Backtest Auditor MCP server

Read from the package source without running it. The installed server may list more.

• audit_backtest

  One call that runs every audit that applies: check_path on the code, audit_returns on the returns, audit_trade_log on the trades, all against the benchmark if given. Returns one combined verdict, the worst of the parts: No red flags found / Some red flags / Major red flags, with reasons per part. Without a benchmark, or with code only, the best verdict is 'Some red flags'. No red flags doesn't mea

• audit_returns

  Statistical red-team of a backtest's return series: net vs gross at 0/5/10/20 bps and the break-even cost; Sharpe with Newey-West and Lo-style t-stats (autocorrelation-aware); the Deflated Sharpe Ratio (Bailey & Lopez de Prado 2014) for n_trials and the minimum track record length; stability by thirds and by year; share of PnL from the best 5% of days; max drawdown and duration; excess return, IR

• audit_trade_log

  Builds daily PnL, returns and turnover from a trade log (marked to market with your prices if given), then runs the full audit_returns review. Adds PnL concentration by ticker and heuristic survivorship hints (tickers traded before their symbol existed; no names ever leaving a multi-year universe). Heuristics are labeled as such.

• check_code

  Static review of Python/pandas strategy code for patterns that inflate backtests: negative shifts in features or signals, centered windows, backward fill, fitting before the time split, shuffled CV, signal and fill on the same bar, labels on the wrong bar, today's index constituents, yfinance caveats, intraday resample labels, global normalization, target leakage, full-sample parameter search and

• check_path

  Read-only lint of Python strategy files on disk: the same rules as check_code, per file. Code is parsed with ast and never imported or run. Virtual environments, node_modules, .git and caches are skipped; folder symlinks are not followed; huge, binary, unreadable or undecodable files are skipped with a reason (a UTF-8 BOM is fine). Each finding has rule_id, severity, title, start_line/end_line, wh

• explain

  What a check looks for, why the problem inflates backtest results, how to fix it, and references.

• Code scan21 source files scanned20/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenanceno repository listed3/15
• Maintainer identityverified namespace with website, no repo4/10

Safety score

60/100

higher than 15% of 48,255 servers

Tools

6

the typical server has 7

Tools that change things

0%

typical: 0%. Fewer write tools means less an agent can break

Downloads a week

81

more than 58% of 12,191 servers with a package

Backtest Auditor: common questions

Is Backtest Auditor MCP server safe?

With care: it is graded C, so read the findings first (60/100). Read the Backtest Auditor safety report

How do I install Backtest Auditor?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Backtest Auditor need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Backtest Auditor maintained?

The latest release is v0.7.0.

How does Backtest Auditor compare with other MCP servers?

safety score 60/100 (higher than 15% of 48,255 servers); tools 6 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.