Jarroba Tools

A tight-binding chain of N atoms: the N levels it produces, the bandwidth, and the spacing between levels. Shows where a band COMES FROM — with 2 atoms the level splits in two (alpha +/- beta), and with many the spacing falls as 1/N until it drops below k_B*T, which is when talking about individual levels stops making sense.

Programmer's calculator on exact integers (BigInt): arithmetic (add/sub/mul/div/mod/pow) and bitwise (and/or/xor/nand/nor/xnor/shl/shr/sar/rol/ror). Returns the result in every base.

Energy curve between the two atoms of a measured diatomic molecule: bond length, well depth (De), REAL dissociation energy (D0) and zero-point energy. D0 is NOT De — the molecule is never at rest at the bottom of the well, not even at 0 K, and in H2 the difference is 0.27 eV. Covalent bonds use Morse, noble gases use Lennard-Jones.

Differentiate an expression symbolically, exactly: "x^3 + 2x", "sin(x)*cos(x)", "x^x". Keeps units, so d/dx (3 m * x) is "3 m" and not 3. Can take higher-order derivatives and evaluate the result at a point. Says which name it read as a unit, and refuses to answer "0" when the variable is not in the expression.

Evaluate a mathematical expression WITH UNITS and dimensional checking: "100 km/h to m/s", "5 km + 300 m", "70 kg to lbs", "det([[1,2],[3,4]])". Adding incompatible units is an error, not a silent number. Also flags results that are not finite (NaN, infinity).

Evaluate a multi-line calculation sheet and return the result of EVERY line. Variables carry downwards, units travel with the value, "#" starts a comment, "ans" is the previous result, and an error stays on its own line instead of killing the sheet. Declare currencies with "# @moneda USD = 1.08 EUR". Good for checking a quote or a budget line by line.

Solve an equation in one unknown ("x^2 - 5x + 6 = 0", "sin(x) = 0.5") or a linear system (one equation per line). Says whether the answer is EXACT or an approximation, and over which interval it searched. Never invents a root it did not find.

Show the WORKED STEPS of a calculation, verified step by step: a linear or quadratic equation, a derivative (naming which rule applies), or Gaussian elimination on a linear system row by row. Each step comes with the name of the rule used. When it cannot explain a case it says so (covered: false) instead of inventing a plausible-looking derivation — useful when you have to show your work to a person.

Check Cedar authorization policies (the language of AWS Verified Permissions) with the official Cedar engine, instead of reasoning about them: parse errors with their location; validation against your schema if you give one (wrong attribute, wrong entity type, impossible conditions), and of your entities against it; and, for each request, allow or deny with the policies that decided it — so you can tell a missing permit from a forbid that wins, and see a forbid that errored and so did not apply (fails open). Policies may carry @id("…") to name them in the answer.

Exact pH of a mixture of acids, bases and salts by charge and mass balance — no "x is negligible", no "only the first dissociation" — with the speciation of each weak system and the textbook formula next to it, with its validity rule and how wrong it is here. Every constant comes with the paper or critical compilation it was taken from. Ideal solution at 25 °C. Give listSubstances: true (and no components) to get what it knows.

Does a sparingly soluble salt precipitate in this solution (Q vs Ksp), and if it does — or if you add the solid in excess — the equilibrium: how much dissolves or precipitates and the final pH, with the basicity of the anion and the common ion taken into account; next to it the textbook formula, which ignores the pH (the CaCO₃ lesson). Every constant comes with the paper or critical compilation it was taken from.

Titration of what is in the beaker with a titrant from the burette: every equivalence point (volume and pH), the indicators ranked by titration error for each, and the curve. Polyprotic acids, mixtures and weak/weak included, computed exactly. Every constant comes with the paper or critical compilation it was taken from.

Read Unix permissions: takes octal ("755") or symbolic ("rwxr-xr-x") and returns both forms plus the breakdown (user/group/other, setuid/setgid/sticky).

Is this IP inside that CIDR network? Returns true/false.

Analyze an IPv4 network from CIDR or IP+mask: network and broadcast addresses, first/last host, mask and wildcard, host count, class, private/special ranges, binary form and reverse PTR name.

Split a base network into variable-length subnets (VLSM) sized to the host counts you ask for.

Split a text into claims and say, for each, whether it comes with a source and of what kind: peer-reviewed, preprint (arXiv and friends), registry/link, or self-published. Flags the ABSOLUTE claims with NO source at all, which is the expensive failure mode because they sound exactly as confident as the backed ones. It does NOT say whether something is true — it cannot — it says whether it is supported, which is a different thing. An arXiv DOI is still a preprint: registration is not review. Worth running on your own answer before you send it.

Convert a color between HEX, RGB and HSL. Accepts "#3498db", "rgb(52,152,219)", "hsl(...)" or CSS names.

Single-electron transistor: charging energy E_C, whether Coulomb blockade occurs, and why it does not when it fails. Checks BOTH conditions — E_C >> k_B*T and tunnel barriers above the resistance quantum R_K = h/e^2 ~ 25.8 kOhm. The second is almost never mentioned, and without it a design with perfect energy still does not blockade.

Count tokens with a model's real tokenizer: o200k_base (GPT-4o and later), cl100k_base (GPT-4/3.5), p50k_base, r50k_base; qwen3 (Qwen3/Qwen2.5 family) and mistral-v3 (Mistral 7B v0.3 and similar), run locally. Claude's tokenizer is not public: claude-estimate is o200k × a measured factor, an estimate. Returns tokens, words, characters and % of the context window.

Next run times of a 5-field cron expression, as ISO dates. "When does this actually fire?" is a calculation LLMs routinely get wrong.

Compare two CSV files by a KEY column, of ANY size: which rows are only in A, only in B, and which changed and in WHICH columns. Columns are matched by header name, so a re-exported file with reordered columns or rows is not "everything changed" (it is for a line diff). Both files are streamed from disk; only the keys of B are held in memory, so do not read them into your context — pass the paths. Quoted cells with commas or line breaks inside are handled (RFC 4180). Optionally writes the FULL difference, one row per changed cell (`estado,clave,columna,valor_a,valor_b`), to `outPath`.

Turn a DDL into Markdown documentation, DBML (dbdiagram.io) or a Mermaid erDiagram, with relations and their 1:1 / 1:N cardinality derived from the keys.

Turn a DDL into classes in your language: Java/JPA, TypeScript, Python (SQLAlchemy 2.0), C#/EF Core or Go. Types are respected — `numeric` becomes BigDecimal/decimal, never a double — and so is which fields are optional.

Propose the missing foreign keys: find by name and type the columns that look like they point at another table, then CHECK each one against the rows, counting how many of its values actually exist on the other side. The percentage is counted rows, not a hunch. At 100% the relation holds and the returned ALTER TABLE cannot fail; with orphan rows PostgreSQL would reject it, so how many and which ones are reported.

Find the foreign-key paths between two tables and return the SELECT with the JOINs already written. If the script carries data, every path is EXECUTED and they are ranked by the rows they actually return — a short path that yields zero rows joins nothing. Hub tables (related to almost everything) can be set aside, since they connect any pair without explaining anything.

Before proposing a PostgreSQL migration, MEASURE what each statement would lock, instead of guessing. Runs your schema (DDL + sample data) and then the migration in an ephemeral PostgreSQL (pglite, in memory) and reads, per statement: the strongest table lock actually taken (pg_locks), whether it rewrote the table, whether it scanned it in full, a risk level (lock mode × duration), and the safer rewrite when there is one — CREATE INDEX CONCURRENTLY, ADD CONSTRAINT … NOT VALID + VALIDATE, NOT NULL NOT VALID (PG 18), lock_timeout, new column + backfill instead of ALTER TYPE — with the SQL writte…

Run a SQL query against your schema in an ephemeral PostgreSQL (pglite, in memory) before you hand it over, instead of guessing whether a column exists: does it run, which columns it returns with their real PostgreSQL types, how many rows, a small sample — or Postgres's own error with its SQLSTATE and position. Runs inside a transaction that is rolled back, so an UPDATE or DELETE is safe to check. Give `compareWith` (e.g. a reference query, or the version before your rewrite) to check both return the same rows: they are also run on adversarial data (NULLs, duplicates, empty tables), and if the…

Run the script in an ephemeral PostgreSQL and review row-level security, warning about the SILENT failures: RLS on with no policies, policies with RLS off, the owner bypassing them because FORCE is missing, a superuser role, or the missing GRANT/USAGE that makes "zero rows" not the policy's fault at all. Given a role and a table it also SIMULATES: it looks at the table through that role's eyes, inside a transaction that is rolled back, and reports how many rows it can see, update and delete.

Run a DDL in an ephemeral PostgreSQL and return the REAL schema (tables, columns, keys, indexes, constraints) plus the design problems found: tables with no primary key, foreign keys with no index, money in floating point, timestamps without a time zone, types that do not match on the two sides of a relation, and redundant indexes. The schema is executed, not guessed with regular expressions.

Detect whether a SQL script comes from MySQL/MariaDB, SQLite, SQL Server or Oracle and translate it to PostgreSQL, explaining every change with its line number. Changes that are NOT exact equivalents are flagged as such.

Append the "nodes"/"edges"/"charts" of a JTD FRAGMENT (same format) to the diagram held in memory, on top of whatever is already there. Returns the new counts plus the warnings and errors of validating the result.

Return the COMPLETE JTD document built so far in memory, ready to save or paste into the web tool.

Start an EMPTY JTD diagram in memory, discarding any previous one. Lets you build it piece by piece with diagram_add and look at it with diagram_preview, instead of writing the whole JSON in one shot.

Validate and DRAW (SVG) the diagram held in memory, so you can look at it and keep adding or fixing in a loop. This is the generate → look → correct cycle; a model cannot judge a diagram by reading its JSON.

Render a JTD to PNG with the app's REAL engine (full fidelity; only needed to check skins and effects). Requires a checkout of the repo AND a running dev server. For everything else use diagram_svg, which needs neither.

Render a JTD to SVG with no browser and no dev server, so you get the actual drawing back and can check it. Validates first. This is the one to use to SEE what you built.

Validate a JTD (Jarroba Tools Diagram) document: structure, allowed shapes and chart types, and edge references. Returns {ok, errors, warnings, summary}. Spec: public/jtd.md. Use it to check your JSON before handing it to anyone.

Say which LAYERS of a Dockerfile would be rebuilt when given files change, and which come from cache. Dockerfile linters spot suspicious ordering patterns; this SIMULATES invalidation, which is a different thing: it needs to know which files exist and which changed. In Docker, when one layer is invalidated so is EVERY layer after it, so a `COPY . .` before the `RUN` that installs dependencies condemns you to reinstalling all of them every time you touch a line of code — and that shows up here as numbers. Respects the `.dockerignore`: what stays out of the context cannot invalidate anything.

The four DORA delivery metrics (plus rework rate) from data you already have locally, without sending it anywhere: deployment frequency, lead time for changes, change failure rate and time to restore, computed from the JSON of `gh run list --workflow deploy.yml --branch main --limit 1000 --json databaseId,workflowName,headSha,displayTitle,conclusion,status,updatedAt` (or a CSV with a date column), optionally with `git log --first-parent --format=%H%x09%cI%x09%s main` for lead time. Says why each deploy counts as failed, and classifies the team against every State of DevOps report 2019-2024 — s…

Electron configuration of a neutral element, full and noble-gas abbreviated, with its shells and valence. Flags whether the element is one of the 20 real ANOMALIES (Cr, Cu, Nb, Ru, Pd...) — exactly where the Madelung rule fails and a language model tends to get the rule right and the element wrong.

Data sheet for an element by atomic number or symbol: name, mass, category, group/period/block, electronegativity, radius, ionization energy and electron affinity. Data that does NOT exist comes back as null, never as 0 — a noble gas has no electron affinity, and that is not "zero".

Electron configuration of an ION. Electrons leave from the HIGHEST n shell, not from the last orbital that was filled: Fe2+ is [Ar]3d6, not [Ar]3d4 4s2. This is the classic mistake and the one seen most often in generated answers.

Check the authentication of an email and of a domain's mail records: paste the raw headers of a message (Authentication-Results, DKIM-Signature, From, Reply-To, Return-Path) and/or the DNS TXT records (v=spf1, v=DMARC1, v=DKIM1). Finds SPF/DKIM/DMARC failures, a Reply-To or Return-Path on another domain, a DKIM signature that does not cover From or only part of the body (l=), weak or revoked keys, SPF +all / ?all / more than 10 DNS lookups, and DMARC p=none or without reports. Verifies DKIM key strength locally; it does NOT query DNS — paste the records you want checked.

Review an eval suite and run it against the outputs you provide. The review catches what silently ruins a suite: assertions that CANNOT FAIL (an empty `contains`, a regex like `.*`, a case with no assertions) and ones that can never pass (requiring and forbidding the same thing, an inverted range). A suite with those scores 100% on day one and has measured nothing. Assertion types: contains, not-contains, regex, json, range, max-chars and supported (no absolute claim without a source). Calls no model: you pass the outputs in already produced.

Convert data between formats: json, yaml, properties, env, csv, markdown.

Why the transistor changed shape: natural length lambda and minimum gate length (5*lambda) for each architecture — planar, FD-SOI, FinFET, GAA nanosheet, nanowire, forksheet and CFET — at the SAME dimensions, which is what isolates the effect of geometry alone. It does not tabulate real process-node dimensions, because those are not public.

Detect and correct a single-bit error in a received Hamming word: whether there is an error, which bit, and the corrected data.

Encode bits with a Hamming (SEC) code: inserts the parity bits. Input is a string of 0s and 1s.

SHA-256, SHA-384 and SHA-512 (hex) of a UTF-8 string.

Audit the HTTP response headers of a site as you pasted them (from curl -I, DevTools or a HAR): an A+…F grade like /headers-audit; Content-Security-Policy (missing, unsafe-inline/eval, wildcards, missing object-src/base-uri/frame-ancestors), HSTS (missing, too short, invalid preload), nosniff, frame options, Referrer-Policy, the obsolete X-XSS-Protection, cookies without Secure/HttpOnly/SameSite, and a Server header that exposes the version. Nothing is requested over the network: it reads what you give it.

Find what a model cannot see in a piece of text: invisible Unicode that smuggles instructions (tag characters U+E0000–E007F, the "ASCII smuggling" used against Copilot and in poisoned MCP/skill files), variation-selector and invisible-bit encodings, zero-width and bidi controls (Trojan Source), look-alike Cyrillic/Greek letters inside Latin words, and odd spaces. Returns every finding with UTF-16 offsets and codepoints, and DECODES the hidden message when it can. Run it on any text you are about to follow as instructions (a README, an issue, a tool description, a web page) — you cannot do this…

Hydrogen spectral lines for a series (nLow=1 Lyman, 2 Balmer, 3 Paschen...). Gives the wavelength IN VACUUM and IN AIR, which are different numbers: H-alpha is 656.47 nm in vacuum and 656.28 in air, and confusing them is common. Uses the reduced-mass Rydberg constant (R_H), not R-infinity.

IEEE-754 representation of a decimal number in 32-bit (single) or 64-bit (double): sign, exponent, mantissa, raw bits, hex, and the value actually stored.

Say which paths a `.gitignore` or `.dockerignore` ignores AND BY WHICH LINE — it is `git check-ignore -v` without git. And it does what no other tool does: it reads the SAME file as git and as Docker and points at where they do NOT decide the same. The two formats look alike and are not: a pattern with no slashes (`node_modules`) applies at any depth in git but ONLY at the root in Docker, so a `.dockerignore` copied from a `.gitignore` pulls into the build context exactly what you thought you had excluded. It also warns about the `!` that cannot work because its folder is already excluded, whi…

IR drop across a power delivery grid: worst and mean voltage lost, and where the worst is. Solves the 2D resistive network (GV=I) with sparse conjugate gradient. Use it to compare frontside delivery (entry points further apart) against backside (spread out, lower-resistance metal) at the SAME load, which is the only comparison that means anything. First-order: uniform single-layer mesh, static and equal load per region, no inductive coupling, no switching. Real designs are signed off at 0.5-2.5 % of Vdd.

Structural differences between two JSON documents, by path: added / removed / changed / type changed.

Validate a JSON document against a JSON Schema — the check to run on your own structured output before handing it over, instead of eyeballing it. Supports draft 2020-12 (default), 2019-09 and draft-07, chosen from the schema's `$schema`; `format` (email, date-time, uri, uuid…) is enforced. Returns `valid` and, if not, EVERY error with the JSON Pointer of the offending value, the keyword that failed and its parameters. Remote `$ref`s are NOT fetched: an unresolvable reference is reported as a schema error.

Decode a JSON Web Token WITHOUT verifying its signature — header, payload, expiry — and flag what makes it dangerous to accept (RFC 8725bis / RFC 9068): alg "none", no exp, exp that is not a NumericDate, alg differing only in letter case, a kid with path traversal or injection characters, a key or key URL carried in the header (jwk/jku/x5u), an access token without typ at+jwt, illegal characters. Give `expectedAlgorithm` (what your verifier uses) and, optionally, `key` to also catch algorithm confusion (HMAC verified with a public key) and HMAC secrets shorter than the hash. The key is only in…

Will the cluster accept these Kubernetes manifests? Validates them against the OFFICIAL schema of the Kubernetes version you target (1.33–1.37; checked against kubeconform --strict): unknown fields with the one you probably meant (a typo in livenessProbe silently leaves the pod without a probe), wrong types ("80" where an integer goes), missing required fields, removed APIs with what to migrate to. And Pod Security Standards, ported from the official admission controller: the highest level each workload meets, what it violates (the controller's own check ids), and whether its namespace's pod-s…

Which pods can actually reach which, according to the Kubernetes NetworkPolicies in the manifests you paste (multi-document YAML: Pods/Deployments/StatefulSets…, Services, Namespaces, NetworkPolicies) — computed, not guessed, and checked against netpol-analyzer. Returns the pairs that CAN connect with their ports (everything else is blocked), plus findings: policies or peers that select no pods, the namespaceSelector/podSelector split-list trap, Services selecting no pods or exposing a missing targetPort, missing ConfigMap/Secret/ServiceAccount, unreachable pods, hostNetwork pods. Give `from` …

How a Kafka consumer group splits partitions among its members with the classic protocol (the default in Kafka 4.3): range, roundrobin, sticky or cooperative-sticky, ported from Kafka 4.3.1 and checked against its tests. Returns each member's partitions, idle members and the order the assignor walked them; for the sticky strategies give each member's owned partitions (and generation) to see what moves, and with cooperative-sticky which partitions are revoked this round and handed over in the next. Not covered: rack awareness and the server-side assignors of KIP-848; sticky only when all member…

The partition Kafka's default partitioner picks for a message key: murmur2 over the UTF-8 bytes, made positive, modulo the partition count — with the intermediate numbers so the result can be checked. Ported from Kafka 4.3.1 and checked against its murmur2 test vectors. Only for messages WITH a key (without one, Kafka uses the sticky partitioner, which is not deterministic).

Run a NAMED metric from the semantic layer against RDF data: fills its {{param}} placeholders from `args` and executes the resulting SPARQL. Use it so "revenue" or "active users" is computed from the AGREED definition instead of a query you invented — the fix for "one number, three answers". Returns the effective SPARQL and the result, or which parameters are missing.

Run SPARQL 1.1 (SELECT/ASK/CONSTRUCT/DESCRIBE) over in-memory RDF — a real engine, not pattern matching. Accepts Turtle, N-Triples, N-Quads, TriG, JSON-LD or RDF/XML. Returns rows (SELECT), a boolean (ASK) or Turtle (CONSTRUCT/DESCRIBE).

Validate a SEMANTIC LAYER document (term→predicate glossary + named SPARQL metrics) before trusting it: structure, required fields (term/target, name/sparql), metric names usable as identifiers, and uniqueness. Returns {ok, errors, warnings}. This is "semantics as code": define once, compute the same everywhere.

Validate RDF data against its SHACL shapes (core subset): sh:targetClass + sh:path with minCount, maxCount, datatype, class and nodeKind. Returns whether it conforms plus every violation (node, property, constraint, message).

Understand a log without reading it: detected format, number of EVENTS (a 40-line stack trace counts as one), breakdown by level, time range, the errors with their ROOT CAUSE resolved, and the most frequent patterns. Accepts a file PATH — that is how you look at a log that does not fit in your context, such as a CI log of hundreds of MB. Logs WRAPPED by whatever collected them (Docker json-file, CRI/Kubernetes `P`/`F` lines, `journalctl -o json`, OpenTelemetry OTLP JSON, AWS CloudTrail) are unwrapped first and the pieces the runtime split are joined back, so a stack trace spread over 40 record…

What ELSE happened around a moment in time. Given an instant — the spike log_trends returned, or the time of an alert — find the patterns that cluster there and do not appear the same way in the rest of the log. Correlation is NOT causation, and what settles it is order: what started BEFORE comes first and is a candidate explanation; what came after is usually a consequence. Background noise is filtered out even when a narrow window lands on one of its bursts.

Convert a log from one format to another through OpenTelemetry's Logs Data Model: JSON, logfmt, syslog RFC 5424, CSV, OpenTelemetry or Elastic Common Schema. Tells you UP FRONT what the conversion loses — syslog only has eight severities and a text body, so coming down to it from JSON drops fields.

What sets a group of events APART from the rest of the log: the field=value pairs over-represented in the selection. E.g. of 300 errors, 92% have `version=2.4.1` against 4% of everything else — the deploy that broke it, found without reading 300 errors. Select by minimum level (default: errors), by text, or by one field=value; that selector is left out of the answer, since it would trivially top it. Fields that are unique per event (request ids, trace ids) are skipped: they identify, they do not distinguish. A difference in proportions, not causation.

Check whether the log is WELL WRITTEN — not what happened in the system: secrets or personal data printed, one line flooding the file, timestamps with no time zone (which make two machines impossible to correlate), the clock going backwards, everything at the same level, no request id, payload dumps, and orphan stack traces with no error line. Every finding comes with its count and a sample; secrets are masked.

Group log lines into TEMPLATES (Drain algorithm): "connected to 10.0.0.1" and "connected to 10.0.0.7" are the same message. Turns a million lines into a few hundred readable things, each with its count, worst level and time range. Also returns the RARE ones (seen once or twice), which in a production log are usually what you were looking for.

Validate a Jarroba Tools LOG PROFILE (the `logprofile: 1` JSON that configures the log tools: format, server time zone, own-code prefixes, rules and AI budget). Returns ALL errors at once, each with the exact field (`rules[2].pattern`) and what was expected, so you can fix them in one pass instead of one at a time. Format documented in `public/logprofile.md`.

Propose a LOG PROFILE from a real log: infers the format, the own-code prefix (read from the stack traces, which is where it is demonstrated) and a starting set of rules covering the most frequent errors and whatever floods the file. What it does NOT propose is the server time zone: that is not in the log, and inventing it shifts the entire timeline without anyone noticing. Accepts a file path.

Cut a log down to a CHARACTER budget while keeping what matters: errors with their full stack trace, the window of what happened just before, and anything that appears only once or twice. Repeats are collapsed with their count ([xN]) and gaps are marked ([...N]). Use it to hand a big log to a model without spending the context on the same line repeated.

Put a folder or a list of rotated logs into TIME ORDER, split into series. Rotation numbering runs BACKWARDS against time: `app.log.3.gz` is older than `app.log.1.gz`, and plain `app.log` is the newest; alphabetically `app.log.10` sorts before `app.log.9` while in time it comes after. Use this BEFORE reading several logs of one service, or you will read them backwards. Returns the paths already ordered, ready to feed to log_analyze one by one.

Read an exception stack trace (Java/JVM, Python, Node, Go, .NET, Rust, Ruby or PHP) and answer the only question anyone asks it: WHERE TO LOOK. Follows the "Caused by" chain to the root cause, separates your code from the framework, and points at your first frame. Infers which package is yours from the trace itself if you do not say.

Answer WHEN IT STARTED, which is what a log is really asked. Compares each pattern against ITSELF rather than against total volume — in a busy service everything rises at 9am and nothing has happened — and returns three different things: what SPIKED relative to its own normal and at what time; what is NEW, which did not exist before and is usually what a deploy left behind; and what STOPPED APPEARING, which raises no counter and is often the worse news.

Generate a ready-to-use Makefile for a stack (node, python, go, rust, c, maven, gradle or generic). What it generates PASSES its own linter with zero findings: it always ships `.DELETE_ON_ERROR`, `SHELL := /bin/bash` with `.SHELLFLAGS := -eu -o pipefail -c`, and declared `.PHONY` targets — the three lines that are almost never there and that prevent the most expensive failures. With `withLogs`, targets record their output through `tee`, redirect stderr, timestamp the file name, and take the log directory as an order-only prerequisite.

Review a Makefile and return the mistakes that actually bite, each with WHAT is wrong, HOW it breaks in practice and HOW to fix it: a recipe indented with spaces instead of a tab, a `cd` that does not persist to the next line, a `$` that make eats before the shell sees it, `$(shell ...)` inside a `=` variable (re-executed on every use), a pipeline without `pipefail`, a missing `.PHONY`, and a missing `.DELETE_ON_ERROR`. Calibrated NOT to complain about correct code: a well-written Makefile comes back with zero findings.

Compare the output of a REAL `make` run with what the simulation predicted, matching each command in the log to the Makefile rule that produced it. **What makes this useful, rather than any log analyzer, is the diff:** if make rebuilt something the simulation considered cached, that is the signature of an UNDECLARED DEPENDENCY — it raises no error, it just makes the build slower than it should be, or occasionally fails to rebuild what it should. Line-to-rule matching is APPROXIMATE and each match carries its confidence: recipes are echoed after variable expansion, a leading `@` suppresses them…

Answer the question that decides whether `make` is giving you anything: is this Makefile a BUILD, or a script LAUNCHER? make exists in order NOT to redo what is already done — mtimes, a dependency graph, skipping what did not change — and most Makefiles today use none of it: they are `make test`, `make lint`, `make docker-up`, all .PHONY, all running every time. Here each target is classified WITH THE SIGNAL that decided it (including the signals that pointed the other way: a .PHONY whose recipe creates that very file is a bug waiting to happen), what make is giving you TODAY is measured, and …

Simulate `make` WITHOUT RUNNING ANYTHING: which targets would be rebuilt, in what order, and WHY, naming the file to blame. Answers the two questions no other tool answers: "why is it rebuilding this when I changed nothing?" and "why is it NOT rebuilding it?". With `project` it reads the Makefile and the REAL mtimes from disk; `touch` asks "what if I changed this file?" without changing it. The reasons use the same vocabulary as the Linux kernel's `make V=2`.

Paste the `tools/list` response of an MCP server — yours, or a third party's you are evaluating whether to install — and check its catalogue quality: missing descriptions or annotations, a tool name that suggests it writes or deletes while its annotations say otherwise, context cost per tool (real BPE tokenization), and whether the top-level `instructions` field is set and fits under the ~2 KB some Tool Search clients trim. Add `serverJson`/`packageJson` to also catch the official MCP registry's own field-length and namespace-pattern limits, and a version mismatch between the two — the exact 4…

Check that Mermaid code actually parses, with Mermaid's own parser (the same version the Jarroba Tools web uses), before you hand it to someone to render. Returns the detected diagram type, or the parser error with its line, column and the tokens it expected — feed that back and fix the diagram, instead of guessing. Catches what models typically get wrong: unquoted labels with parentheses, `end` used as a node id, full-width punctuation, a `%` inside a pie value, an unknown diagram keyword. Covers every diagram type Mermaid knows (flowchart, sequence, class, state, ER, gantt, pie, mindmap, git…

Show an integer in binary, octal, decimal and hex, plus its bit view (signed/unsigned, popcount, leading/trailing zeros) at the chosen width. Accepts decimal, 0x…, 0b…, 0o…

Audit an OAuth 2.0 / OpenID Connect setup against RFC 9700 (OAuth 2.0 Security BCP), RFC 8414 and OIDC Discovery. Give an `authorizeUrl` (the /authorize request your app sends) to check PKCE present and S256, state and its entropy, nonce, PAR, redirect_uri over TLS / loopback / wildcards / fragments, secrets in the URL and scope breadth; and/or a `discoveryDocument` (the openid-configuration or oauth-authorization-server JSON, pasted — nothing is fetched) to check issuer, required fields, HTTPS endpoints, RS256, id_token alg "none", implicit and password grants, PKCE advertised (and "plain"), …

Before pasting a log, a HAR file or any text into a ticket, chat or prompt: find the secrets and personal data in it (API keys, JWTs, session cookies, Authorization headers, passwords, cards, emails…). A HAR is read entry by entry, so each finding says in which request, header, cookie, query parameter or body it sits — the way the 2023 Okta support breach happened, through a HAR with live session tokens. Returns a short preview per finding (never the full secret) and `redacted`: the same content with every finding replaced, ready to paste.

Before recommending a practice you learned in training, check whether it still holds: a curated, dated register of development and AI practices (still valid, superseded by what, anti-pattern, unnecessary since, or depends on the case), each with its evidence and how sure it is. Give `since` (your knowledge cutoff) to get only what changed after it. If the register has no entry, it says so instead of guessing — no entry means not reviewed, not "fine".

Check a system prompt against the rules that make it followable: an explicit output contract, a definition of done, what to do when the model does not know (the rule that prevents made-up answers), contradictions, unverifiable requirements, prohibitions with no alternative, example count and context budget. It does NOT judge whether the prompt is GOOD — that needs evals and a real model run — it is the deterministic layer underneath. Useful on your own system prompt.

M/M/c queue: with N resources, how many people wait, how long, and what fraction leaves without a place. With `waitingRoom` the model becomes M/M/c/K (finite waiting area — the realistic case); without it the queue is infinite. Output times are in MINUTES. Erlang and M/M/c are exactly the kind of arithmetic a model does "from memory" and gets wrong.

Pure LOSS system (Erlang B): there is no waiting area, so whoever finds no free resource leaves. Car parks, workshop bays, phone lines, critical-care beds.

Simulate the queue customer by customer (discrete events, fixed seed, so the result is reproducible). Its job is to CROSS-CHECK the analytic answer: if the simulation and the formula disagree, one of them is wrong.

How many resources do you need? Returns the MINIMUM that meets your target (max wait, max turned away, or max utilization) and how the system behaves at that number. This is the question asked before building a place, not after.

Which queues a RabbitMQ exchange delivers a message to, and why each binding matches or not: direct, topic (* and # words), fanout and headers (x-match all/any/all-with-x/any-with-x). Ported from RabbitMQ and calibrated against real 4.0.5 and 4.3.6 brokers (thousands of seeded cases, all equal). Unroutable means the message is dropped (or returned with mandatory). One difference: in headers, 1 and 1.0 are different values in RabbitMQ and equal here.

Split a text on real boundaries (paragraph, else sentence, never mid-word) with the overlap you ask for, and optionally rank the chunks against a query with BM25. Use it to prepare a RAG corpus, or to see why a query fails to retrieve what it should. No model involved: this is the lexical half, the one that finds literal terms — a code, a surname, a version number — that an embedding dissolves.

Check a regex for catastrophic backtracking (ReDoS) WITHOUT running it on any text: static analysis with recheck, the same engine the Jarroba Tools /regex page uses. Says whether the pattern is safe, exponential or polynomial (with its degree), which part of the pattern is to blame, and an attack string that triggers it. For the two shapes people type by accident — nested quantifiers like (a+)+ and (\w+\s?)+ — it proposes a rewrite, re-analyses it, and only offers it if it is actually better, saying what it becomes. Use it right after writing a regex that will run on untrusted input.

Test a regex against a string: whether it matches, every match and its capture groups. Exact matching, not guessed.

Audit a SAML message: paste it as raw XML, as the base64 of an HTTP-POST binding, or as the deflated+base64 SAMLRequest/SAMLResponse of a Redirect binding (a whole URL works). Finds a missing signature, weak signature or digest algorithms (SHA-1), duplicate IDs and a signature that references a different element than the one being read (signature wrapping), no NotOnOrAfter, expired, no AudienceRestriction, no InResponseTo, unencrypted assertions, a non-success status and secrets in attributes. Returns issuer, NameID and attributes too. It does NOT verify the signature cryptographically against…

Carrier concentrations in a doped semiconductor at a given temperature: n, p, band gap (Varshni), intrinsic concentration and Fermi level. The minority carrier is computed as ni^2/majority to avoid the catastrophic cancellation that destroys precision when subtracting nearly equal dopings.

Parse a SemVer version (major.minor.patch + pre-release + build metadata).

Given a list of versions, which ones satisfy a SemVer range (^, ~, >=, <, x, …).

Does an AWS SNS subscription filter policy let this message through, and which key decided it: exact values, prefix, suffix, equals-ignore-case, wildcard, cidr, numeric ranges, anything-but, exists and $or, on MessageAttributes or on the JSON body (FilterPolicyScope=MessageBody). Also rejects what SNS would reject: more than 5 keys, more than 150 combinations, a policy over 256 KB. Built from the AWS documentation; there is no emulator to calibrate it against, and the answer says so.

Audit a spreadsheet file (.xlsx, .xlsm, .ods, .xls) by RECALCULATING every formula and comparing it with the value saved in the file: cells whose saved value no longer matches its formula (stale or hand-overwritten results), real circular references, functions the recalculation engine does not support, and formula errors. Returns only the problem cells, each with sheet, address, formula, saved and recalculated value; healthy formulas are just counted. Reads the file from disk: pass its path.

Static noise margin (SNM) of a 6T SRAM cell by the butterfly method: two cross-coupled transfer curves and the side of the largest inscribed square. Returns the margin per mode (hold/read/write), the per-lobe split (which side would flip) and, optionally, the margin expressed in sigmas and the array failure probability. NOT the diagonal shortcut, which returns twice the correct value. First-order Shichman-Hodges: no body effect, no process variation, no parasitics — it shows why the margin moves, it is not a silicon signature.

SRAM read timing from dV = I*t/C: bit-line capacitance, signal needed, and how long before a 1 can be told from a 0. The signal needed is the amplifier sensitivity PLUS several sigmas of its offset, which usually dominates. Also returns the time for 1/2/4/8 banks. First-order: constant cell current, capacitance linear in cell count, no line resistance or column coupling. The reads-per-second figure is signal development only — a real read adds precharge, decoding and amplification.

Standard-cell geometry from its height in TRACKS: height, area, tracks left free for routing, fins per transistor, density and power-rail resistance — plus what you gain and lose against another height. The rail resistance it returns is what ir_drop consumes. Warns when the height does not land on the routing grid, which misaligns pins when alternate rows are flipped to share a rail. Idealised geometry: no real design rules, no vias, no parasitic extraction.

Escape a string for a target context: javascript, json, sql, regex, html, url or css.

Unescape a string from a context (javascript, json, sql, regex, html, url, css).

Audit a test file and say, case by case, what it ACTUALLY checks: which ones assert about a value, which only check that something exists, which assert nothing at all, and which are disabled. Returns the EVIDENCE behind each verdict (the assertions it found) so you can check the checker. TypeScript, JavaScript, Python, Java and Go. Executes nothing. Run it on the tests you just wrote, BEFORE you hand them over: told to "make the tests pass", widening a matcher is cheaper than fixing the bug, and this is what notices.

From a TYPE to the cases worth testing, with no model involved: equivalence partitions and boundary values derived from a TypeScript signature or a JSON Schema. For each parameter it returns the TECHNIQUE that applies and why — boundary values only mean something where there is an ordering, so they are NOT applied to a boolean or an enum. It adds the properties that can be asserted without knowing the domain, plus a fast-check test ready to paste. Use it BEFORE writing the tests, so you do not miss the cases everyone misses.

A project's DISABLED-test debt, WITH ITS AGE. Walks the folder, finds every `it.skip`, `xit`, `@Ignore`, `@pytest.mark.skip` or `t.Skip`, and dates it with `git blame`. None of those cases appears in a coverage report, because as far as the runner is concerned they do not exist: this is the debt nobody measures and the one that lasts longest — disabled 'to fix later', and later never comes. Sorted oldest first, which is what makes it actionable.

Compare TWO versions of the same test file and say whether the change STRENGTHENED or WEAKENED the safety net: widened matchers (toBe -> toContain -> toBeGreaterThan), assertions that disappeared, and cases that stopped running. Call it on your own work after touching tests, and above all after fixing a red suite: reaching green by softening an assertion is cheaper than fixing the bug, and this is what catches it. Executes nothing.

Try to decode a string from URL-encoding, Base64 and HTML entities.

Encode a string to URL-encoding, Base64 and HTML-escape (all three at once).

Convert an instant between formats: Unix (s/ms), ISO 8601, human, log, and per-locale/timezone. Accepts a Unix number or a date string.

Synchronous path analysis: setup and hold slack, and maximum frequency. The clock period appears ONLY in the setup check, so a setup failure is fixed by lowering the frequency and a hold failure is not — no speed makes it work. Skew enters both with opposite signs. With irDropV+vdd+vth it also derates the logic by voltage (alpha-power law), connecting power delivery to the clock. First-order: ONE path, delays as numbers, no process variation, no jitter, no temperature derating.

Unicode details for every character in a string: code point (U+…), name/category, UTF-8/16 bytes, HTML entity, escapes.

Convert data sizes between SI multiples (kB/MB, base 1000) and IEC multiples (KiB/MiB, base 1024), and between bits and bytes. Settles the usual KB-vs-KiB confusion.

Break a URL into protocol, host, port, path, query (parsed) and fragment.

WCAG contrast ratio between two colors, and whether it passes AA/AAA for normal and large text. Accepts #rgb/#rrggbb, rgb(), hsl() or CSS names.