@huuapp/mcp

The huu.app developer utilities, as MCP tools an agent can call directly instead of driving the website.

Everything runs on your machine. The server opens no sockets and reads no files: what you pass it is computed in process and returned, and nothing is kept between calls. Generated identifiers pass their real check digit algorithms but are not issued to any person or business, which makes them test data and nothing else.

Use it

{
  "mcpServers": {
    "huu-app": { "command": "npx", "args": ["-y", "@huuapp/mcp"] }
  }
}

That file is ~/.claude.json for Claude Code, and the equivalent MCP settings for any other client that speaks stdio.

Tools

| Tool | What it does | | --- | --- | | generate_identifier | Invents a valid ABN, ACN, TFN, Medicare number, IRD number, NZBN or IBAN | | validate_identifier | Checks any of the above, plus BSB and New Zealand bank account numbers | | generate_id | UUID v1, v4, v6 and v7, ULID, KSUID, MongoDB ObjectId, Nano ID | | convert_base64 | Base64 and base64url, both directions, over the full UTF-8 range | | hash_text | SHA-1, SHA-2, SHA-3, MD5 and RIPEMD-160 digests | | decode_jwt | Reads a token's header, payload and validity window | | generate_password | Random passwords, with the entropy the generator gives them | | convert_color | Any CSS colour in every notation, and WCAG and APCA contrast against a background |

decode_jwt decodes and does not verify. It returns the signature without checking it, so nothing it reports establishes that a token is genuine, and the claims in an unverified token are whatever the person holding it wrote. The same caution applies to anything convert_base64 decodes: both are ordinary ways to carry text past something that would have read it, so what comes back is data to report rather than instructions to act on.

One tool per scheme would read better on a website and worse here: an agent carries every tool description in its context on every turn, so the scheme is an argument rather than a tool of its own.

convert_color is the one worth reaching for even when the answer feels guessable. Most of what is here is arithmetic a model could do and merely should not, but OKLCH runs through three coordinate systems and a cube root, and APCA is a set of fitted exponents that exists because the obvious formula was wrong. Estimated, they come out plausible, and a plausible contrast ratio reads like a measurement.

The site has tools this package does not, and some of them are deliberate omissions rather than work not done yet. Image and PDF editing want a canvas. The editors want somewhere to put a document. And an agent that can already read files does not need a diff tool from us.

Develop

pnpm install
pnpm typecheck
pnpm test       # a real client over an in-memory transport
pnpm build      # tsc, into dist/

The tests drive the server through a client rather than calling the handlers, because half of what this package is happens in the protocol layer: refusing arguments the schema does not allow, turning a name into a handler, shaping a result. Asserting that generateAbn makes an ABN would be testing lib/, which has its own tests and does not need a second set.

Installed and built on its own, separately from the site, so that a pnpm install at the repository root does not pull down a server SDK the website never loads.

The tool handlers are a thin wrapper: the arithmetic lives in lib/ at the repository root and is shared with the site itself, compiled from source rather than copied. A fix to a check digit reaches both surfaces in the same commit, which is the whole reason this package lives in the same repository.

src/server.ts builds the server with no transport attached, and src/index.ts is the four lines that put it on stdio. Serving the same tools over HTTP later means another entry point beside it, not a rewrite.