Omnideck

io.github.aapd-studioPublished by GitHub account aapd-studiov1.0.4Updated Oct 27, 2026

Local privacy-first tools: redact secrets, decode JWTs, compare LLM costs. No network calls.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & MonitoringAI & ML

Overview

AI-generated overview

Local, privacy-first utility server that lets an assistant redact secrets, decode JWTs, hash text, split documents and compare LLM costs without network calls.

What you can do
  • Redact emails, API keys, credit cards, IBANs, IPs and phone numbers from logs, configs or pasted text, optionally limited to chosen categories
  • Decode a JWT header and payload and check expiry, without verifying the signature
  • Hash text with MD5, SHA-1, SHA-256 or SHA-512 locally
  • Estimate and compare the cost of one request across nine GPT, Claude and Gemini models
  • Split long documents into chunks that fit a token budget on paragraph or sentence boundaries
  • Flag names, numbers and dates in an AI summary that do not appear in the source text
When to use it
Useful when an assistant has to handle sensitive strings — tokens, passwords, log files — that you would rather not paste into an online tool, or when you want quick local cost estimates, hashing, chunking or a rough check for invented specifics in a summary.
Requirements
Runs as a local stdio process; install globally with npm or run via npx, so Node.js and npm are needed. No accounts, API keys, environment variables or network access are required.
Before you install
The JWT tool does not verify signatures, so decoded tokens are still live credentials. Cost figures are list prices dated 2026-10 and should not be relied on for billing. The fidelity check is a lexical heuristic, not a fact-checker, and can flag correct rephrasings. Redaction is pattern-based, so review output before sharing.

Installation

In SourceWeft

  1. Open Omnideck in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

OmniDeck MCP

[M8ven Score]

Local, privacy-first tools for AI agents. No network calls, ever.

Some tasks are awkward to hand to an AI agent because doing them normally means pasting a secret into a website: decoding a JWT, hashing a password, scrubbing a log file before it goes to an API. This server does those locally instead.

Every tool is pure computation inside your own process. The server opens no sockets and makes no outbound requests — nothing you pass to it leaves your machine.

Install

bash
npm install -g omnideck-mcp

Or run it without installing:

bash
npx omnideck-mcp

Configure

Claude Desktop — add to claude_desktop_config.json:

json
{  "mcpServers": {    "omnideck": {      "command": "npx",      "args": ["-y", "omnideck-mcp"]    }  }}

Claude Code:

bash
claude mcp add omnideck -- npx -y omnideck-mcp

Any MCP client that speaks stdio works the same way.

Tools

redact_sensitive_data

Masks emails, API keys, credit cards, IBANs, IP addresses and phone numbers. Run it over logs, config files or user-pasted text before that content reaches an external API or a shared transcript.

Patterns are applied most-specific-first, so a key like sk-ant-… is matched whole rather than being chopped up by the generic phone-number pattern.

Contact me at [email protected], key sk-ant-abcdefghij1234567890→ Contact me at [EMAIL REDACTED], key [API KEY REDACTED]

Optional categories argument restricts which classes are masked.

decode_jwt

Decodes a token's header and payload and reports whether it has expired. The signature is not verified — no secret is needed, and none should be pasted anywhere. A JWT is a live credential; this exists so you never have to paste one into an online decoder.

estimate_llm_cost

Compares what a single request would cost across nine GPT, Claude and Gemini models, cheapest first. Pass text (tokens are counted exactly via gpt-tokenizer) or pass input_tokens directly. Useful before committing to a model for a large batch job.

List prices are current as of 2026-10 and are refreshed periodically — check your provider's pricing page before relying on them for billing decisions.

split_for_context

Splits a long document into chunks that fit a token budget, cutting on paragraph boundaries and falling back to sentence boundaries, so no chunk ends mid-thought.

check_output_fidelity

Flags names, numbers and dates that appear in an AI-generated summary but not in the source it was based on — the usual shape of a fabricated detail.

This is a lexical heuristic, not a fact-checker. It catches invented specifics, not faulty reasoning, and a correctly-rephrased term can be flagged. Treat the output as a list of things to verify by hand.

hash_text

MD5, SHA-1, SHA-256 or SHA-512 digest of a string, computed locally. For when the input is a password or other private value that has no business going into an online hash generator.

Privacy

  • No network requests. No telemetry. No analytics. No logging of your inputs.
  • Three runtime dependencies: the MCP SDK, zod, and gpt-tokenizer.
  • MIT licensed — read index.js and verify all of the above; it is a single readable file.

Related

Full documentation for this server, in English and Spanish: omnideck.cc/mcp

These tools also run as free browser-based utilities, alongside ~125 others, at omnideck.cc — same principle, everything client-side.

License

MIT © AAPD Studio

Source: README.md at commit 7e75adb

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

3
  1. v1.0.4LatestOct 7, 2026
  2. v1.0.3Sep 21, 2026
  3. v1.0.1Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts