Buildutilities Mcp

io.github.brentspore由 GitHub 账号 brentspore 发布v0.1.3更新于 Oct 31, 2026

Deterministic dev utilities: UUIDs, hashes, encoding, JWT, cron, regex. No network, no API key.

已验证STDIO仅桌面开发者工具安全与监控

概览

AI 生成的概览

本地运行的确定性开发工具 MCP 服务器：随机 ID 与密码、哈希、HMAC、编码、JWT 解码、cron、正则与文本统计。

可以做什么
  • 用操作系统 CSPRNG 生成随机 UUID、密码和令牌
  • 进行 Base64 与 URL 百分号编码的编解码，并计算 md5/sha1/sha256/sha384/sha512 摘要
  • 对消息做 HMAC 签名，并以恒定时间比对校验签名
  • 在任意 IANA 时区之间转换 Unix 时间戳，并列出 5 段式 cron 表达式的下次运行时间
  • 格式化或压缩 JSON、解码 JWT 头部与载荷、逐行比较两段文本
  • 实际执行正则并返回匹配位置与捕获组、转义正则字面量、统计字符/词/行/字节数、生成 URL slug、检查 WCAG 2.2 颜色对比度
适用场景
适合需要真实随机性、精确摘要或字节级准确编码的任务，也适合需要真正执行正则、统计长文本、做时区与 cron 时间计算的场景，避免模型凭猜测给出看似合理却错误的答案。
运行要求
通过 npx 从 npm 包 buildutilities-mcp 以本地 stdio 进程运行，需要 Node 18 或更高版本。无需 API 密钥、账号、环境变量或网络访问。
安装前请注意
decode_jwt 只做解码、不校验签名，其输出不能当作身份认证依据。md5 与 sha1 仅用于校验和与旧系统兼容，不适合安全用途。生成的密码和令牌会返回给助手并进入对话记录。cron 只接受标准 5 段式语法，夏令时跳变缺口中的时间仍会列出，而真实 cron 实现对此处理不一。

安装

在 SourceWeft 中

  1. 打开 控制台中的 Buildutilities Mcp，将其添加到工作区。
  2. 为需要使用其工具的对话启用该服务。

Desktop only，通过 STDIO。 STDIO 服务会启动本地进程，因此需要 SourceWeft 桌面宿主。

其他 MCP 客户端

参照 仓库 中的启动说明。

README

buildutilities-mcp

Deterministic developer utilities as MCP tools. Runs entirely on your machine — no network calls, no telemetry, no API key, no account.

From the people who make buildutilities.com.

Why these tools and not others

A language model is already good at most text manipulation, and a tool it does not need is a tool that only burns its context window. So this server deliberately covers the operations models are genuinely bad at:

  • Randomness. A model cannot generate it. Ask one for a UUID or a password and you get something drawn from its training distribution — repeatable between sessions, sometimes lifted verbatim from a public code sample. For anything security-adjacent that is a real defect.
  • Exact digests and bytes. It cannot compute a SHA-256, so it invents a plausible one. Base64 of anything it has not effectively memorised comes back quietly corrupted.
  • Running a regex. Asked whether a pattern matches, a model reasons about the pattern instead of executing it, so it reports matches that do not exist and misses ones that do.
  • Precise counting over long text, and calendar arithmetic across timezones and DST — including "when does this cron next fire", which models answer confidently and wrongly.

Everything here is a pure function: same arguments, same answer, no state, no side effects.

Install

Claude Code

bash
claude mcp add buildutilities -- npx -y buildutilities-mcp

Claude Desktop, Cursor, or any client with a JSON config

json
{  "mcpServers": {    "buildutilities": {      "command": "npx",      "args": ["-y", "buildutilities-mcp"]    }  }}

Requires Node 18 or newer. To see the tool list without an MCP client:

bash
npx -y buildutilities-mcp --help

Tools

Randomness a model cannot fake

ToolWhat it does
generate_uuidCryptographically random UUID v4s, via the OS CSPRNG.
generate_passwordRandom password, guaranteeing at least one character from every enabled set.
generate_tokenRandom token for API keys, session ids, nonces and salts — hex, base64url or alphanumeric.

Exact bytes and digests

ToolWhat it does
base64_encodeEncode to Base64, standard or URL-safe.
base64_decodeDecode Base64, reporting invalid input rather than returning mojibake.
url_encodePercent-encode, in component or full-URI mode.
url_decodeDecode percent-encoding, reporting malformed input.
hash_textmd5, sha1, sha256, sha384 or sha512 digest, with a warning on the broken ones.
hmac_signHMAC a message with a secret — webhook and request signing.
hmac_verifyConstant-time check of a message against an expected signature.

Calendar arithmetic

ToolWhat it does
convert_timestampUnix epoch to human time in any IANA timezone; auto-detects seconds vs milliseconds.
cron_next_runsNext run times for a 5-field cron expression, in a timezone.

Documents, tokens, diffs

ToolWhat it does
format_jsonPretty-print or minify JSON exactly, with line and column on a parse error.
decode_jwtRead a JWT's header, payload and expiry. Decodes only — never verifies.
diff_textLine-by-line diff, marking what was added and removed.

Run it, do not predict it

ToolWhat it does
test_regexActually execute a pattern and return every match with its index and capture groups.
escape_regexEscape a string for use as a regex literal.
analyze_textExact character, word, line, sentence, paragraph and byte counts.
slugifyURL-safe slug, transliterating accents.
check_color_contrastExact WCAG 2.2 contrast ratio and which AA/AAA thresholds it passes.

What it does not do

  • It does not verify JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.
  • md5 and sha1 are included but not secure. They are there for checksums and legacy interop, and the tool says so in its output.
  • Cron is standard 5-field only. Non-standard syntax (L, W, #, ?) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disagree about that case.

The no-network claim is tested

Three tests in test/no-network.test.ts enforce it, so it cannot quietly stop being true:

  1. No source file imports node:net, http, https, dns, tls or dgram, or calls fetch.
  2. Running every tool in the catalogue loads no network-related native binding.
  3. The package declares exactly two runtime dependencies (the MCP SDK and zod); adding a third fails the suite and forces a re-check.
bash
npm test    # 48 tests

Licence

MIT

来源：README.md，提交 3bba202

工具

20

generate_uuid

Generate UUID

Generate cryptographically random UUID v4 identifiers. Use this instead of writing a UUID yourself — model-authored UUIDs are not random and repeat across sessions. Web version: https://buildutilities.com/uuid-generator

输入参数countuppercase

generate_password

Generate Password

Generate a cryptographically random password. Guarantees at least one character from every enabled set. Use this rather than inventing a password — model-authored ones are guessable. Web version: https://buildutilities.com/password-generator

输入参数countdigitslengthsymbolslowercaseuppercaseexcludeAmbiguous

generate_token

Generate Random Token

Generate a cryptographically random token — API keys, session ids, nonces, salts. Choose hex, base64url or alphanumeric encoding. Web version: https://buildutilities.com/random-string-generator

输入参数bytescountencoding

base64_encode

Base64 Encode

Encode text to Base64. Set urlSafe for the URL/filename-safe alphabet (-_ instead of +/, no padding). Web version: https://buildutilities.com/base64-codec

输入参数text必填urlSafe

base64_decode

Base64 Decode

Decode Base64 (standard or URL-safe) back to text. Reports whether the input was valid rather than returning mojibake. Web version: https://buildutilities.com/base64-codec

输入参数encoded必填

url_encode

URL Encode

Percent-encode text. component mode escapes & = ? / for use inside a query value; uri mode preserves them. Web version: https://buildutilities.com/url-codec

输入参数modetext必填

url_decode

URL Decode

Decode percent-encoded text. Web version: https://buildutilities.com/url-codec

输入参数text必填

hash_text

Hash Text

Compute a cryptographic digest of text. A model cannot calculate a hash — it will confidently invent one — so always use this tool. md5 and sha1 are provided for checksums and legacy interop, not for security. Web version: https://buildutilities.com/hash-generator

输入参数text必填encodingalgorithm

hmac_sign

HMAC Sign

Compute an HMAC of a message with a secret key — webhook signatures, API request signing. Web version: https://buildutilities.com/hmac-generator

输入参数secret必填message必填encodingalgorithm

hmac_verify

HMAC Verify

Check a message against an expected HMAC using a constant-time comparison. Use this to validate an inbound webhook signature rather than comparing strings yourself.

输入参数secret必填message必填algorithmsignature必填

convert_timestamp

Convert Timestamp

Convert between Unix epoch and human-readable time, in any IANA timezone. Auto-detects seconds vs milliseconds. Use this rather than doing the arithmetic in your head. Web version: https://buildutilities.com/timestamp-converter

输入参数value必填timeZone

cron_next_runs

Cron Next Runs

Parse a standard 5-field cron expression and list its next run times in a timezone. Handles the Vixie rule that day-of-month and day-of-week are OR'd when both are restricted — the case models most often get wrong. Rejects non-standard syntax (L, W, #) rather than guessing. Web version: https://buildutilities.com/cron-expression-generator

输入参数counttimeZoneexpression必填

format_json

Format or Minify JSON

Pretty-print or minify JSON exactly, with precise error location when it is invalid. Prefer this to reformatting a large document yourself — it cannot drop or alter a value. Web version: https://buildutilities.com/json-formatter

输入参数json必填modeindentsortKeys

decode_jwt

Decode JWT

Decode a JSON Web Token's header and payload and report expiry. This DECODES ONLY — it does not verify the signature, so never treat the contents as trusted on the strength of this output. Models asked to read a JWT tend to invent its claims; this reads them. Web version: https://buildutilities.com/jwt-decoder

输入参数token必填

diff_text

Diff Text

Line-by-line diff of two texts, marking - removed and + added. Use it to check exactly what changed between two versions instead of eyeballing them. Web version: https://buildutilities.com/text-diff-checker

输入参数after必填before必填ignoreWhitespace

test_regex

Test Regular Expression

Actually execute a regular expression against text and return every match with its index and capture groups. Use this instead of predicting what a pattern matches — reasoning about a regex is not the same as running it. Web version: https://buildutilities.com/regex-tester

输入参数text必填flagspattern必填maxMatches

escape_regex

Escape Regex Literal

Escape a string so it can be used as a literal inside a regular expression.

输入参数text必填

analyze_text

Analyze Text

Exact counts for a text: characters, words, lines, sentences, paragraphs, bytes. Use this rather than estimating — counting long text is a classic model failure. Web version: https://buildutilities.com/word-counter

输入参数text必填

slugify

Slugify

Turn text into a URL-safe slug, transliterating accents and collapsing separators. Web version: https://buildutilities.com/slug-generator

输入参数text必填maxLengthseparator

check_color_contrast

Check Colour Contrast

Compute the exact WCAG 2.2 contrast ratio between two colours and report which AA/AAA thresholds it passes. This is a specific formula, not a judgement call — do not estimate it. Web version: https://buildutilities.com/color-contrast-checker

输入参数background必填foreground必填

版本历史

2
  1. v0.1.3最新Oct 30, 2026
  2. v0.1.2Sep 16, 2026

评分

已满足适用检查项的 90%

该评分衡量此收录条目的完整程度，依据注册中心条目、端点与公开来源计算得出。它不是对服务器本身的评价，也不表示服务器安全或当前可用：可连通性是带日期的检查结果，评分也不包含安装量或用户评价。

  • 近 30 天内可连通25 分
  • 已声明认证方式10 分

    请在注册中心条目中声明凭据请求头，或保持端点能够响应探测，以便判定其认证方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 图标10 分
  • 文档15 分
  • 许可证10 分