Jarroba Tools

Analyse a conversion A/B (or A/B/n) test the way a statistician would, instead of eyeballing two percentages. Two variants: difference and relative lift with confidence intervals, the right test (two-proportion z, or Fisher's exact when counts are low), p-value, significance and winner, plus the Bayesian probability that the variant beats control (Beta(1,1) priors). More than two: an omnibus chi-square and every variant against control with Holm or Benjamini-Hochberg correction. Always checks sample ratio mismatch (SRM) against the planned split — a broken split invalidates the result, however good it looks.

Plan a conversion A/B test before running it: visitors per variant needed to detect a given relative lift (same formula as R's power.prop.test, two-sided), and how many days that takes with your traffic. Or the reverse: the smallest lift detectable with the visitors you can get.

Looking at an A/B test before it ends needs a stricter threshold per look, or false positives balloon. Returns the two-sided z boundary per look of a group-sequential design, Pocock or O'Brien-Fleming: equally spaced `looks`, or arbitrary `informationFractions` (Lan-DeMets alpha spending). Stop at look k only if |z| ≥ its boundary.

Evaluate "can this principal do this action on this scope, and WHY?" against a vendor-neutral identity/RBAC model that mirrors Azure RBAC, AWS IAM/Organizations, GCP Resource Manager or Kubernetes RBAC — each rule verified against the official docs (access.md). Returns a three-valued verdict — allowed / denied / indeterminate (an unmodelled condition would decide it) — with a step-by-step trace of which rule decided and why. Nothing is looked up online: you must pass the scenario data yourself in "world".

"What if" access diff: compares two versions of the same scenario (e.g. before/after removing a role assignment, or offboarding a principal) against a list of (principal, action, scope) checks, and reports who gains access and who loses it. A check that flips to/from "indeterminate" counts as neither a gain nor a loss — only a genuine allowed<->denied flip does.

The dual of access_check: given a list of candidate principals, returns which of them can do this action on this scope — each with its own verdict and trace, same shape as access_check.

Audit GitHub Actions workflows for the injection and supply-chain patterns behind real incidents: untrusted `${{ github.event.* }}` interpolated into `run:` or github-script (command/script injection), `pull_request_target` that checks out the fork's code with the repo's secrets ("pwn request"), actions pinned to a tag or branch instead of a commit SHA (tj-actions/changed-files, CVE-2025-30066, 23,000+ repos), `permissions: write-all`, hard-coded secrets, curl-pipe-to-shell and suspicious hosts. Each finding carries a rule id, severity, confidence (structural vs heuristic), file, line and job. Static analysis of the YAML you pass: nothing is fetched or run.

Audit the configuration an AI coding agent runs with, before you trust a repo or install something: Claude Code settings (hooks, permissions like Bash(*), bypass mode, environment variables that redirect the API), MCP server configs for any client (shell servers, unpinned packages, privileged Docker, plain HTTP, auto-approval), VS Code tasks that run when a folder opens and auto-approve settings, Codex and Gemini CLI configs, environment files, and instruction text (CLAUDE.md, AGENTS.md, skills, subagents) carrying hidden Unicode, instruction-override or fake-authority phrasing, data leaks through image links, or download-and-execute commands. Findings that run WITHOUT anyone approving (a hook, a task on open) come first in `runsWithoutAsking`.

Compare two OpenAPI specifications and say which changes BREAK a client that already exists - which is the question you actually ask before deploying, and the one a colour diff does not answer. Tells apart pairs that look identical in a diff: adding an OPTIONAL parameter breaks nothing, adding a REQUIRED one does; ADDING an enum value is safe, REMOVING one is not; dropping a query parameter is ignored, dropping a path one changes the URL. Every finding says why.

Turn a request into pasteable code in one of eleven targets: curl, fetch, axios, Python requests, HTTPie, Go, Java, C#, PHP, PowerShell or Rust. Emits the import lines and escapes per language, and gets right the things that are habitually wrong (in C# the Content-Type belongs to the content, not the headers; in Go an unused import does not compile).

Convert an API collection between formats, entirely offline. Reads Postman v2.1, Insomnia, Bruno .bru, OpenAPI 3.x / Swagger 2.0 (JSON or YAML), a browser HAR, or curl commands - the format is detected. Writes Postman, Bruno (as a file tree) or curl. Reports what cannot be translated (Postman/Bruno scripts, file fields, Insomnia templates) instead of dropping it silently.

List the credentials hidden inside an API collection before you share it: tokens, cookies, API keys and passwords, with their location and a MASKED sample. An exported collection carries its secrets with it, and this is the file people attach to tickets. Heuristic by name: it masks what it recognises, it never claims a file is clean.

Will the browser send an OPTIONS preflight before this request, and WHY? Answers without touching the network. Half of "it works in curl but not in my page" is a preflight the server does not answer, and knowing which of the three things triggers it (the method, the Content-Type or a custom header) changes where to look. Also lists the headers the browser refuses to let a page set.

Simulate an architecture (archsim format) with the Architecture Simulator's engine: steady-state throughput, p50/p95 RESPONSE latency (it ends at the first queue) and PROCESSING latency, availability, bottleneck, infrastructure cost per hour, per-queue lag / "full in N s" / silently lost messages, per-node utilization, and the Report's findings. Optionally also runs a timed phase with a scenario (peak, DDoS, LLM outage) and reports the worst of it. Deterministic; nothing leaves the machine.

Validate an architecture-simulation document (the archsim format, spec: archsim.md next to llms.txt). Checks the JSON shape, known node kinds and edge references, and builds the graph with the type defaults. Returns {ok, error?, summary: {nodes by kind, edges, queues without consumers}}. Use it before archsim_simulate or before handing the JSON to a person.

A tight-binding chain of N atoms: the N levels it produces, the bandwidth, and the spacing between levels. Shows where a band COMES FROM — with 2 atoms the level splits in two (alpha +/- beta), and with many the spacing falls as 1/N until it drops below k_B*T, which is when talking about individual levels stops making sense.

Programmer's calculator on exact integers (BigInt): arithmetic (add/sub/mul/div/mod/pow) and bitwise (and/or/xor/nand/nor/xnor/shl/shr/sar/rol/ror). Returns the result in every base.

Energy curve between the two atoms of a measured diatomic molecule: bond length, well depth (De), REAL dissociation energy (D0) and zero-point energy. D0 is NOT De — the molecule is never at rest at the bottom of the well, not even at 0 K, and in H2 the difference is 0.27 eV. Covalent bonds use Morse, noble gases use Lennard-Jones.

Differentiate an expression symbolically, exactly: "x^3 + 2x", "sin(x)*cos(x)", "x^x". Keeps units, so d/dx (3 m * x) is "3 m" and not 3. Can take higher-order derivatives and evaluate the result at a point. Says which name it read as a unit, and refuses to answer "0" when the variable is not in the expression.

Evaluate a mathematical expression WITH UNITS and dimensional checking: "100 km/h to m/s", "5 km + 300 m", "70 kg to lbs", "det([[1,2],[3,4]])". Adding incompatible units is an error, not a silent number. Also flags results that are not finite (NaN, infinity).

Evaluate a multi-line calculation sheet and return the result of EVERY line. Variables carry downwards, units travel with the value, "#" starts a comment, "ans" is the previous result, and an error stays on its own line instead of killing the sheet. Declare currencies with "# @moneda USD = 1.08 EUR". Good for checking a quote or a budget line by line.

Solve an equation in one unknown ("x^2 - 5x + 6 = 0", "sin(x) = 0.5") or a linear system (one equation per line). Says whether the answer is EXACT or an approximation, and over which interval it searched. Never invents a root it did not find.

Show the WORKED STEPS of a calculation, verified step by step: a linear or quadratic equation, a derivative (naming which rule applies), or Gaussian elimination on a linear system row by row. Each step comes with the name of the rule used. When it cannot explain a case it says so (covered: false) instead of inventing a plausible-looking derivation — useful when you have to show your work to a person.

Check Cedar authorization policies (the language of AWS Verified Permissions) with the official Cedar engine, instead of reasoning about them: parse errors with their location; validation against your schema if you give one (wrong attribute, wrong entity type, impossible conditions), and of your entities against it; and, for each request, allow or deny with the policies that decided it — so you can tell a missing permit from a forbid that wins, and see a forbid that errored and so did not apply (fails open). Policies may carry @id("…") to name them in the answer.

Exact pH of a mixture of acids, bases and salts by charge and mass balance — no "x is negligible", no "only the first dissociation" — with the speciation of each weak system and the textbook formula next to it, with its validity rule and how wrong it is here. Every constant comes with the paper or critical compilation it was taken from. Ideal solution at 25 °C. Give listSubstances: true (and no components) to get what it knows.

Does a sparingly soluble salt precipitate in this solution (Q vs Ksp), and if it does — or if you add the solid in excess — the equilibrium: how much dissolves or precipitates and the final pH, with the basicity of the anion and the common ion taken into account; next to it the textbook formula, which ignores the pH (the CaCO₃ lesson). Every constant comes with the paper or critical compilation it was taken from.

Titration of what is in the beaker with a titrant from the burette: every equivalence point (volume and pH), the indicators ranked by titration error for each, and the curve. Polyprotic acids, mixtures and weak/weak included, computed exactly. Every constant comes with the paper or critical compilation it was taken from.

Read Unix permissions: takes octal ("755") or symbolic ("rwxr-xr-x") and returns both forms plus the breakdown (user/group/other, setuid/setgid/sticky).

Is this IP inside that CIDR network? Returns true/false.

Analyze an IPv4 network from CIDR or IP+mask: network and broadcast addresses, first/last host, mask and wildcard, host count, class, private/special ranges, binary form and reverse PTR name.

Split a base network into variable-length subnets (VLSM) sized to the host counts you ask for.

Split a text into claims and say, for each, whether it comes with a source and of what kind: peer-reviewed, preprint (arXiv and friends), registry/link, or self-published. Flags the ABSOLUTE claims with NO source at all, which is the expensive failure mode because they sound exactly as confident as the backed ones. It does NOT say whether something is true — it cannot — it says whether it is supported, which is a different thing. An arXiv DOI is still a preprint: registration is not review. Worth running on your own answer before you send it.

Convert a color between HEX, RGB and HSL. Accepts "#3498db", "rgb(52,152,219)", "hsl(...)" or CSS names.

Single-electron transistor: charging energy E_C, whether Coulomb blockade occurs, and why it does not when it fails. Checks BOTH conditions — E_C >> k_B*T and tunnel barriers above the resistance quantum R_K = h/e^2 ~ 25.8 kOhm. The second is almost never mentioned, and without it a design with perfect energy still does not blockade.

Count tokens with a model's real tokenizer: o200k_base (GPT-4o and later), cl100k_base (GPT-4/3.5), p50k_base, r50k_base; qwen3 (Qwen3/Qwen2.5 family) and mistral-v3 (Mistral 7B v0.3 and similar), run locally. Claude's tokenizer is not public: claude-estimate is o200k × a measured factor, an estimate. Returns tokens, words, characters and % of the context window.

Next run times of a 5-field cron expression, as ISO dates. "When does this actually fire?" is a calculation LLMs routinely get wrong.

Compare two CSV files by a KEY column, of ANY size: which rows are only in A, only in B, and which changed and in WHICH columns. Columns are matched by header name, so a re-exported file with reordered columns or rows is not "everything changed" (it is for a line diff). Both files are streamed from disk; only the keys of B are held in memory, so do not read them into your context — pass the paths. Quoted cells with commas or line breaks inside are handled (RFC 4180). Optionally writes the FULL difference, one row per changed cell (`estado,clave,columna,valor_a,valor_b`), to `outPath`.

Turn a DDL into Markdown documentation, DBML (dbdiagram.io) or a Mermaid erDiagram, with relations and their 1:1 / 1:N cardinality derived from the keys.

Turn a DDL into classes in your language: Java/JPA, TypeScript, Python (SQLAlchemy 2.0), C#/EF Core or Go. Types are respected — `numeric` becomes BigDecimal/decimal, never a double — and so is which fields are optional.

Propose the missing foreign keys: find by name and type the columns that look like they point at another table, then CHECK each one against the rows, counting how many of its values actually exist on the other side. The percentage is counted rows, not a hunch. At 100% the relation holds and the returned ALTER TABLE cannot fail; with orphan rows PostgreSQL would reject it, so how many and which ones are reported.

Find the foreign-key paths between two tables and return the SELECT with the JOINs already written. If the script carries data, every path is EXECUTED and they are ranked by the rows they actually return — a short path that yields zero rows joins nothing. Hub tables (related to almost everything) can be set aside, since they connect any pair without explaining anything.

Before proposing a PostgreSQL migration, MEASURE what each statement would lock, instead of guessing. Runs your schema (DDL + sample data) and then the migration in an ephemeral PostgreSQL (pglite, in memory) and reads, per statement: the strongest table lock actually taken (pg_locks), whether it rewrote the table, whether it scanned it in full, a risk level (lock mode × duration), and the safer rewrite when there is one — CREATE INDEX CONCURRENTLY, ADD CONSTRAINT … NOT VALID + VALIDATE, NOT NULL NOT VALID (PG 18), lock_timeout, new column + backfill instead of ALTER TYPE — with the SQL written out. Nothing touches a real database.

Run a SQL query against your schema in an ephemeral PostgreSQL (pglite, in memory) before you hand it over, instead of guessing whether a column exists: does it run, which columns it returns with their real PostgreSQL types, how many rows, a small sample — or Postgres's own error with its SQLSTATE and position. Runs inside a transaction that is rolled back, so an UPDATE or DELETE is safe to check. Give `compareWith` (e.g. a reference query, or the version before your rewrite) to check both return the same rows: they are also run on adversarial data (NULLs, duplicates, empty tables), and if they differ you get the smallest counter-example with its INSERT statements — the classic NOT IN with a NULL.

Run the script in an ephemeral PostgreSQL and review row-level security, warning about the SILENT failures: RLS on with no policies, policies with RLS off, the owner bypassing them because FORCE is missing, a superuser role, or the missing GRANT/USAGE that makes "zero rows" not the policy's fault at all. Given a role and a table it also SIMULATES: it looks at the table through that role's eyes, inside a transaction that is rolled back, and reports how many rows it can see, update and delete.

Run a DDL in an ephemeral PostgreSQL and return the REAL schema (tables, columns, keys, indexes, constraints) plus the design problems found: tables with no primary key, foreign keys with no index, money in floating point, timestamps without a time zone, types that do not match on the two sides of a relation, and redundant indexes. The schema is executed, not guessed with regular expressions.

Detect whether a SQL script comes from MySQL/MariaDB, SQLite, SQL Server or Oracle and translate it to PostgreSQL, explaining every change with its line number. Changes that are NOT exact equivalents are flagged as such.

Append the "nodes"/"edges"/"charts" of a JTD FRAGMENT (same format) to the diagram held in memory, on top of whatever is already there. Returns the new counts plus the warnings and errors of validating the result.

Return the COMPLETE JTD document built so far in memory, ready to save or paste into the web tool.

Start an EMPTY JTD diagram in memory, discarding any previous one. Lets you build it piece by piece with diagram_add and look at it with diagram_preview, instead of writing the whole JSON in one shot.

Validate and DRAW (SVG) the diagram held in memory, so you can look at it and keep adding or fixing in a loop. This is the generate → look → correct cycle; a model cannot judge a diagram by reading its JSON.