English Français العربية

io.github.brentspore/buildutilities-mcp

Official registry Other

Deterministic dev utilities: UUIDs, hashes, encoding, JWT, cron, regex. No network, no API key.

Source code Website Documentation

What can you do with io.github.brentspore/buildutilities-mcp?

  • It does not verify JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.
  • md5 and sha1 are included but not secure. They are there for checksums and legacy interop, and the tool says so in its output.
  • Cron is standard 5-field only. Non-standard syntax (L, W, #, ?) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disag...

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package buildutilities-mcp
Claude Code 
claude mcp add buildutilities-mcp -- npx -y buildutilities-mcp@0.1.3
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "buildutilities-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "buildutilities-mcp@0.1.3"
            ]
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. buildutilities-mcp
  2. Why these tools and not others
  3. Install
  4. Tools
  5. What it does not do
  6. The no-network claim is tested
  7. Licence

buildutilities-mcp

Deterministic developer utilities as MCP tools. Runs entirely on your machine — no network calls, no telemetry, no API key, no account.

From the people who make buildutilities.com.

Why these tools and not others

A language model is already good at most text manipulation, and a tool it does not need is a tool that only burns its context window. So this server deliberately covers the operations models are genuinely bad at:

  • Randomness. A model cannot generate it. Ask one for a UUID or a password and you get something drawn from its training distribution — repeatable between sessions, sometimes lifted verbatim from a public code sample. For anything security-adjacent that is a real defect.
  • Exact digests and bytes. It cannot compute a SHA-256, so it invents a plausible one. Base64 of anything it has not effectively memorised comes back quietly corrupted.
  • Running a regex. Asked whether a pattern matches, a model reasons about the pattern instead of executing it, so it reports matches that do not exist and misses ones that do.
  • Precise counting over long text, and calendar arithmetic across timezones and DST — including "when does this cron next fire", which models answer confidently and wrongly.

Everything here is a pure function: same arguments, same answer, no state, no side effects.

Install

Claude Code

claude mcp add buildutilities -- npx -y buildutilities-mcp

Claude Desktop, Cursor, or any client with a JSON config

{
  "mcpServers": {
    "buildutilities": {
      "command": "npx",
      "args": ["-y", "buildutilities-mcp"]
    }
  }
}

Requires Node 18 or newer. To see the tool list without an MCP client:

npx -y buildutilities-mcp --help

Tools

Randomness a model cannot fake

ToolWhat it does
generate_uuidCryptographically random UUID v4s, via the OS CSPRNG.
generate_passwordRandom password, guaranteeing at least one character from every enabled set.
generate_tokenRandom token for API keys, session ids, nonces and salts — hex, base64url or alphanumeric.

Exact bytes and digests

ToolWhat it does
base64_encodeEncode to Base64, standard or URL-safe.
base64_decodeDecode Base64, reporting invalid input rather than returning mojibake.
url_encodePercent-encode, in component or full-URI mode.
url_decodeDecode percent-encoding, reporting malformed input.
hash_textmd5, sha1, sha256, sha384 or sha512 digest, with a warning on the broken ones.
hmac_signHMAC a message with a secret — webhook and request signing.
hmac_verifyConstant-time check of a message against an expected signature.

Calendar arithmetic

ToolWhat it does
convert_timestampUnix epoch to human time in any IANA timezone; auto-detects seconds vs milliseconds.
cron_next_runsNext run times for a 5-field cron expression, in a timezone.

Documents, tokens, diffs

ToolWhat it does
format_jsonPretty-print or minify JSON exactly, with line and column on a parse error.
decode_jwtRead a JWT's header, payload and expiry. Decodes only — never verifies.
diff_textLine-by-line diff, marking what was added and removed.

Run it, do not predict it

ToolWhat it does
test_regexActually execute a pattern and return every match with its index and capture groups.
escape_regexEscape a string for use as a regex literal.
analyze_textExact character, word, line, sentence, paragraph and byte counts.
slugifyURL-safe slug, transliterating accents.
check_color_contrastExact WCAG 2.2 contrast ratio and which AA/AAA thresholds it passes.

What it does not do

  • It does not verify JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never trust its output as authentication.
  • md5 and sha1 are included but not secure. They are there for checksums and legacy interop, and the tool says so in its output.
  • Cron is standard 5-field only. Non-standard syntax (L, W, #, ?) is refused rather than guessed at, because a plausible wrong schedule is worse than an error. Times inside a DST spring-forward gap are still listed; real cron implementations disagree about that case.

The no-network claim is tested

Three tests in test/no-network.test.ts enforce it, so it cannot quietly stop being true:

  1. No source file imports node:net, http, https, dns, tls or dgram, or calls fetch.
  2. Running every tool in the catalogue loads no network-related native binding.
  3. The package declares exactly two runtime dependencies (the MCP SDK and zod); adding a third fails the suite and forces a re-check.
npm test    # 48 tests

Licence

MIT

Frequently asked questions

What is io.github.brentspore/buildutilities-mcp?

Deterministic dev utilities: UUIDs, hashes, encoding, JWT, cron, regex. No network, no API key.

How do I install io.github.brentspore/buildutilities-mcp?

It runs on your machine. In Claude Code: claude mcp add buildutilities-mcp -- npx -y buildutilities-mcp@0.1.3. For other clients, paste the JSON configuration from this page into their MCP settings.

Does io.github.brentspore/buildutilities-mcp need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is io.github.brentspore/buildutilities-mcp open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains io.github.brentspore/buildutilities-mcp?

It is published by brentspore. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.