MCP Server

20 of these utilities, available to Claude Code, Claude Desktop, Cursor and anything else that speaks the Model Context Protocol. It runs on your machine — no network calls, no telemetry, no API key, no account.

Nothing leaves your machine

Every tool is a pure function running locally. Three tests in the package enforce that: no source file may import a network module or call fetch, running the whole catalogue must load no network binding, and the dependency list is pinned to two entries so adding a third fails the suite.

Why these tools and not all of them

A model is already good at most text manipulation, and a tool it does not need only takes up room in its context window. So this is deliberately not every tool on the site — it is the subset covering the things models are genuinely bad at: producing real randomness, computing an exact digest, moving bytes without corrupting them, running a regex rather than reasoning about one, counting precisely, and doing calendar arithmetic.

Install

Claude Code

claude mcp add buildutilities -- npx -y buildutilities-mcp

Claude Desktop, Cursor, or any client with a JSON config

{
  "mcpServers": {
    "buildutilities": {
      "command": "npx",
      "args": ["-y", "buildutilities-mcp"]
    }
  }
}

Requires Node 18 or newer. Source and full documentation are on GitHub.

The 20 tools

Randomness a model cannot fake

A language model cannot produce randomness. Ask one for a UUID and you get something shaped like a UUID, drawn from its training data — repeatable between sessions, and occasionally lifted verbatim from a public code sample.

generate_uuid

Cryptographically random UUID v4s from the OS entropy source.

generate_password

Random passwords guaranteeing one character from every enabled set.

generate_token

API keys, session ids, nonces and salts in hex, base64url or alphanumeric.

Exact bytes and digests

Hashing and encoding are byte-exact. A model cannot compute a SHA-256, so it invents a plausible one, and it quietly corrupts Base64 for anything it has not effectively memorised.

base64_encode

Encode to Base64, standard or URL-safe.

base64_decode

Decode Base64, reporting invalid input rather than returning mojibake.

url_encode

Percent-encode, in component or full-URI mode.

url_decode

Decode percent-encoding, reporting malformed input.

hash_text

md5, sha1, sha256, sha384 or sha512, with a warning on the broken ones.

hmac_sign

HMAC a message with a secret — webhook and request signing.

hmac_verify

Constant-time check of a message against an expected signature.

Calendar arithmetic

Timezone and cron maths is where models answer confidently and wrongly, especially across a DST boundary.

convert_timestamp

Unix epoch to human time in any IANA timezone; detects seconds vs milliseconds.

cron_next_runs

Next run times for a 5-field cron expression, in a timezone.

Documents, tokens and diffs

Pushing a large document through a model to reformat it costs context and risks a silently dropped key or altered number.

format_json

Pretty-print or minify exactly, with line and column on a parse error.

decode_jwt

Read a JWT's header, payload and expiry. Decodes only — never verifies.

diff_text

Line-by-line diff marking what was added and removed.

Run it, do not predict it

Asked whether a pattern matches, a model reasons about the pattern instead of executing it — so it reports matches that do not exist and misses ones that do. Precise counting fails the same way.

test_regex

Actually execute a pattern and return every match with index and capture groups.

escape_regex

Escape a string for use as a regex literal.

analyze_text

Exact character, word, line, sentence, paragraph and byte counts.

slugify

URL-safe slug, transliterating accents.

check_color_contrast

Exact WCAG 2.2 contrast ratio and which AA/AAA thresholds it passes.

What it deliberately does not do

It never verifies JWT signatures. decode_jwt reads a token; it cannot tell you the token is genuine. Never treat its output as authentication.
md5 and sha1 are included but are not secure. They are there for checksums and legacy interop, and the tool says so in its own output.
Cron is standard five-field only. Non-standard syntax (L, W, #) is refused rather than guessed at, because a plausible wrong schedule is worse than an error.