{
  "markdown": "# buildutilities-mcp\n\nDeterministic developer utilities as MCP tools. Runs entirely on your machine — **no network calls, no telemetry, no API key, no account.**\n\nFrom the people who make [buildutilities.com](https://buildutilities.com).\n\n## Why these tools and not others\n\nA language model is already good at most text manipulation, and a tool it does not need is a tool that only burns its context window. So this server deliberately covers the operations models are genuinely *bad* at:\n\n- **Randomness.** A model cannot generate it. Ask one for a UUID or a password and you get something drawn from its training distribution — repeatable between sessions, sometimes lifted verbatim from a public code sample. For anything security-adjacent that is a real defect.\n- **Exact digests and bytes.** It cannot compute a SHA-256, so it invents a plausible one. Base64 of anything it has not effectively memorised comes back quietly corrupted.\n- **Running a regex.** Asked whether a pattern matches, a model reasons *about* the pattern instead of executing it, so it reports matches that do not exist and misses ones that do.\n- **Precise counting** over long text, and **calendar arithmetic** across timezones and DST — including \"when does this cron next fire\", which models answer confidently and wrongly.\n\nEverything here is a pure function: same arguments, same answer, no state, no side effects.\n\n## Install\n\n**Claude Code**\n\n```bash\nclaude mcp add buildutilities -- npx -y buildutilities-mcp\n```\n\n**Claude Desktop, Cursor, or any client with a JSON config**\n\n```json\n{\n  \"mcpServers\": {\n    \"buildutilities\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"buildutilities-mcp\"]\n    }\n  }\n}\n```\n\nRequires Node 18 or newer. To see the tool list without an MCP client:\n\n```bash\nnpx -y buildutilities-mcp --help\n```\n\n## Tools\n\n**Randomness a model cannot fake**\n\n| Tool | What it does |\n| --- | --- |\n| `generate_uuid` | Cryptographically random UUID v4s, via the OS CSPRNG. |\n| `generate_password` | Random password, guaranteeing at least one character from every enabled set. |\n| `generate_token` | Random token for API keys, session ids, nonces and salts — hex, base64url or alphanumeric. |\n\n**Exact bytes and digests**\n\n| Tool | What it does |\n| --- | --- |\n| `base64_encode` | Encode to Base64, standard or URL-safe. |\n| `base64_decode` | Decode Base64, reporting invalid input rather than returning mojibake. |\n| `url_encode` | Percent-encode, in component or full-URI mode. |\n| `url_decode` | Decode percent-encoding, reporting malformed input. |\n| `hash_text` | md5, sha1, sha256, sha384 or sha512 digest, with a warning on the broken ones. |\n| `hmac_sign` | HMAC a message with a secret — webhook and request signing. |\n| `hmac_verify` | Constant-time check of a message against an expected signature. |\n\n**Calendar arithmetic**\n\n| Tool | What it does |\n| --- | --- |\n| `convert_timestamp` | Unix epoch to human time in any IANA timezone; auto-detects seconds vs milliseconds. |\n| `cron_next_runs` | Next run times for a 5-field cron expression, in a timezone. |\n\n**Documents, tokens, diffs**\n\n| Tool | What it does |\n| --- | --- |\n| `format_json` | Pretty-print or minify JSON exactly, with line and column on a parse error. |\n| `decode_jwt` | Read a JWT's header, payload and expiry. Decodes only — never verifies. |\n| `diff_text` | Line-by-line diff, marking what was added and removed. |\n\n**Run it, do not predict it**\n\n| Tool | What it does |\n| --- | --- |\n| `test_regex` | Actually execute a pattern and return every match with its index and capture groups. |\n| `escape_regex` | Escape a string for use as a regex literal. |\n| `analyze_text` | Exact character, word, line, sentence, paragraph and byte counts. |\n| `slugify` | URL-safe slug, transliterating accents. |\n| `check_color_contrast` | Exact WCAG 2.2 contrast ratio and which AA/AAA thresholds it passes. |\n\n## What it does not do\n\n- **It does not verify JWT signatures.** `decode_jwt` reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.\n- **md5 and sha1 are included but not secure.** They are there for checksums and legacy interop, and the tool says so in its output.\n- **Cron is standard 5-field only.** Non-standard syntax (`L`, `W`, `#`, `?`) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disagree about that case.\n\n## The no-network claim is tested\n\nThree tests in `test/no-network.test.ts` enforce it, so it cannot quietly stop being true:\n\n1. No source file imports `node:net`, `http`, `https`, `dns`, `tls` or `dgram`, or calls `fetch`.\n2. Running every tool in the catalogue loads no network-related native binding.\n3. The package declares exactly two runtime dependencies (the MCP SDK and zod); adding a third fails the suite and forces a re-check.\n\n```bash\nnpm test    # 48 tests\n```\n\n## Licence\n\nMIT\n",
  "bytes": 4961,
  "sha": "de1d18849b91515d4fe00540d67a4396907dfc7bfbf05e084ea181c62f7a7265",
  "repo_slug": "brentspore/buildutilities-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_brentspore_buildutilities_mcp_ea4df538/readme"
}