Jarroba Tools

What `mvn <command>` would actually run in THIS project, without running Maven: module by module (reactor order with -pl/-am/-amd), phase by phase, goal by goal, and WHERE each goal comes from — the packaging default binding, your pom (with line), the parent (e.g. spring-boot:repackage comes from spring-boot-starter-parent), or a profile. Also: what is declared but never runs and why, which profiles are active and why, what changes between Maven 3.10 and 4.0, and a pom review (duplicates that fail the build since 3.10, plugins without a version). Verified goal by goal against real `mvn` logs (Maven 3.10.0 and 4.0.0-rc-7) on 11 real cases. Unknown parents or plugins are reported, never guessed.

Paste the `tools/list` response of an MCP server — yours, or a third party's you are evaluating whether to install — and check its catalogue quality: missing descriptions or annotations, a tool name that suggests it writes or deletes while its annotations say otherwise, context cost per tool (real BPE tokenization), and whether the top-level `instructions` field is set and fits under the ~2 KB some Tool Search clients trim. Add `serverJson`/`packageJson` to also catch the official MCP registry's own field-length and namespace-pattern limits, and a version mismatch between the two — the exact 422/403/400 errors this project hit publishing its own packages. This is NOT an access-security review: it does not evaluate what the tools are permitted to do, only how the catalogue is described. Add `approvedToolsListJson` (the tools/list you reviewed and approved earlier) to catch a "rug pull": tools added or removed since, descriptions that changed or gained poisoning signals, new parameters, and annotations that became less cautious.

Check that Mermaid code actually parses, with Mermaid's own parser (the same version the Jarroba Tools web uses), before you hand it to someone to render. Returns the detected diagram type, or the parser error with its line, column and the tokens it expected — feed that back and fix the diagram, instead of guessing. Catches what models typically get wrong: unquoted labels with parentheses, `end` used as a node id, full-width punctuation, a `%` inside a pie value, an unknown diagram keyword. Covers every diagram type Mermaid knows (flowchart, sequence, class, state, ER, gantt, pie, mindmap, gitGraph, C4, architecture…). It parses only; it does not render.

Show an integer in binary, octal, decimal and hex, plus its bit view (signed/unsigned, popcount, leading/trailing zeros) at the chosen width. Accepts decimal, 0x…, 0b…, 0o…

Audit an OAuth 2.0 / OpenID Connect setup against RFC 9700 (OAuth 2.0 Security BCP), RFC 8414 and OIDC Discovery. Give an `authorizeUrl` (the /authorize request your app sends) to check PKCE present and S256, state and its entropy, nonce, PAR, redirect_uri over TLS / loopback / wildcards / fragments, secrets in the URL and scope breadth; and/or a `discoveryDocument` (the openid-configuration or oauth-authorization-server JSON, pasted — nothing is fetched) to check issuer, required fields, HTTPS endpoints, RS256, id_token alg "none", implicit and password grants, PKCE advertised (and "plain"), iss in responses, sender-constrained tokens and PAR. Each failed check carries its severity (must/should) and the RFC section.

Before pasting a log, a HAR file or any text into a ticket, chat or prompt: find the secrets and personal data in it (API keys, JWTs, session cookies, Authorization headers, passwords, cards, emails…). A HAR is read entry by entry, so each finding says in which request, header, cookie, query parameter or body it sits — the way the 2023 Okta support breach happened, through a HAR with live session tokens. Returns a short preview per finding (never the full secret) and `redacted`: the same content with every finding replaced, ready to paste.

Compute the regulatory base (base reguladora) of a Spanish contributory retirement pension (General Scheme) from the monthly contribution bases, the way the law does it and models usually get wrong: BOTH systems while they coexist (the new one with its 2026-2036 calendar and the previous 300-month one, the higher wins), gaps filled with the minimum base (48 months at 100 %, then 50 %; improved for women under DT 41.ª), the older bases updated with the INE CPI, and the best months chosen. With the days contributed it also gives the percentage and the monthly pension. Each warning says what was assumed. It explains how the number is made; the official simulator of the Social Security has the full record.

Before recommending a practice you learned in training, check whether it still holds: a curated, dated register of development and AI practices (still valid, superseded by what, anti-pattern, unnecessary since, or depends on the case), each with its evidence and how sure it is. Give `since` (your knowledge cutoff) to get only what changed after it. If the register has no entry, it says so instead of guessing — no entry means not reviewed, not "fine".

Check a prompt against the rules that make it followable, in English or Spanish. kind "system" (an app's system prompt): explicit output contract, definition of done, what to do when the model does not know (the rule that prevents made-up answers), contradictions, vague or unverifiable requirements, prohibitions with no alternative, examples and context budget. kind "task" (a brief for an agent: "fix X in file Y"): deliverable, where to look, how to verify the result, what not to touch, definition of done. Both also flag an expert persona used to buy accuracy and shouting in capitals. Each finding says what to fix and, when a dated practice backs it, its id for practice_check. It does NOT judge whether the prompt is GOOD — that needs evals and a real model run — it is the deterministic layer underneath. Useful on prompts you write yourself.

M/M/c queue: with N resources, how many people wait, how long, and what fraction leaves without a place. With `waitingRoom` the model becomes M/M/c/K (finite waiting area — the realistic case); without it the queue is infinite. Output times are in MINUTES. Erlang and M/M/c are exactly the kind of arithmetic a model does "from memory" and gets wrong.

Pure LOSS system (Erlang B): there is no waiting area, so whoever finds no free resource leaves. Car parks, workshop bays, phone lines, critical-care beds.

Simulate the queue customer by customer (discrete events, fixed seed, so the result is reproducible). Its job is to CROSS-CHECK the analytic answer: if the simulation and the formula disagree, one of them is wrong.

How many resources do you need? Returns the MINIMUM that meets your target (max wait, max turned away, or max utilization) and how the system behaves at that number. This is the question asked before building a place, not after.

Which queues a RabbitMQ exchange delivers a message to, and why each binding matches or not: direct, topic (* and # words), fanout and headers (x-match all/any/all-with-x/any-with-x). Ported from RabbitMQ and calibrated against real 4.0.5 and 4.3.6 brokers (thousands of seeded cases, all equal). Unroutable means the message is dropped (or returned with mandatory). One difference: in headers, 1 and 1.0 are different values in RabbitMQ and equal here.

Split a text on real boundaries (paragraph, else sentence, never mid-word) with the overlap you ask for, and optionally rank the chunks against a query with BM25. Use it to prepare a RAG corpus, or to see why a query fails to retrieve what it should. No model involved: this is the lexical half, the one that finds literal terms — a code, a surname, a version number — that an embedding dissolves.

Check a regex for catastrophic backtracking (ReDoS) WITHOUT running it on any text: static analysis with recheck, the same engine the Jarroba Tools /regex page uses. Says whether the pattern is safe, exponential or polynomial (with its degree), which part of the pattern is to blame, and an attack string that triggers it. For the two shapes people type by accident — nested quantifiers like (a+)+ and (\w+\s?)+ — it proposes a rewrite, re-analyses it, and only offers it if it is actually better, saying what it becomes. Use it right after writing a regex that will run on untrusted input.

Test a regex against a string: whether it matches, every match and its capture groups. Exact matching, not guessed.

Audit a SAML message: paste it as raw XML, as the base64 of an HTTP-POST binding, or as the deflated+base64 SAMLRequest/SAMLResponse of a Redirect binding (a whole URL works). Finds a missing signature, weak signature or digest algorithms (SHA-1), duplicate IDs and a signature that references a different element than the one being read (signature wrapping), no NotOnOrAfter, expired, no AudienceRestriction, no InResponseTo, unencrypted assertions, a non-success status and secrets in attributes. Returns issuer, NameID and attributes too. It does NOT verify the signature cryptographically against a certificate.

Carrier concentrations in a doped semiconductor at a given temperature: n, p, band gap (Varshni), intrinsic concentration and Fermi level. The minority carrier is computed as ni^2/majority to avoid the catastrophic cancellation that destroys precision when subtracting nearly equal dopings.

Parse a SemVer version (major.minor.patch + pre-release + build metadata).

Given a list of versions, which ones satisfy a SemVer range (^, ~, >=, <, x, …).

Does an AWS SNS subscription filter policy let this message through, and which key decided it: exact values, prefix, suffix, equals-ignore-case, wildcard, cidr, numeric ranges, anything-but, exists and $or, on MessageAttributes or on the JSON body (FilterPolicyScope=MessageBody). Also rejects what SNS would reject: more than 5 keys, more than 150 combinations, a policy over 256 KB. Built from the AWS documentation; there is no emulator to calibrate it against, and the answer says so.

Audit a spreadsheet file (.xlsx, .xlsm, .ods, .xls) by RECALCULATING every formula and comparing it with the value saved in the file: cells whose saved value no longer matches its formula (stale or hand-overwritten results), real circular references, functions the recalculation engine does not support, and formula errors. Returns only the problem cells, each with sheet, address, formula, saved and recalculated value; healthy formulas are just counted. Reads the file from disk: pass its path.

Static noise margin (SNM) of a 6T SRAM cell by the butterfly method: two cross-coupled transfer curves and the side of the largest inscribed square. Returns the margin per mode (hold/read/write), the per-lobe split (which side would flip) and, optionally, the margin expressed in sigmas and the array failure probability. NOT the diagonal shortcut, which returns twice the correct value. First-order Shichman-Hodges: no body effect, no process variation, no parasitics — it shows why the margin moves, it is not a silicon signature.

SRAM read timing from dV = I*t/C: bit-line capacitance, signal needed, and how long before a 1 can be told from a 0. The signal needed is the amplifier sensitivity PLUS several sigmas of its offset, which usually dominates. Also returns the time for 1/2/4/8 banks. First-order: constant cell current, capacitance linear in cell count, no line resistance or column coupling. The reads-per-second figure is signal development only — a real read adds precharge, decoding and amplification.

Standard-cell geometry from its height in TRACKS: height, area, tracks left free for routing, fins per transistor, density and power-rail resistance — plus what you gain and lose against another height. The rail resistance it returns is what ir_drop consumes. Warns when the height does not land on the routing grid, which misaligns pins when alternate rows are flipped to share a rail. Idealised geometry: no real design rules, no vias, no parasitic extraction.

Escape a string for a target context: javascript, json, sql, regex, html, url or css.

Unescape a string from a context (javascript, json, sql, regex, html, url, css).

Audit a test file and say, case by case, what it ACTUALLY checks: which ones assert about a value, which only check that something exists, which assert nothing at all, and which are disabled. Returns the EVIDENCE behind each verdict (the assertions it found) so you can check the checker. TypeScript, JavaScript, Python, Java and Go. Executes nothing. Run it on the tests you just wrote, BEFORE you hand them over: told to "make the tests pass", widening a matcher is cheaper than fixing the bug, and this is what notices.

From a TYPE to the cases worth testing, with no model involved: equivalence partitions and boundary values derived from a TypeScript signature or a JSON Schema. For each parameter it returns the TECHNIQUE that applies and why — boundary values only mean something where there is an ordering, so they are NOT applied to a boolean or an enum. It adds the properties that can be asserted without knowing the domain, plus a fast-check test ready to paste. Use it BEFORE writing the tests, so you do not miss the cases everyone misses.

A project's DISABLED-test debt, WITH ITS AGE. Walks the folder, finds every `it.skip`, `xit`, `@Ignore`, `@pytest.mark.skip` or `t.Skip`, and dates it with `git blame`. None of those cases appears in a coverage report, because as far as the runner is concerned they do not exist: this is the debt nobody measures and the one that lasts longest — disabled 'to fix later', and later never comes. Sorted oldest first, which is what makes it actionable.

Compare TWO versions of the same test file and say whether the change STRENGTHENED or WEAKENED the safety net: widened matchers (toBe -> toContain -> toBeGreaterThan), assertions that disappeared, and cases that stopped running. Call it on your own work after touching tests, and above all after fixing a red suite: reaching green by softening an assertion is cheaper than fixing the bug, and this is what catches it. Executes nothing.

Try to decode a string from URL-encoding, Base64 and HTML entities.

Encode a string to URL-encoding, Base64 and HTML-escape (all three at once).

Convert an instant between formats: Unix (s/ms), ISO 8601, human, log, and per-locale/timezone. Accepts a Unix number or a date string.

Synchronous path analysis: setup and hold slack, and maximum frequency. The clock period appears ONLY in the setup check, so a setup failure is fixed by lowering the frequency and a hold failure is not — no speed makes it work. Skew enters both with opposite signs. With irDropV+vdd+vth it also derates the logic by voltage (alpha-power law), connecting power delivery to the clock. First-order: ONE path, delays as numbers, no process variation, no jitter, no temperature derating.

Unicode details for every character in a string: code point (U+…), name/category, UTF-8/16 bytes, HTML entity, escapes.

Convert data sizes between SI multiples (kB/MB, base 1000) and IEC multiples (KiB/MiB, base 1024), and between bits and bytes. Settles the usual KB-vs-KiB confusion.

Break a URL into protocol, host, port, path, query (parsed) and fragment.

WCAG contrast ratio between two colors, and whether it passes AA/AAA for normal and large text. Accepts #rgb/#rrggbb, rgb(), hsl() or CSS names.