io.github.brentspore/buildutilities-mcp

buildutilities-mcp

Deterministic developer utilities as MCP tools. Runs entirely on your machine — no network calls, no telemetry, no API key, no account.

From the people who make buildutilities.com.

Why these tools and not others

A language model is already good at most text manipulation, and a tool it does not need is a tool that only burns its context window. So this server deliberately covers the operations models are genuinely bad at:

• Randomness. A model cannot generate it. Ask one for a UUID or a password and you get something drawn from its training distribution — repeatable between sessions, sometimes lifted verbatim from a public code sample. For anything security-adjacent that is a real defect.
• Exact digests and bytes. It cannot compute a SHA-256, so it invents a plausible one. Base64 of anything it has not effectively memorised comes back quietly corrupted.
• Running a regex. Asked whether a pattern matches, a model reasons about the pattern instead of executing it, so it reports matches that do not exist and misses ones that do.
• Precise counting over long text, and calendar arithmetic across timezones and DST — including "when does this cron next fire", which models answer confidently and wrongly.

Everything here is a pure function: same arguments, same answer, no state, no side effects.

Install

Claude Code

claude mcp add buildutilities -- npx -y buildutilities-mcp

Claude Desktop, Cursor, or any client with a JSON config

{
  "mcpServers": {
    "buildutilities": {
      "command": "npx",
      "args": ["-y", "buildutilities-mcp"]
    }
  }
}

Requires Node 18 or newer. To see the tool list without an MCP client:

npx -y buildutilities-mcp --help

Tools

Randomness a model cannot fake

Exact bytes and digests

Calendar arithmetic

Documents, tokens, diffs

Run it, do not predict it

What it does not do

• It does not verify JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.
• md5 and sha1 are included but not secure. They are there for checksums and legacy interop, and the tool says so in its output.
• Cron is standard 5-field only. Non-standard syntax (L, W, #, ?) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disagree about that case.

The no-network claim is tested

Three tests in test/no-network.test.ts enforce it, so it cannot quietly stop being true:

1. No source file imports node:net, http, https, dns, tls or dgram, or calls fetch.
2. Running every tool in the catalogue loads no network-related native binding.
3. The package declares exactly two runtime dependencies (the MCP SDK and zod); adding a third fails the suite and forces a re-check.

npm test    # 48 tests

Licence

MIT