Buildutilities Mcp

io.github.brentspore由 GitHub 帳號 brentspore 發布v0.1.3更新於 Oct 31, 2026

Deterministic dev utilities: UUIDs, hashes, encoding, JWT, cron, regex. No network, no API key.

已驗證STDIO僅桌面開發者工具安全與監控

概覽

AI 產生的概覽

在本機執行的確定性開發工具 MCP 伺服器：隨機 ID 與密碼、雜湊、HMAC、編碼、JWT 解碼、cron、正規表示式與文字統計。

可以做什麼
  • 以作業系統 CSPRNG 產生隨機 UUID、密碼與權杖
  • 進行 Base64 與 URL 百分比編碼的編解碼，並計算 md5/sha1/sha256/sha384/sha512 摘要
  • 對訊息做 HMAC 簽章，並以固定時間比對驗證簽章
  • 在任意 IANA 時區之間轉換 Unix 時間戳，並列出 5 欄位 cron 運算式的下次執行時間
  • 格式化或壓縮 JSON、解碼 JWT 標頭與內容、逐行比對兩段文字
  • 實際執行正規表示式並回傳符合位置與擷取群組、跳脫正規表示式字面值、統計字元/詞/行/位元組數、產生 URL slug、檢查 WCAG 2.2 顏色對比度
適用情境
適合需要真正隨機性、精確摘要或位元組準確編碼的任務，也適合需要實際執行正規表示式、統計長文字、處理時區與 cron 時間運算的情境，避免模型憑猜測給出看似合理卻錯誤的答案。
執行需求
透過 npx 從 npm 套件 buildutilities-mcp 以本機 stdio 程序執行，需要 Node 18 或更新版本。不需要 API 金鑰、帳號、環境變數或網路存取。
安裝前請注意
decode_jwt 只做解碼、不驗證簽章，其輸出不可當作身分驗證依據。md5 與 sha1 僅供校驗碼與舊系統相容使用，不適合安全用途。產生的密碼與權杖會回傳給助理並進入對話紀錄。cron 只接受標準 5 欄位語法，日光節約時間跳躍缺口中的時間仍會列出，而實際 cron 實作對此處理不一致。

安裝

在 SourceWeft 中

  1. 開啟 儀表板中的 Buildutilities Mcp，將其新增到工作區。
  2. 為需要使用其工具的對話啟用該服務。

Desktop only，透過 STDIO。 STDIO 服務會啟動本機處理程序，因此需要 SourceWeft 桌面主機。

其他 MCP 客戶端

參照 儲存庫 中的啟動說明。

README

buildutilities-mcp

Deterministic developer utilities as MCP tools. Runs entirely on your machine — no network calls, no telemetry, no API key, no account.

From the people who make buildutilities.com.

Why these tools and not others

A language model is already good at most text manipulation, and a tool it does not need is a tool that only burns its context window. So this server deliberately covers the operations models are genuinely bad at:

  • Randomness. A model cannot generate it. Ask one for a UUID or a password and you get something drawn from its training distribution — repeatable between sessions, sometimes lifted verbatim from a public code sample. For anything security-adjacent that is a real defect.
  • Exact digests and bytes. It cannot compute a SHA-256, so it invents a plausible one. Base64 of anything it has not effectively memorised comes back quietly corrupted.
  • Running a regex. Asked whether a pattern matches, a model reasons about the pattern instead of executing it, so it reports matches that do not exist and misses ones that do.
  • Precise counting over long text, and calendar arithmetic across timezones and DST — including "when does this cron next fire", which models answer confidently and wrongly.

Everything here is a pure function: same arguments, same answer, no state, no side effects.

Install

Claude Code

bash
claude mcp add buildutilities -- npx -y buildutilities-mcp

Claude Desktop, Cursor, or any client with a JSON config

json
{  "mcpServers": {    "buildutilities": {      "command": "npx",      "args": ["-y", "buildutilities-mcp"]    }  }}

Requires Node 18 or newer. To see the tool list without an MCP client:

bash
npx -y buildutilities-mcp --help

Tools

Randomness a model cannot fake

ToolWhat it does
generate_uuidCryptographically random UUID v4s, via the OS CSPRNG.
generate_passwordRandom password, guaranteeing at least one character from every enabled set.
generate_tokenRandom token for API keys, session ids, nonces and salts — hex, base64url or alphanumeric.

Exact bytes and digests

ToolWhat it does
base64_encodeEncode to Base64, standard or URL-safe.
base64_decodeDecode Base64, reporting invalid input rather than returning mojibake.
url_encodePercent-encode, in component or full-URI mode.
url_decodeDecode percent-encoding, reporting malformed input.
hash_textmd5, sha1, sha256, sha384 or sha512 digest, with a warning on the broken ones.
hmac_signHMAC a message with a secret — webhook and request signing.
hmac_verifyConstant-time check of a message against an expected signature.

Calendar arithmetic

ToolWhat it does
convert_timestampUnix epoch to human time in any IANA timezone; auto-detects seconds vs milliseconds.
cron_next_runsNext run times for a 5-field cron expression, in a timezone.

Documents, tokens, diffs

ToolWhat it does
format_jsonPretty-print or minify JSON exactly, with line and column on a parse error.
decode_jwtRead a JWT's header, payload and expiry. Decodes only — never verifies.
diff_textLine-by-line diff, marking what was added and removed.

Run it, do not predict it

ToolWhat it does
test_regexActually execute a pattern and return every match with its index and capture groups.
escape_regexEscape a string for use as a regex literal.
analyze_textExact character, word, line, sentence, paragraph and byte counts.
slugifyURL-safe slug, transliterating accents.
check_color_contrastExact WCAG 2.2 contrast ratio and which AA/AAA thresholds it passes.

What it does not do

  • It does not verify JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.
  • md5 and sha1 are included but not secure. They are there for checksums and legacy interop, and the tool says so in its output.
  • Cron is standard 5-field only. Non-standard syntax (L, W, #, ?) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disagree about that case.

The no-network claim is tested

Three tests in test/no-network.test.ts enforce it, so it cannot quietly stop being true:

  1. No source file imports node:net, http, https, dns, tls or dgram, or calls fetch.
  2. Running every tool in the catalogue loads no network-related native binding.
  3. The package declares exactly two runtime dependencies (the MCP SDK and zod); adding a third fails the suite and forces a re-check.
bash
npm test    # 48 tests

Licence

MIT

來源：README.md，提交 3bba202

工具

20

generate_uuid

Generate UUID

Generate cryptographically random UUID v4 identifiers. Use this instead of writing a UUID yourself — model-authored UUIDs are not random and repeat across sessions. Web version: https://buildutilities.com/uuid-generator

輸入參數countuppercase

generate_password

Generate Password

Generate a cryptographically random password. Guarantees at least one character from every enabled set. Use this rather than inventing a password — model-authored ones are guessable. Web version: https://buildutilities.com/password-generator

輸入參數countdigitslengthsymbolslowercaseuppercaseexcludeAmbiguous

generate_token

Generate Random Token

Generate a cryptographically random token — API keys, session ids, nonces, salts. Choose hex, base64url or alphanumeric encoding. Web version: https://buildutilities.com/random-string-generator

輸入參數bytescountencoding

base64_encode

Base64 Encode

Encode text to Base64. Set urlSafe for the URL/filename-safe alphabet (-_ instead of +/, no padding). Web version: https://buildutilities.com/base64-codec

輸入參數text必填urlSafe

base64_decode

Base64 Decode

Decode Base64 (standard or URL-safe) back to text. Reports whether the input was valid rather than returning mojibake. Web version: https://buildutilities.com/base64-codec

輸入參數encoded必填

url_encode

URL Encode

Percent-encode text. component mode escapes & = ? / for use inside a query value; uri mode preserves them. Web version: https://buildutilities.com/url-codec

輸入參數modetext必填

url_decode

URL Decode

Decode percent-encoded text. Web version: https://buildutilities.com/url-codec

輸入參數text必填

hash_text

Hash Text

Compute a cryptographic digest of text. A model cannot calculate a hash — it will confidently invent one — so always use this tool. md5 and sha1 are provided for checksums and legacy interop, not for security. Web version: https://buildutilities.com/hash-generator

輸入參數text必填encodingalgorithm

hmac_sign

HMAC Sign

Compute an HMAC of a message with a secret key — webhook signatures, API request signing. Web version: https://buildutilities.com/hmac-generator

輸入參數secret必填message必填encodingalgorithm

hmac_verify

HMAC Verify

Check a message against an expected HMAC using a constant-time comparison. Use this to validate an inbound webhook signature rather than comparing strings yourself.

輸入參數secret必填message必填algorithmsignature必填

convert_timestamp

Convert Timestamp

Convert between Unix epoch and human-readable time, in any IANA timezone. Auto-detects seconds vs milliseconds. Use this rather than doing the arithmetic in your head. Web version: https://buildutilities.com/timestamp-converter

輸入參數value必填timeZone

cron_next_runs

Cron Next Runs

Parse a standard 5-field cron expression and list its next run times in a timezone. Handles the Vixie rule that day-of-month and day-of-week are OR'd when both are restricted — the case models most often get wrong. Rejects non-standard syntax (L, W, #) rather than guessing. Web version: https://buildutilities.com/cron-expression-generator

輸入參數counttimeZoneexpression必填

format_json

Format or Minify JSON

Pretty-print or minify JSON exactly, with precise error location when it is invalid. Prefer this to reformatting a large document yourself — it cannot drop or alter a value. Web version: https://buildutilities.com/json-formatter

輸入參數json必填modeindentsortKeys

decode_jwt

Decode JWT

Decode a JSON Web Token's header and payload and report expiry. This DECODES ONLY — it does not verify the signature, so never treat the contents as trusted on the strength of this output. Models asked to read a JWT tend to invent its claims; this reads them. Web version: https://buildutilities.com/jwt-decoder

輸入參數token必填

diff_text

Diff Text

Line-by-line diff of two texts, marking - removed and + added. Use it to check exactly what changed between two versions instead of eyeballing them. Web version: https://buildutilities.com/text-diff-checker

輸入參數after必填before必填ignoreWhitespace

test_regex

Test Regular Expression

Actually execute a regular expression against text and return every match with its index and capture groups. Use this instead of predicting what a pattern matches — reasoning about a regex is not the same as running it. Web version: https://buildutilities.com/regex-tester

輸入參數text必填flagspattern必填maxMatches

escape_regex

Escape Regex Literal

Escape a string so it can be used as a literal inside a regular expression.

輸入參數text必填

analyze_text

Analyze Text

Exact counts for a text: characters, words, lines, sentences, paragraphs, bytes. Use this rather than estimating — counting long text is a classic model failure. Web version: https://buildutilities.com/word-counter

輸入參數text必填

slugify

Slugify

Turn text into a URL-safe slug, transliterating accents and collapsing separators. Web version: https://buildutilities.com/slug-generator

輸入參數text必填maxLengthseparator

check_color_contrast

Check Colour Contrast

Compute the exact WCAG 2.2 contrast ratio between two colours and report which AA/AAA thresholds it passes. This is a specific formula, not a judgement call — do not estimate it. Web version: https://buildutilities.com/color-contrast-checker

輸入參數background必填foreground必填

版本歷史

2
  1. v0.1.3最新Oct 30, 2026
  2. v0.1.2Sep 16, 2026

評分

已滿足適用檢查項的 90%

該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。

  • 近 30 天內可連通25 分
  • 已宣告認證方式10 分

    請在註冊中心條目中宣告憑證請求標頭，或保持端點能夠回應探測，以便判定其認證方式。

  • 已列出工具必需15 分
  • 描述必需15 分
  • 圖示10 分
  • 文件15 分
  • 授權條款10 分