AlphaAssay

Independent statistical validation for trading signals and backtests: deflated Sharpe, out-of-sample and leakage forensics, signed replayable verdicts; a methodology audit, not investment advice.

GitHub

Documentation

alphaassay-tools

Open-source client tooling for the AlphaAssay validation service: an offline certificate verifier (Python) and a stdio-to-remote MCP proxy (Node), plus runnable examples and the registry manifest for the hosted server.

Component	Language	Path	What it does
`alphaassay_verify`	Python ≥3.10	`alphaassay_verify/`	Verifies certificates offline: Ed25519 signatures, canonical serialisation, signed key/revocation history. No network access.
MCP proxy	Node ≥18	`server/`	Bridges a local stdio MCP client to the remote streamable-HTTP endpoint.
Examples	—	`examples/`	Known-answer request/response pairs you can run against the free demo endpoint.
`server.json`	—	`server.json`	Secondary artifact: the manifest the MCP registry reads to describe the hosted server. Not needed to use the code above.

The validation engine itself is a hosted service and is not part of this repository.

Install

Python verifier, from source:

pip install .
# or, for development
pip install -e ".[dev]"

Node proxy:

npm install

Usage

Verify a certificate offline

Full platform trust needs three local inputs: the certificate with its signature, a signed version-2 revocation/key-history bundle, and at least one externally obtained SHA-256 root fingerprint. The verifier performs no network or database access.

python -m alphaassay_verify verify \
  --certificate cert.json \
  --trust-bundle trust-bundle.json \
  --root-fingerprint <64-hex-digest>

Signature-only evidence, when you deliberately do not want to establish full platform trust:

python -m alphaassay_verify signature-only \
  --certificate cert.json \
  --public-key key.pem

Exit code 0 means verified; a non-zero exit code and a machine-readable reason mean it is not. See SPEC.md for the canonical byte format and the trust rules the implementation follows.

Run the MCP proxy

node server/index.mjs

The proxy speaks stdio to your MCP client and forwards to the remote endpoint. The tool list it exposes is in server/tools.json.

Run the examples

Each example is a request payload, the expected response, and a shell script that posts it to the free demo endpoint:

cd examples && ./golden_lookahead.sh

The expected responses are checked in, so they double as fixtures for integration tests in your own code.

Tests

python -m pytest tests/     # verifier: unit tests and canonical vectors
npm test                    # proxy: contract and behaviour tests

Test vectors live in tests/canonical_vectors.json and tests/fixtures/; they are the same vectors the implementation is developed against.

Contributing

Issues and pull requests are welcome. Please:

keep changes focused and include tests for behaviour changes;
run python -m pytest tests/ and npm test before opening a PR;
for the verifier, do not add network or database access — offline operation is a design constraint, not an implementation detail;
report security issues privately as described in SECURITY.md rather than in a public issue.

License

Apache-2.0. See LICENSE.