Shikamaru — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Shikamaru (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Provably correct day-count, holiday-calendar, business-day, and payment-schedule calculations. A small, dependency-light TypeScript library and an MCP server, so an AI agent can get the exact date or number instead of guessing.
LLMs are unreliable at date and money math: they pick the wrong day-count convention, forget market holidays, and miscompute accrued interest. shikamaru does it deterministically and proves it against published reference values. Do not let a model guess your interest accrual or your settlement date.
us-federal, nyse, sifma-us, target, uk.Calendars are published rules plus a short pinned table of historical one-off closures, current as of this version. Rules generate correct dates arbitrarily far forward; one-off closures (a mourning day, a proclaimed extra holiday) are added when announced and ship in a patch release. A scheduled CI run re-checks every calendar against the latest QuantLib weekly, so drift is detected, not discovered.
npm install @jayofemi/shikamaruimport {
accruedInterest, addBusinessDays, adjustDate, dayCountFraction,
generateSchedule, isBusinessDay,
} from "@jayofemi/shikamaru";
dayCountFraction("2003-11-01", "2004-05-01", "ACT/ACT ISDA"); // 0.4977...
accruedInterest({
notional: 1_000_000,
rate: 0.05,
start: "2024-01-01",
end: "2024-04-01",
convention: "ACT/365F",
});
isBusinessDay("2024-06-19", "nyse"); // false (Juneteenth)
adjustDate("2024-03-29", "modified-following", "target"); // "2024-03-28" (Good Friday, stays in March)
addBusinessDays("2024-07-02", 2, "us-federal"); // "2024-07-05" (T+2 over July 4th)
generateSchedule({
effective: "2024-01-15",
termination: "2026-01-15",
frequency: "semiannual",
calendar: "target",
}); // four periods with unadjusted and adjusted datesDates are strict ISO YYYY-MM-DD. Rate is an annual decimal (0.05 = 5%).
From source (local dev):
npm install
npm run build
node dist/server.jsOnce published, an MCP client can launch it directly:
npx @jayofemi/shikamaruPoint any MCP client (Claude Desktop, an IDE, etc.) at that command over stdio.
The standard way to test shikamaru's server is the official MCP Inspector. The unit tests cover the library; the Inspector covers the server layer they do not touch.
npm run build
npx @modelcontextprotocol/inspector node dist/server.jsIt opens a local UI, connects over stdio, lists the tools, and lets you call them. Sanity check: day_count_fraction with start 2003-11-01, end 2004-05-01, convention ACT/ACT ISDA returns about 0.4977.
Conventions follow the ISDA 2006 definitions; calendars follow their published sources (OPM, NYSE rules, SIFMA recommendations, ECB TARGET rules, gov.uk proclamations). The test suite checks published reference vectors (ISDA worked examples, official holiday lists, the OpenGamma conventions guide), property checks, and differential batteries against QuantLib, the de-facto reference: day-count fractions, full per-calendar holiday lists across decades, business-day adjustment and advancing, schedules compared date by date, and ACT/ACT ICMA fractions including stubs.
To (re)generate the QuantLib batteries (needs Python + pip):
pip install QuantLib
npm run vectorsThis writes test/vectors/quantlib.json and test/vectors/quantlib-calendar.json (commit both). npm test then checks shikamaru against every QuantLib value. CI regenerates the batteries from the latest QuantLib on every push AND on a weekly schedule (the drift watchdog), so a real-world calendar change surfaces as a red run even when the repo is quiet. The proof is the product.
npm install
npm run build
npm testMIT. Copyright (c) 2026 Jay Ofemi.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.