← MCP servers · abhayjnayakk

Quant Research

ai.avasis/quant-research

BLOCKgrade D · trust 69/100

Statistical tests for whether a backtest means anything: deflated Sharpe, PBO, purged CV, reality checks, attestation verification.

backtestingdeflated sharpemcpoverfittingpythonquantitative financeresearch integritystatistics

Overview

From the repository's own README, as read at the audited commit.

<div align="center"># quant-integrity**Statistical tests for whether a backtest means anything.**[![PyPI](https://img.shields.io/pypi/v/quant-integrity?color=FFB224&label=pypi)](https://pypi.org/project/quant-integrity/)[![Python](https://img.shields.io/pypi/pyversions/quant-integrity?color=FFB224)](https://pypi.org/project/quant-integrity/)[![Licence](https://img.shields.io/badge/licence-AGPL--3.0--or--later-FFB224)](LICENSE)[![CI](https://github.com/abhayjnayakk/quant-integrity/actions/workflows/ci.yml/badge.svg)](https://github.com/abhayjnayakk/quant-integrity/actions/workflows/ci.yml)[![Typed](https://img.shields.io/badge/typing-py.typed-FFB224)](src/)</div>> **This library will not find you a profitable strategy. Its function is to reject> them.** Everything here exists to answer one question: given how many> configurations you tried before reporting this one, does the result survive?```bashpip install quant-integrity```---## The problem, in one pictureA moving-average crossover on BTC-USD hourly bars. After sweeping parameters, thebest configuration returned an annualised Sharpe of **0.95** — and aProbabilistic Sharpe of 0.86, which reads as *"probably beats zero"*.That is where most backtests stop. Here is the same result next to the bar that28 attempts actually sets:![Observed Sharpe against the bar set by the trial count](docs/figures/deflation.svg)The best of 28 tries is large **even when every underlying edge is exactlyzero**. Against that bar the deflated Sharpe is 0.157. The observed result is notmarginal; it is below half of what luck alone produces.A high PSR with a low DSR is the signature of an overfit search, not a borderlineedge.## What the search was actually selecting onThe cause was visible in the trials themselves. Sorting the 28 recorded runs bytrade count against Sharpe:![Sharpe against trade count across every trial](docs/figures/turnover.svg)Every configuration that traded less looked better, at ρ = **−0.96**. That is nota signal being dis

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add quant-integrity -- uvx quant-integrity
claude-desktop
{
  "mcpServers": {
    "quant-integrity": {
      "command": "uvx",
      "args": [
        "quant-integrity"
      ]
    }
  }
}

Details

Source
abhayjnayakk/quant-integrity
PyPI
quant-integrity
Transports
streamable-http
Tools
Registered at runtime; the list could not be read from source.
License
AGPL-3.0
Stars
1 · pushed 9d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codePASS
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
none-observed
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (14)

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.firecrawl/authentik-install.md:72
## Requirements [](https://docs.goauthentik.io/install-config/install/docker-compose/\#requirements "Direct link to Requirements")
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.firecrawl/authentik-install.md:77
## Video [](https://docs.goauthentik.io/install-config/install/docker-compose/\#video "Direct link to Video")
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.firecrawl/authentik-install.md:93
## Download the Compose file [](https://docs.goauthentik.io/install-config/install/docker-compose/\#download-the-compose-file "Direct link to Download the Compose file")
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.firecrawl/authentik-install.md:108
## Generate PostgreSQL password and secret key [](https://docs.goauthentik.io/install-config/install/docker-compose/\#generate-postgresql-password-and-secret-key "Direct link to Generate PostgreSQL pa
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
.firecrawl/authentik-install.md:132
## Configure custom ports [](https://docs.goauthentik.io/install-config/install/docker-compose/\#configure-custom-ports "Direct link to Configure custom ports")
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMAuth / authz · mcp.remote_no_auth · CWE-287, CWE-862
streamable-http
Why it matters. a network transport with no auth environment variable found
Fix. require a token
LOWInventory / provenance · inv.binary · CWE-1104
examples/btc_ma_runs.npz
btc_ma_runs.npz
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.firecrawl/logto-deploy.md:173
proxy_pass http://127.0.0.1:3001;
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.firecrawl/logto-deploy.md:209
proxy_pass http://127.0.0.1:3002;
LOWObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
.firecrawl/logto-gh.md:267
[![discord](https://camo.githubusercontent.com/e95e4b73dcc04e37b996306a69c44956ce165a80067395b65b1d6965e3441db8/68747470733a2f2f696d672e736869656c64732e696f2f646973636f72642f39363538343536363235333531
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
src/quant_integrity/attestation.py:153
else base64.b64decode(public_key)
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
src/quant_integrity/attestation.py:157
base64.b64decode(record["signature"]["value"]), digest.encode("utf-8"))
LOWPrompt injection · prompt.transfer_instruction · CWE-94, CWE-1427
.firecrawl/logto-gh.md:391
[authentication](https://github.com/topics/authentication) [authorization](https://github.com/topics/authorization) [email](https://github.com/topics/email) [identity](https://github.com/topics/identi
Why it matters. an instruction to move sensitive data to an outside destination
Fix. remove; a skill never needs the user's secrets off the machine
LOWInventory / provenance · mcp.no_tools_extracted · CWE-1104
listings/server.json
Why it matters. the tool list is enumerated at runtime by tools/list, not declared in source
Fix. the page says so rather than showing an empty table

Gates applied: no_behavioural_pass.

Audited 2026-09-13 · audit v0.4.0 · source sha 90a655f54226 · full audit: observations/trust-audit/mcp-server/abhayjnayakk__quant-research.json · Report an issue or request a re-scan

Audit history

DateSourceVerdictGradeScoreChange
2026-09-1390a655f54226BLOCKD69source changed, verdict held

Alternatives

Other servers in the same categories, safer ones first.

Questions

What is the ai.avasis/quant-research MCP server?

Statistical tests for whether a backtest means anything: deflated Sharpe, PBO, purged CV, reality checks, attestation verification.

Is ai.avasis/quant-research safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does ai.avasis/quant-research need?

No credential environment variables were found in its source, so it appears to need none.

How does ai.avasis/quant-research run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as quant-integrity.

How current is this page?

The grade is for one exact copy of the source (90a655f54226), read on 2026-09-13. The repository is watched and re-audited when it changes.

Provenance: OBSERVED · read 2026-09-13 · job trust-audit-2026-09-13