Toolars

io.github.aixtralPublished by GitHub account aixtralv0.1.2Updated Nov 14, 2026

Local-first dev utilities: hash, base64, JWT, UUID, cron, URL codec. No network or telemetry.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local stdio MCP server offering developer utilities: hashing, Base64, JWT decoding, UUID/ULID generation, timestamp conversion, cron explanation and URL…

What you can do
  • Compute hex digests of text with md5, sha1, sha224, sha256, sha384 or sha512, defaulting to sha256
  • Encode and decode Base64 text in standard or URL-safe alphabets
  • Parse a JWT header, payload and time claims without verifying the signature
  • Generate random UUIDs (version 4 or 7) and timestamp-ordered ULIDs
  • Convert Unix, ISO 8601, RFC 2822 and wall times, and explain 5-field cron expressions with upcoming runs
  • Percent-encode and decode text using encodeURIComponent or encodeURI semantics
When to use it
Useful when you want an assistant to do quick encoding, hashing, identifier generation or timestamp and cron conversions without leaving the chat, and you prefer these operations to run on your own machine rather than through a web service.
Requirements
Runs as a local process over stdio, started with npx from the npm package @toolars/mcp, so Node.js and network access for the initial package fetch are needed. No accounts, API keys, environment variables or headers are declared.
Before you install
JWT decoding never verifies signatures, so claims should not be trusted for authentication or authorization. MD5 and SHA-1 are integrity-only legacy digests, not signatures. Inputs and results enter the MCP client's context and may be sent to its model provider, so avoid pasting secrets or tokens you would not share with that provider.

Installation

In SourceWeft

  1. Open Toolars in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Toolars open-source distribution

[Privacy proof]

Use Toolars online for PDF, image, text, and developer tools directly in your browser.

This directory is the source of truth for the code Toolars publishes publicly. It is assembled into a distributable tree by scripts/export-open-source.mjs in the private repository; nothing here is built or bundled into the website.

Continuous verification

Every push and every day at 03:17 UTC, the Privacy proof workflow rebuilds both packages from this tree alone, re-runs their test vectors, and re-captures the privacy-proof receipt against the live site. The badge is green only when the latest receipt's outcome is verified.

A failed run is not automatically a privacy finding. The harness distinguishes two outcomes: violation means a measured request crossed the local-processing boundary (the workflow fails on the first attempt, without retrying); inconclusive means the run could not be completed — usually a network problem between the runner and the site — and says nothing about the site in either direction. Inconclusive runs are retried; a persistent one fails the job with an explicit notice. Read the run log before reading anything into a red badge.

What is published

PathWhat it is
evidence-harness/A runnable harness that drives the public website in headless Chromium and records every network request, including dedicated Web Worker fetches. It is the tool behind the claim that files never leave the browser.
packages/cli/@toolars/cli — a local stdio CLI and MCP server (hash, base64, JWT decode, UUID/ULID, timestamp, cron, URL encode/decode), shipped as a prebuilt bundle in dist/.
packages/local-tools/@toolars/local-tools — a smaller local stdio CLI and MCP server (JSON formatting, SHA-256), shipped as runnable source.

All of it is MIT-licensed (see LICENSE). THIRD-PARTY.md states the exact scope and lists third-party components.

What is deliberately not published

This is an open-core distribution, not the whole product. Not included:

  • the website application (routing, SEO layer, catalog, editorial content, the 13 localized content sets);
  • the tool implementations and Web Workers that the website ships, in source form — with one deliberate exception: packages/*/vendor/ carries the site runner cores these two packages import (15 files for the CLI, 2 for local-tools), because without them the packages could not be rebuilt or re-tested here. The packages/cli bundle also inlines compiled copies of the same cores, since it is the artifact prepared for a future @toolars/cli npm release. Both are covered by this repository's MIT license;
  • runtime assets (WASM engines, OCR language packs, fonts, PDF.js);
  • internal engineering, product, and audit documentation;
  • any deployment configuration, credentials, or analytics configuration.

That boundary is the point: the harness verifies the deployed site, so independent verification does not require the site's source. See evidence-harness/README.md for exactly what the harness does and does not prove.

Verifying the local-processing claim yourself

bash
cd evidence-harnessnpm installnpx playwright install chromiumnpm run verify -- --base-url https://toolars.com

The run writes privacy-proof-receipt.json and exits non-zero if an unexpected request leaves the site's origin, if any request carries the canary marker, or if any request uploads data. Disclosed shell requests are counted separately. A missing or changing release identity also prevents a verified result.

Both packages are published on npm under the @toolars scope: npm install -g @toolars/cli gives you toolars + toolars-mcp, and npm install -g @toolars/local-tools gives you toolars-local + toolars-local-mcp. The bins do not collide.

Running the CLI and MCP server

bash
cd packages/clinode dist/cli.mjs hash --sha256 "hello"node dist/mcp.mjs   # stdio MCP server

dist/ is committed and copied from the private build output, so running it needs no install and no build. Review that bundle if you want to see the code you would actually execute: it is unminified, and its section comments name the source file each part came from.

You can also rebuild it here and re-run the same test vectors the private workspace runs. Each package carries the exact site core closure it depends on under vendor/, so neither needs the private repository:

bash
cd packages/clinpm install          # esbuild + vitest, declared as devDependenciesnpm run build        # writes dist/ from src/ plus vendor/npm test             # shared digest vectors and CLI/MCP boundary tests
bash
cd packages/local-toolsnpm install          # esbuild + prettiernode build.mjs       # regenerates src/json-core.mjs from vendor/node --test test/*.test.mjs

vendor/ holds copies of the site runner cores these packages import, produced by the exporter and byte-identical to the private ones. They are published as source on purpose: a reader who can rebuild the package and re-run its vectors can check the results instead of trusting them. Rebuilding in the exported layout changes source-path comments in the CLI bundles and local-tools generated core. Compare executable content separately from these comments; a rebuild is not claimed to reproduce the original manifest byte for byte.

Both packages are local-stdio only. Their inputs and results enter the calling client's context and may reach that client's model provider; the website's privacy promise does not extend to the client. Each package's README states this scope.

Reporting a problem with this code

Open an issue on the public repository. Security reports follow the process in that repository's SECURITY.md.

License

MIT — see LICENSE. Scope and third-party components: THIRD-PARTY.md and evidence-harness/fixtures/PROVENANCE.md.

Source: README.md at commit 6be33da

Tools

11

toolars_hash

Compute the hex digest of UTF-8 text with any algorithm the Toolars hash-checker tools ship (md5, sha1, sha224, sha256, sha384, sha512). Defaults to sha256. Identical to the corresponding Toolars *-hash-checker web tools. MD5 and SHA-1 are integrity-only legacy digests, never signatures. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

Parameterstextrequiredalgorithm

toolars_hash_sha256

Compute a SHA-256 hex digest. Compatibility alias for toolars_hash with algorithm sha256. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

Parameterstextrequired

toolars_base64_encode

Encode UTF-8 text as Base64 (standard or URL-safe alphabet), identical to the Toolars base64-encoder-decoder web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

ParameterstextrequiredurlSafe

toolars_base64_decode

Decode Base64 text (standard or URL-safe alphabet) as UTF-8, identical to the Toolars base64-encoder-decoder web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

ParameterstextrequiredurlSafe

toolars_jwt_decode

Parse a JWT (header, payload, time-claim report) WITHOUT verifying the signature. Never trust the claims; verification is intentionally not offered. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

Parameterstokenrequired

toolars_uuid_generate

Generate random RFC 9562 UUIDs (version 4 or 7), identical to the Toolars uuid-ulid-generator web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

Parameterscountversion

toolars_ulid_generate

Generate ULIDs (timestamp-ordered identifiers), identical to the Toolars uuid-ulid-generator web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

Parameterscount

toolars_timestamp_convert

Convert a Unix timestamp (seconds/milliseconds), ISO 8601, RFC 2822, or wall time into all common representations, identical to the Toolars timestamp-time-zone-converter web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

ParameterssourcerequiredoutputTimeZone

toolars_cron_explain

Explain a 5-field cron expression and list the next scheduled runs, identical to the Toolars cron-builder-explainer web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

ParameterscounttimeZoneexpressionrequired

toolars_url_encode

Percent-encode text (encodeURIComponent or encodeURI semantics), identical to the Toolars url-encoder-decoder web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

Parametersmodetextrequired

toolars_url_decode

Decode percent-encoded text (decodeURIComponent or decodeURI semantics), identical to the Toolars url-encoder-decoder web tool. Runs entirely locally; no network or filesystem access. Input and result enter the MCP client context and may be sent to its model provider.

Parametersmodetextrequired

Version history

2
  1. v0.1.2LatestNov 14, 2026
  2. v0.1.1Sep 26, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts