"author:tylerscomic-lab" matching MCP servers:

Enables users to statically analyze regular expressions for catastrophic-backtracking (ReDoS) risk through real AST parsing rather than executing the pattern, flagging nested quantifiers, ambiguous alternation, and backreferences. It also generates candidate proof-of-concept attack strings with a timeout-guarded test snippet and suggests JavaScript-safe rewrites.

Enables statistical validation of whether a trading backtest’s edge is real using bootstrap-resampling and reshuffling Monte Carlo methods, including confidence intervals, drawdown-path percentiles, expected value calculations, and prop-firm challenge pass-probability simulation. It also compares multiple win-rate/risk-reward geometries by simulated pass rate.

Enables users to audit Dockerfiles for container-security anti-patterns, including missing USER, baked-in secrets, curl | sh / wget | bash, unpinned base images, and ADD with remote URLs. It parses Dockerfile structure to return risk levels and actionable fixes.

Enables users to scan AI agent skills and configuration files for hidden Unicode instructions, prompt injection, download-and-execute payloads, exfiltration patterns, and overly broad permissions before installation. It provides static audit tools for skill files, agent configs, and revealing hidden text without executing or fetching the input.

Enables scanning arbitrary text and added lines in unified git diffs for accidentally committed credentials, using precise vendor-format matches and entropy-based detection. All detected secrets are redacted before results are returned, helping coding agents and developers catch leaks without exposing full values.

Enables users to generate Pine Script v6 strategy code from plain-language descriptions, with built-in consideration for prop-firm evaluation constraints such as position sizing, session filters, and drawdown-aware exits.

Enables quant traders and researchers to test whether a strategy's edge is genuine or an artifact of testing many variants, via Probability of Backtest Overfitting, Deflated Sharpe Ratio, Minimum Backtest Length, and purged/embargoed cross-validation splits.

Enables static auditing of Pine Script v6 strategies to catch backtest-vs-live divergence traps before deployment, returning specific lines and plain-English explanations. It identifies fill-timing, ATR-smoothing, lookahead bias, VWAP-anchoring drift, exit-drift, and v6 syntax issues.

Scores MCP tool definitions and tool lists from 0-100, flagging vague descriptions, missing parameter docs, non-verb-first naming, oversized enums, and nested schemas with severity, rationale, and concrete fixes. It also validates marketplace listings against platform character caps such as MCPize's 500-character short-description limit before deploy.

Enables auditing package.json files for real npm supply-chain attack mechanisms — typosquatted dependency names, malicious preinstall/install/postinstall scripts that pipe downloads into a shell or decode base64 payloads, and unpinned versions — plus live npm registry lookups that flag nonexistent, brand-new, deprecated, or typosquatted packages. It exposes dedicated tools for full manifest audits and single-name typosquat checks.

Enables traders to instantly evaluate whether a trade fits a specific prop firm's drawdown, position-size, consistency, and daily-loss rules, returning pass/fail status and safe actions. It provides structured firm rule sets and remaining limits through MCP tool calls.

Enables 1099 gig workers and freelancers to calculate 2026 quarterly federal estimates, self-employment tax, safe-harbor minimum payments, and mileage or actual-expense deductions, including the mid-year business mileage rate change from 72.5 to 76 cents. It also compares standard mileage against actual vehicle costs and exposes every tax constant with its source.

Enables sweeping commission and slippage assumptions across backtest results to see how performance degrades, pinpoint the exact cost level where a strategy's edge hits zero, and audit for look-ahead-bias patterns like data leakage and repainting indicators.

Itemises marketplace fees, shipping, and item costs to work out true net profit, margin, and ROI for sales on eBay, Etsy, Poshmark, Mercari, Depop, Whatnot, and TikTok Shop. It also ranks the same item across all seven platforms and finds the lowest list price that still hits a target profit, with dated fee schedules and custom fee overrides.

Enables users to audit other MCP servers' tool definitions for agentic attack classes such as tool poisoning, sensitive-path references in metadata, and tool shadowing via invisible Unicode or homoglyphs. It can analyze a tools/list payload, check a single description string, or connect to a public remote MCP URL to fetch and audit its tool list.

Enables traders and agents to look up upcoming high-impact economic events like FOMC, NFP, and CPI, and to check whether a prop firm's news-restriction window is currently active. It also scores news risk from 1-10 with a plain trading recommendation.

Enables walk-forward analysis of trading strategies by computing Walk-Forward Efficiency ratios, scoring parameter surfaces for fragile curve-fit spikes versus robust plateaus, auditing whether parameters were genuinely locked after optimization, and generating correctly non-overlapping rolling in-sample/out-of-sample windows.

Enables users to search and vet US financial advisors, brokers, and firms using live FINRA BrokerCheck public records, returning registration status, disclosures, employment history, ranked plain-English red flags, and suggested questions to ask. Supports name-based searches and full profiles by CRD number for both individuals and firms.

Strips personal data and credentials from text before it reaches a model, log, or ticket, using checksum-verified detection for cards, IBANs, routing numbers, SSNs, contact details, and API keys. Placeholders such as <EMAIL_1> can later be swapped back in so the model's response is restored with the original values.

Enables scanning GitHub Actions workflow YAML for real-world security vulnerabilities such as script injection from attacker-controlled expressions, unpinned third-party actions, missing permissions blocks, and dangerous pull_request_target checkouts. It returns each finding with its exact location, an explanation of the risk, and a concrete remediation.

Validates cron expressions and computes DST-correct next-fire times against real IANA timezone data, flagging schedules that silently skip a spring-forward run or double-fire on fall-back. Also surfaces the POSIX day-of-month/day-of-week OR semantics and other semantic footguns before a job ships.

Enables exact Claude API cost estimation from token counts with correct prompt-cache economics, plus cache break-even analysis showing whether and at which TTL reusing a prefix pays off. It also scans source code for tiktoken-based token counting used alongside Claude models and points to the correct fix.