buildutilities-mcp

Deterministic developer utilities as MCP tools. Runs entirely on your machine — no network calls, no telemetry, no API key, no account.

From the people who make buildutilities.com.

Why these tools and not others

A language model is already good at most text manipulation, and a tool it does not need is a tool that only burns its context window. So this server deliberately covers the operations models are genuinely bad at:

Randomness. A model cannot generate it. Ask one for a UUID or a password and you get something drawn from its training distribution — repeatable between sessions, sometimes lifted verbatim from a public code sample. For anything security-adjacent that is a real defect.
Exact digests and bytes. It cannot compute a SHA-256, so it invents a plausible one. Base64 of anything it has not effectively memorised comes back quietly corrupted.
Running a regex. Asked whether a pattern matches, a model reasons about the pattern instead of executing it, so it reports matches that do not exist and misses ones that do.
Precise counting over long text, and calendar arithmetic across timezones and DST — including "when does this cron next fire", which models answer confidently and wrongly.

Everything here is a pure function: same arguments, same answer, no state, no side effects.

Install

Claude Code

Terminal

claude mcp add buildutilities -- npx -y buildutilities-mcp

Claude Desktop, Cursor, or any client with a JSON config

config.json

{
  "mcpServers": {
    "buildutilities": {
      "command": "npx",
      "args": ["-y", "buildutilities-mcp"]
    }
  }
}

Requires Node 18 or newer. To see the tool list without an MCP client:

Terminal

npx -y buildutilities-mcp --help

Tools

Randomness a model cannot fake

Tool	What it does
`generate_uuid`	Cryptographically random UUID v4s, via the OS CSPRNG.
`generate_password`	Random password, guaranteeing at least one character from every enabled set.
`generate_token`	Random token for API keys, session ids, nonces and salts — hex, base64url or alphanumeric.

Exact bytes and digests

Tool	What it does
`base64_encode`	Encode to Base64, standard or URL-safe.
`base64_decode`	Decode Base64, reporting invalid input rather than returning mojibake.
`url_encode`	Percent-encode, in component or full-URI mode.
`url_decode`	Decode percent-encoding, reporting malformed input.
`hash_text`	md5, sha1, sha256, sha384 or sha512 digest, with a warning on the broken ones.
`hmac_sign`	HMAC a message with a secret — webhook and request signing.
`hmac_verify`	Constant-time check of a message against an expected signature.

Calendar arithmetic

Tool	What it does
`convert_timestamp`	Unix epoch to human time in any IANA timezone; auto-detects seconds vs milliseconds.
`cron_next_runs`	Next run times for a 5-field cron expression, in a timezone.

Documents, tokens, diffs

Tool	What it does
`format_json`	Pretty-print or minify JSON exactly, with line and column on a parse error.
`decode_jwt`	Read a JWT's header, payload and expiry. Decodes only — never verifies.
`diff_text`	Line-by-line diff, marking what was added and removed.

Run it, do not predict it

Tool	What it does
`test_regex`	Actually execute a pattern and return every match with its index and capture groups.
`escape_regex`	Escape a string for use as a regex literal.
`analyze_text`	Exact character, word, line, sentence, paragraph and byte counts.
`slugify`	URL-safe slug, transliterating accents.
`check_color_contrast`	Exact WCAG 2.2 contrast ratio and which AA/AAA thresholds it passes.

What it does not do

It does not verify JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.
md5 and sha1 are included but not secure. They are there for checksums and legacy interop, and the tool says so in its output.
Cron is standard 5-field only. Non-standard syntax (L, W, #, ?) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disagree about that case.

The no-network claim is tested

Three tests in test/no-network.test.ts enforce it, so it cannot quietly stop being true:

No source file imports node:net, http, https, dns, tls or dgram, or calls fetch.
Running every tool in the catalogue loads no network-related native binding.
The package declares exactly two runtime dependencies (the MCP SDK and zod); adding a third fails the suite and forces a re-check.

Terminal

npm test    # 48 tests

Licence

MIT