Buildutilities Mcp

io.github.brentsporePublished by GitHub account brentsporev0.1.3Updated Oct 31, 2026

Deterministic dev utilities: UUIDs, hashes, encoding, JWT, cron, regex. No network, no API key.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server of deterministic developer utilities: random IDs and passwords, hashes, HMAC, encoding, JWT decoding, cron, regex and text counting.

What you can do
  • Generate random UUIDs, passwords and tokens from the OS CSPRNG
  • Encode and decode Base64 and percent-encoded URLs, and compute md5/sha1/sha256/sha384/sha512 digests
  • Sign and constant-time verify HMACs for webhook or request signing
  • Convert Unix timestamps across IANA timezones and list the next runs of a 5-field cron expression
  • Format or minify JSON, decode a JWT header and payload, and diff two texts line by line
  • Execute regexes with match indexes and capture groups, escape regex literals, count characters/words/lines/bytes, slugify text and check WCAG 2.2 colour contrast
When to use it
Useful when an assistant must produce real randomness, exact digests or byte-accurate encodings, or actually run a regex, count long text, or do timezone and cron arithmetic instead of estimating. Good for everyday development chores where a confidently wrong answer would be costly.
Requirements
Runs as a local stdio process via npx from the npm package buildutilities-mcp; requires Node 18 or newer. No API key, account, environment variables or network access.
Before you install
decode_jwt only decodes and does not verify signatures, so its output must not be treated as authentication. md5 and sha1 are for checksums and legacy interop, not security. Passwords and tokens are generated locally but are returned to the assistant and its transcript. Cron accepts only standard 5-field syntax, and DST spring-forward gaps are listed even though real cron implementations differ.

Installation

In SourceWeft

  1. Open Buildutilities Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

buildutilities-mcp

Deterministic developer utilities as MCP tools. Runs entirely on your machine — no network calls, no telemetry, no API key, no account.

From the people who make buildutilities.com.

Why these tools and not others

A language model is already good at most text manipulation, and a tool it does not need is a tool that only burns its context window. So this server deliberately covers the operations models are genuinely bad at:

  • Randomness. A model cannot generate it. Ask one for a UUID or a password and you get something drawn from its training distribution — repeatable between sessions, sometimes lifted verbatim from a public code sample. For anything security-adjacent that is a real defect.
  • Exact digests and bytes. It cannot compute a SHA-256, so it invents a plausible one. Base64 of anything it has not effectively memorised comes back quietly corrupted.
  • Running a regex. Asked whether a pattern matches, a model reasons about the pattern instead of executing it, so it reports matches that do not exist and misses ones that do.
  • Precise counting over long text, and calendar arithmetic across timezones and DST — including "when does this cron next fire", which models answer confidently and wrongly.

Everything here is a pure function: same arguments, same answer, no state, no side effects.

Install

Claude Code

bash
claude mcp add buildutilities -- npx -y buildutilities-mcp

Claude Desktop, Cursor, or any client with a JSON config

json
{  "mcpServers": {    "buildutilities": {      "command": "npx",      "args": ["-y", "buildutilities-mcp"]    }  }}

Requires Node 18 or newer. To see the tool list without an MCP client:

bash
npx -y buildutilities-mcp --help

Tools

Randomness a model cannot fake

ToolWhat it does
generate_uuidCryptographically random UUID v4s, via the OS CSPRNG.
generate_passwordRandom password, guaranteeing at least one character from every enabled set.
generate_tokenRandom token for API keys, session ids, nonces and salts — hex, base64url or alphanumeric.

Exact bytes and digests

ToolWhat it does
base64_encodeEncode to Base64, standard or URL-safe.
base64_decodeDecode Base64, reporting invalid input rather than returning mojibake.
url_encodePercent-encode, in component or full-URI mode.
url_decodeDecode percent-encoding, reporting malformed input.
hash_textmd5, sha1, sha256, sha384 or sha512 digest, with a warning on the broken ones.
hmac_signHMAC a message with a secret — webhook and request signing.
hmac_verifyConstant-time check of a message against an expected signature.

Calendar arithmetic

ToolWhat it does
convert_timestampUnix epoch to human time in any IANA timezone; auto-detects seconds vs milliseconds.
cron_next_runsNext run times for a 5-field cron expression, in a timezone.

Documents, tokens, diffs

ToolWhat it does
format_jsonPretty-print or minify JSON exactly, with line and column on a parse error.
decode_jwtRead a JWT's header, payload and expiry. Decodes only — never verifies.
diff_textLine-by-line diff, marking what was added and removed.

Run it, do not predict it

ToolWhat it does
test_regexActually execute a pattern and return every match with its index and capture groups.
escape_regexEscape a string for use as a regex literal.
analyze_textExact character, word, line, sentence, paragraph and byte counts.
slugifyURL-safe slug, transliterating accents.
check_color_contrastExact WCAG 2.2 contrast ratio and which AA/AAA thresholds it passes.

What it does not do

  • It does not verify JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.
  • md5 and sha1 are included but not secure. They are there for checksums and legacy interop, and the tool says so in its output.
  • Cron is standard 5-field only. Non-standard syntax (L, W, #, ?) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disagree about that case.

The no-network claim is tested

Three tests in test/no-network.test.ts enforce it, so it cannot quietly stop being true:

  1. No source file imports node:net, http, https, dns, tls or dgram, or calls fetch.
  2. Running every tool in the catalogue loads no network-related native binding.
  3. The package declares exactly two runtime dependencies (the MCP SDK and zod); adding a third fails the suite and forces a re-check.
bash
npm test    # 48 tests

Licence

MIT

Source: README.md at commit 3bba202

Tools

20

generate_uuid

Generate UUID

Generate cryptographically random UUID v4 identifiers. Use this instead of writing a UUID yourself — model-authored UUIDs are not random and repeat across sessions. Web version: https://buildutilities.com/uuid-generator

Parameterscountuppercase

generate_password

Generate Password

Generate a cryptographically random password. Guarantees at least one character from every enabled set. Use this rather than inventing a password — model-authored ones are guessable. Web version: https://buildutilities.com/password-generator

ParameterscountdigitslengthsymbolslowercaseuppercaseexcludeAmbiguous

generate_token

Generate Random Token

Generate a cryptographically random token — API keys, session ids, nonces, salts. Choose hex, base64url or alphanumeric encoding. Web version: https://buildutilities.com/random-string-generator

Parametersbytescountencoding

base64_encode

Base64 Encode

Encode text to Base64. Set urlSafe for the URL/filename-safe alphabet (-_ instead of +/, no padding). Web version: https://buildutilities.com/base64-codec

ParameterstextrequiredurlSafe

base64_decode

Base64 Decode

Decode Base64 (standard or URL-safe) back to text. Reports whether the input was valid rather than returning mojibake. Web version: https://buildutilities.com/base64-codec

Parametersencodedrequired

url_encode

URL Encode

Percent-encode text. component mode escapes & = ? / for use inside a query value; uri mode preserves them. Web version: https://buildutilities.com/url-codec

Parametersmodetextrequired

url_decode

URL Decode

Decode percent-encoded text. Web version: https://buildutilities.com/url-codec

Parameterstextrequired

hash_text

Hash Text

Compute a cryptographic digest of text. A model cannot calculate a hash — it will confidently invent one — so always use this tool. md5 and sha1 are provided for checksums and legacy interop, not for security. Web version: https://buildutilities.com/hash-generator

Parameterstextrequiredencodingalgorithm

hmac_sign

HMAC Sign

Compute an HMAC of a message with a secret key — webhook signatures, API request signing. Web version: https://buildutilities.com/hmac-generator

Parameterssecretrequiredmessagerequiredencodingalgorithm

hmac_verify

HMAC Verify

Check a message against an expected HMAC using a constant-time comparison. Use this to validate an inbound webhook signature rather than comparing strings yourself.

Parameterssecretrequiredmessagerequiredalgorithmsignaturerequired

convert_timestamp

Convert Timestamp

Convert between Unix epoch and human-readable time, in any IANA timezone. Auto-detects seconds vs milliseconds. Use this rather than doing the arithmetic in your head. Web version: https://buildutilities.com/timestamp-converter

ParametersvaluerequiredtimeZone

cron_next_runs

Cron Next Runs

Parse a standard 5-field cron expression and list its next run times in a timezone. Handles the Vixie rule that day-of-month and day-of-week are OR'd when both are restricted — the case models most often get wrong. Rejects non-standard syntax (L, W, #) rather than guessing. Web version: https://buildutilities.com/cron-expression-generator

ParameterscounttimeZoneexpressionrequired

format_json

Format or Minify JSON

Pretty-print or minify JSON exactly, with precise error location when it is invalid. Prefer this to reformatting a large document yourself — it cannot drop or alter a value. Web version: https://buildutilities.com/json-formatter

ParametersjsonrequiredmodeindentsortKeys

decode_jwt

Decode JWT

Decode a JSON Web Token's header and payload and report expiry. This DECODES ONLY — it does not verify the signature, so never treat the contents as trusted on the strength of this output. Models asked to read a JWT tend to invent its claims; this reads them. Web version: https://buildutilities.com/jwt-decoder

Parameterstokenrequired

diff_text

Diff Text

Line-by-line diff of two texts, marking - removed and + added. Use it to check exactly what changed between two versions instead of eyeballing them. Web version: https://buildutilities.com/text-diff-checker

ParametersafterrequiredbeforerequiredignoreWhitespace

test_regex

Test Regular Expression

Actually execute a regular expression against text and return every match with its index and capture groups. Use this instead of predicting what a pattern matches — reasoning about a regex is not the same as running it. Web version: https://buildutilities.com/regex-tester

ParameterstextrequiredflagspatternrequiredmaxMatches

escape_regex

Escape Regex Literal

Escape a string so it can be used as a literal inside a regular expression.

Parameterstextrequired

analyze_text

Analyze Text

Exact counts for a text: characters, words, lines, sentences, paragraphs, bytes. Use this rather than estimating — counting long text is a classic model failure. Web version: https://buildutilities.com/word-counter

Parameterstextrequired

slugify

Slugify

Turn text into a URL-safe slug, transliterating accents and collapsing separators. Web version: https://buildutilities.com/slug-generator

ParameterstextrequiredmaxLengthseparator

check_color_contrast

Check Colour Contrast

Compute the exact WCAG 2.2 contrast ratio between two colours and report which AA/AAA thresholds it passes. This is a specific formula, not a judgement call — do not estimate it. Web version: https://buildutilities.com/color-contrast-checker

Parametersbackgroundrequiredforegroundrequired

Version history

2
  1. v0.1.3LatestOct 30, 2026
  2. v0.1.2Sep 16, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts
  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts