Furki Özkan

An MCP tool description is read by the model on every single call, and nobody scrolls past it. mcp-vet reads the source before you install: 31 rules covering tool poisoning, exfiltration paths, install hooks and registry provenance, every finding quoted with file:line. Never executes what it audits. Zero dependencies, 289 tests.

• Reads an MCP server's source before you install it - 31 rules across tool poisoning, exfiltration paths, install hooks and registry provenance
• Every finding is quoted with file:line, so a claim can be checked rather than believed

70 Claude Code sub-agents that think in Turkish rather than translate into it - they know PowerShell 5.1 has no &&, that cp1254 kills a Python tool before its first line prints, and that a heredoc eats backslashes. Plus 3 commands, 2 skills and an eval suite. One source, exported to Cursor, OpenCode, Copilot and Codex.

• 71 sub-agents that think in Turkish rather than translate into it
• Encodes the traps that actually bite on Turkish Windows: no && in PowerShell 5.1, cp1254 killing a tool before its first line, heredocs eating backslashes

Godot reports a broken resource reference only when that scene loads, and a dead signal connection never at all. godot-refcheck reads the project files instead: missing paths, case-only breakage, uid problems, connections to nodes that are gone. It repairs the ones with a single provable answer.

• Eleven checks over .tscn, .tres, project.godot, .import, plugin.cfg, GDScript and shaders, in both the Godot 3 and Godot 4 formats
• Node paths resolve through instanced, inherited and placeholder scenes, so a dead signal connection is found without ever calling a healthy one broken

The engine that keeps every repository on this account moving forward: it measures what each one can currently do, ranks where the headroom is, and refuses to record work that no check actually verified.

• Twelve signals that measure a repository without executing anything inside it, each returning the evidence behind its number and null rather than a guess
• Work records with three rules enforced in code: advanced needs the commit to have moved, advanced needs a check that ran and exited zero, no-change needs a stated reason

Which model, provider, params and job made this file - written into the file itself, so the record outlives the database row. PNG gets a lossless text chunk, JPEG a private APP1 marker spliced into container bytes with no re-encoding, MP4/MOV a uuid box appended after the media data so the absolute chunk offsets in moov stay valid, everything else a sidecar. Honest about what C2PA does that this does not. 125 tests.

• Which model, provider, parameters and job made this file - written into the file itself, so the record outlives the database row
• PNG gets a lossless text chunk; JPEG gets a private APP1 marker spliced into container bytes with no re-encoding

Checks what a GitHub repository claims about itself - install commands, badges, links, releases, published sites - against what is actually there. Six checks over the GitHub API, no clone, zero dependencies.

• Checks a README's install commands against PyPI and npm, so the first command a visitor runs is one that still resolves
• Only fenced code blocks count as instructions: a sentence mentioning a command is discussing it, not asking anyone to run it

A pipeline is a plain YAML DAG in git, not a diagram in a visual editor - and it is validated before it runs. A step that reads another step's result without declaring the dependency is rejected at load time, typo and all. Layers run concurrently, capped and backed off so width never becomes a burst. 72 tests.

• A pipeline is a plain YAML DAG in git, not a diagram in a visual editor
• Validated before it runs: a step reading another step's result without declaring the dependency is rejected at load time, typo and all

Fire one request at N model backends at once and read latency, success and output side by side. --rubric adds a judge model returning pass/fail, a 0-1 score and a reason, so you compare quality too, not just who answered first. Every failure carries an error_type a script can branch on. CLI: mch. 74 tests.

• Fires one request at N model backends at once and puts latency, success and output side by side
• --rubric adds a judge model returning pass/fail, a 0-1 score and a reason, so quality is compared too

Your prompts deserve git diff, not a database row. Templates as plain YAML, rendered through Jinja's SandboxedEnvironment with StrictUndefined so a typo'd variable fails loudly instead of rendering blank - plus a ${var} form that keeps an integer an integer instead of stringifying it. CLI: ptm. 61 tests.

• Templates as plain YAML, so a prompt change is a diff in a pull request rather than a database row
• Rendered through Jinja's SandboxedEnvironment with StrictUndefined: a typo'd variable fails loudly instead of rendering blank

Where the tokens went, what it cost, and when the limit resets. Every number carries an evidence class - observed, derived, estimated - and one that fails the reconciliation gate is not printed at all. No prompt, response or file content is defined in any type, so a privacy review is a grep. Local-first. 273 tests.

• Where the tokens went, what it cost, and when the limit resets
• Every number carries an evidence class - observed, derived or estimated - and one that fails the reconciliation gate is not printed at all

Superseded early prototype of Claude Code quota tracking. The maintained implementation lives in claude-code-intelligence.

• Superseded early prototype of Claude Code quota tracking
• The maintained implementation lives in claude-code-intelligence

23 CPU-first media tools behind one MCP server: background removal, EXIF/GPS stripping, resize, thumbnails, GIFs, video trim. 22 of them report "network": "none" in their own response payload rather than in a README, and a test fails if any other module ever imports an HTTP client. No GPU, no paid API. 326 tests.

• 23 CPU-first media tools behind one MCP server: background removal, EXIF/GPS stripping, resize, thumbnails, GIFs, video trim
• 22 of them report "network": "none" in their own response payload rather than in a README

Seven MCP tools on NVIDIA NIM's free tier - image, vision, translation, chat, content safety, embeddings, plus a health probe that tells you which models are still alive. Two of them need no API key at all. Falls through to Groq, Mistral, Gemini or Cerebras when a model is rate-limited or quietly retired. 80 tests.

• Seven MCP tools on NVIDIA NIM's free tier: image, vision, translation, chat, content safety, embeddings, plus a health probe that tells you which models are still alive
• Two of the seven need no API key at all

Ask your own files a question in plain language instead of guessing the keyword you typed six months ago. Semantic search as an MCP server: sqlite-vec + a multilingual ONNX model, incremental re-indexing, answers returned as file:line. No server, no API key, no network at query time. Grounded LLM Q&A is opt-in. 50 tests.

• Ask your own files a question in plain language instead of guessing the keyword you typed six months ago
• Semantic search as an MCP server: sqlite-vec plus a multilingual ONNX model, with incremental re-indexing

Speech in and speech out, needing no API key at all: Groq's free hosted tier when a key is set, Kokoro-82M and faster-whisper locally when it is not. Transcription checks extension and size before it ever opens the file, so "transcribe the audio at .env" is refused locally instead of uploaded. 4 tools, 35 tests.

• Speech in and speech out, needing no API key at all
• Groq's free hosted tier when a key is set; Kokoro-82M and faster-whisper locally when it is not

An AI agency OS built research-first: 40 agent projects read with file:line evidence, then 11 ADRs, 6 machine-readable contracts and 13 modules. Its strongest proof is an acceptance run killed mid-task, reloaded from disk and resumed - then checked that no side effect repeated. The contract validator is mutation-measured: disable any one of its 19 enforcement points and its own self-test has to notice. Zero dependencies, 142 tests.

• Built research-first: 40 agent projects read with file:line evidence before a line was written
• 11 architecture decision records, 6 machine-readable contracts, 13 modules

The async job contract fal.ai, Black Forest Labs and RunPod each arrived at independently, as one hardened reference server: submit, poll, webhook. Idempotency keys that survive a restart, SSRF-guarded signed webhooks, and expiry as a status you can read rather than a silent 404. 156 tests.

• The async job contract fal.ai, Black Forest Labs and RunPod each arrived at independently, as one hardened reference server: submit, poll, webhook
• Idempotency keys that survive a restart

"What do I need, and where is the nearest one?" 167,829 real OpenStreetMap places across all 81 provinces of Türkiye - pulled from each province's true boundary, not a box around its capital, so all 973 district centres have data within 15 km. Bearing, distance and a one-tap "still here?" on every result. 324 tests.

• 167,829 real OpenStreetMap places across all 81 provinces of Turkiye
• Pulled from each province's true boundary, not a box around its capital, so all 973 district centres have data within 15 km

A bedtime story written around one child's name, age and hometown, with the colouring page drawn into it as vectors that fill cleanly instead of raster art that smudges past the outline. Six themes and a branch on page three - twelve readings. Turkish suffix engine, no photo upload, no download, no API key.

• A bedtime story written around one child's name, age and hometown
• The colouring page is drawn into the story as vectors, so it fills cleanly instead of smudging past the outline

One-button endless rooftop runner in Godot 4: a rhythm mode that lays every obstacle on the music beat grid, plus a post-run timing histogram. Turkish UI.

• One-button endless rooftop runner: the only input is when to press
• Rhythm mode lays every obstacle on the music's beat grid instead of a random spacer

No jump button - one key flips gravity and you fall onto the ceiling. 20 hand-built precision platformer rooms in Godot 4. Turkish UI.

• No jump button: one key flips gravity and you fall onto the ceiling
• 20 hand-built precision rooms, each with its own medal times

Side-view digging and upgrade loop in Godot 4: mine ore, watch the fuel, sell, upgrade the rig, reach the core at 250 m. Turkish UI.

• Dig-sell-upgrade loop across five underground layers down to the core at 250 m
• Fuel is the timer: every descent is a bet on getting back up before it runs out

Hook the ceiling, swing, release at the right moment and carry the momentum - a speed-focused 2D swinging platformer in Godot 4; medal times measured on 13 of 14 levels by a scripted bot. Turkish UI.

• Swing physics with no jump button: hook a ceiling anchor, swing, release at the right moment and keep the momentum
• 14 hand-built levels; medal times on 13 of them measured by a scripted bot rather than guessed

Endless browser space-runner with real Three.js bloom, hand-written particles and an audio engine synthesized live in Web Audio - not one sound file in the repo. Skim an obstacle without touching it and take the near-miss bonus. A daily run seeded from the UTC date deals every player the same obstacles. 0.7 MB, no build step.

• Endless browser space-runner with real Three.js bloom post-processing and hand-written particles
• Audio engine synthesized live in Web Audio - not one sound file in the repository

Two Godot 4.7 starters that already feel right to play: top-down with 8-way accelerated movement, and side-view with coyote time, jump buffering and variable jump height. The feel is measured, not guessed - the jump curves come from running the real _physics_process at the project's 60 Hz fixed step.

• Two starter projects that already feel right to play: top-down with 8-way accelerated movement, side-view with coyote time, jump buffering and variable jump height
• The feel is measured, not guessed: jump curves come from running the real _physics_process at the project's 60 Hz fixed step

Reproducible count of the official MCP Registry: the same question asked three ways gives three different numbers, and this measures why.

• Asks the official MCP Registry the same question three ways and shows why the three answers differ
• Finds that roughly a quarter of registry entries have no source code to read

The searchable project directory for this account. Every card is rendered from the project-meta.json a repository carries, so the page cannot claim anything the repository does not; a scheduled workflow rebuilds it from the live metadata every week.

• One searchable page over every public repository, with filters by category and language
• Generated from each repository's own project-meta.json, never hand-edited

Source of the profile README - agent infrastructure, developer tooling and the MCP servers underneath. Every number on the page is traced to the suite run that printed it (see TESTLER.md). Hand-written SVG, no generated stat cards.

• Source of the GitHub profile README
• Every number on the page is traced to the suite run that printed it (TESTLER.md)