 65
- 2026-09-12: 65
- 2026-09-11: 65
- 2026-09-10: 65
- 2026-09-09: 65
- 2026-09-08: 65
- 2026-09-07: 65
- 2026-09-06: 50

## Common questions

### What is the Canli Validation MCP server?

Canli Validation is an MCP server listed in the public MCP registry as io.github.arhancanli/canli-validation-mcp. Deflated Sharpe and PBO checks. A verdict is not admission to anything and is not a forecast. This page covers its npm package (canli-validation-mcp).

### Is the Canli Validation MCP server safe to use?

Canli Validation scores 81 out of 100 on VerifyMCP. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Canli Validation MCP server expose?

Canli Validation exposes 14 tools: get_key, validate_deflated_sharpe, validate_overfitting, validate_paper_evidence, validate_breadth, and 9 more. Their descriptions and schemas cost roughly 2,607 tokens of context every time the server is loaded.

### Is the Canli Validation MCP server still maintained?

Canli Validation is still listed as active in the MCP registry. We last reached this channel on 27 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Canli Validation MCP server under?

Canli Validation declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/canli-validation-mcp
- Socket report: https://socket.dev/npm/package/canli-validation-mcp
- Repository: https://github.com/arhancanli/canlicapital
- Website: https://canlicapital.com/developers#ai-assistant
- Changelog RSS feed: https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canli-validation-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canli-validation-mcp.json
- HTML version of this page: https://verifymcp.io/servers/arhancanli-canli-validation-mcp/canli-validation-mcp