@mate-tools/mcp-server

Model Context Protocol server for mate.tools. 35 utility tools for AI agents — text analysis, encoding, hashing, password generation, JSON/CSV/XML/sitemap parsing, regex, color, date, finance, URL metadata extraction, SEO meta-tag generation, text cleanup, CSPRNG random generators, hashtag tools, DNS lookup, SSL/TLS certificate inspection, JWT decoding and more. Wraps the public mate.tools JSON API so Claude Desktop, Claude Code, Cursor, Windsurf, and any other MCP-compatible client can call them directly.

Zero dependencies · Free · No API key · CORS open · Node 18+

Quick install

Add this to your Claude Desktop / Claude Code / Cursor / Windsurf config:

{
  "mcpServers": {
    "mate-tools": {
      "command": "npx",
      "args": ["-y", "@mate-tools/mcp-server"]
    }
  }
}

Restart your client and all 35 tools appear in the picker. That's it.

All 35 tools, by category

Text (8)

| Tool | What it does | | --- | --- | | count_lines | 16 text metrics: lines, words, sentences, paragraphs, characters, duplicates, line endings (LF/CRLF/CR), longest word, reading & speaking time. | | case_convert | Convert text into 9 case styles in one call: upper, lower, title, sentence, snake, kebab, camel, pascal, constant. | | slugify | Convert any text to a URL-safe slug. Unicode-aware, configurable separator/length, optional transliteration of non-Latin characters. | | sort_lines | Sort lines: asc/desc, case-sensitivity, dedupe, natural-sort (line2 before line10), locale-aware collation. | | lorem_ipsum | Generate placeholder text — paragraphs, sentences or words. | | regex_test | Match / replace / split text with a PCRE regex. Returns capture-group offsets. ReDoS-protected. | | text_diff | Diff two strings by line, word or character. Returns structured changes + unified diff string + Jaccard similarity. | | text_cleanup | Chained cleanup pipeline: trim, collapse_spaces, dedupe_lines, strip HTML/emoji/URLs/emails, normalize quotes/dashes, lower/uppercase. |

Encoding (4)

| Tool | What it does | | --- | --- | | base64_encode | Base64-encode text. Standard or URL-safe alphabet (RFC 4648 §5). | | base64_decode | Base64-decode. Auto-fixes missing padding; returns hex when not valid UTF-8. | | url_encode | Percent-encode a string. Component / form / path mode. | | url_decode | Decode percent-encoded URL strings. |

Crypto & auth (5)

| Tool | What it does | | --- | --- | | hash | MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, CRC32 (or any subset of PHP's hash algorithms). | | password | Generate cryptographically random passwords (CSPRNG). Configurable length, count, character classes, ambiguous-char exclusion. Reports entropy. | | password_strength | Score a password 0–4 (zxcvbn-style), entropy bits, offline-GPU crack-time estimate, concerns and suggestions. | | credit_card_validate | Luhn check + brand detection (Visa, MC, Amex, Discover, JCB, Diners, UnionPay, Maestro, RuPay). PAN never logged. | | jwt_decode | Decode a JWT — header, payload, expiry status. Verify HS256/384/512 with a secret or RS256/384/512 with a PEM public key. Token never logged. |

Data & structure (13)

| Tool | What it does | | --- | --- | | json_format | Validate, pretty-print, minify or analyse a JSON document. Returns structural summary (node counts, max depth, top keys). | | json_to_csv | Convert a JSON array of objects to CSV. Configurable delimiter, columns, optional flattening of nested objects (meta.city, meta.zip). | | xml_validate | Validate XML well-formedness + optional XSD schema. Errors with line/column. XXE-safe. | | sitemap_extract | Fetch + parse XML sitemaps. SSRF-protected (refuses private/loopback/link-local/cloud-metadata IPs). Optional recursive expansion of sub-sitemaps. | | stats | Descriptive statistics for a list of numbers: mean / median / mode / stddev / variance / percentiles / IQR / geometric / harmonic. | | number_base | Convert integers between bases 2..36 + Roman numerals. Big-int safe via GMP. | | finance_calc | Multi-mode financial calculations: loan, compound interest, simple interest, discount, tip, sales tax, ROI, percentage, markup. | | aspect_ratio | Compute reduced aspect ratio (16:9, 4:3, 21:9, ...) from width × height, or scale a dimension to a target ratio. | | color_convert | Convert any color into hex / rgb / rgba / hsl / hsv / cmyk + closest named color + WCAG luminance and contrast (AA / AAA flags). | | url_metadata | Fetch a URL and extract title / description / OpenGraph / Twitter Card / canonical / language / hreflang / JSON-LD / favicon / response headers / element counts. SSRF-protected, 2 MB cap. | | meta_tags_generate | Generate a full HTML head block (meta + OpenGraph + Twitter Card + JSON-LD) from title/description/url/image. Returns ready-to-paste HTML + SEO score 0-100 with concrete warnings. | | dns_lookup | Resolve DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR, SRV) via the system resolver. Includes reverse PTR for A records. | | ssl_check | Inspect a domain's TLS certificate: subject, issuer, validity, fingerprint, alt names, full chain, days remaining, negotiated protocol/cipher. SSRF-protected. |

Date & time (3)

| Tool | What it does | | --- | --- | | timestamp | Bidirectional epoch ↔ ISO 8601 ↔ RFC 3339 ↔ human. Auto-detects epoch resolution. Timezone-aware. Accepts natural language ("next monday", "+2 weeks"). | | date_math | Add/subtract a duration from a date, or compute the diff between two dates. Optional business-day count (Mon–Fri). | | age_calc | Calculate age in years/months/days from DOB. Returns next birthday, days until, Western zodiac sign, generation label. |

Generators & social (2)

| Tool | What it does | | --- | --- | | random_gen | CSPRNG-backed generator: number, string (alpha/alphanumeric/numeric/hex/base58/base64url), word, picker (with/without replacement), team balancer, dice (NdM), coin, country, UUID v4 / v7. | | hashtag_tools | Hashtag operations on text: extract (with offsets), remove, generate (stop-word-filtered word frequency), format (camel/snake/lower/preserve). Unicode-aware. |

The catalog grows over time. npx -y always fetches the latest published version — your client just needs a restart to pick up new tools.

Install snippets for every major client

Claude Desktop

Open the Claude Desktop config:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json
• Linux: ~/.config/Claude/claude_desktop_config.json

Add the mcpServers entry from the Quick install above and restart.

Claude Code

claude mcp add mate-tools npx -- -y @mate-tools/mcp-server

Cursor

Add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "mate-tools": {
      "command": "npx",
      "args": ["-y", "@mate-tools/mcp-server"]
    }
  }
}

Windsurf and other MCP clients

The server speaks MCP over stdio with the standard JSON-RPC 2.0 framing. Any MCP-compatible client can launch it as a subprocess with the same configuration shape.

Manual install (no npx)

npm install -g @mate-tools/mcp-server
mate-tools-mcp   # speaks JSON-RPC over stdio; plug into a client

How to verify it's working

Once installed, ask your AI agent any of these to confirm the tools are wired:

"Use mate-tools to count the lines and reading time of this paragraph."

"Hash the string secret with SHA-256."

"Generate 10 strong passwords, 20 chars, no ambiguous characters."

"Score this password: correct horse battery staple."

"Convert #ff5733 to all color spaces and tell me the WCAG contrast vs white."

"What's the aspect ratio of 3840 × 2160?"

"Diff these two paragraphs for me."

"What's the monthly payment on a $300k loan at 6.5% APR over 30 years?"

"How old is someone born on 1990-04-15? What's their zodiac sign?"

"Extract all URLs from https://example.com/sitemap.xml recursively."

"Fetch the metadata and OpenGraph tags from https://example.com for me."

"Generate SEO meta tags for an article titled … and score the result."

"Roll 4d6 drop lowest, six times, for me."

"Suggest hashtags for this caption."

"Look up the MX and TXT records for example.com."

"Is the SSL certificate on github.com valid? When does it expire?"

"Decode this JWT and tell me if it's expired."

The agent will pick the right tool automatically.

How it works

The server is a single ~600-line zero-dependency Node script. Every tool call:

1. Receives a JSON-RPC tools/call request from the MCP client.
2. Forwards the arguments to the public mate.tools API at https://mate.tools/api/v1/{tool}.php.
3. Returns a human-readable summary plus the full JSON response back to the client.

Nothing runs locally besides the JSON-RPC plumbing. Computation runs on mate.tools' servers behind Cloudflare. Every endpoint is rate-limited at 60 req/min and 600 req/hour per IP.

Configuration

Override the API endpoint (e.g. for testing against a staging deployment):

MATE_TOOLS_API_BASE=https://staging.mate.tools/api/v1 npx -y @mate-tools/mcp-server

Privacy

Each tool call:

• ✅ Sends only the arguments you provide to the MCP tool.
• ✅ Hits HTTPS in transit.
• ✅ Is processed in memory and not logged with content.
• ❌ Does not collect telemetry.
• ❌ Does not require an account, API key or sign-in.

The mate.tools server logs only request method, hashed-IP (rotating daily salt), endpoint name and duration — never request content.

credit_card_validate and password_strength are explicitly engineered so the sensitive input never leaves request-handler memory. Only the validation outcome and metrics are returned.

sitemap_extract, url_metadata, and ssl_check refuse to fetch / connect to any host whose name resolves to a private (RFC 1918), loopback, link-local, or cloud-metadata IP. For HTTP-based tools, each redirect destination is re-validated, so SSRF tricks via 302 don't work. url_metadata additionally caps the response body at 2 MB. ssl_check uses a 5-second connect timeout.

jwt_decode never logs the token. Decoding runs entirely in request-handler memory; only the algorithm name, signature verification outcome, and request duration are written to the per-day access log. Use it confidently with production tokens.

regex_test enforces a hard PCRE backtrack ceiling (100,000 steps) per request — catastrophic regex patterns return a clean 422 rather than hanging the server.

random_gen is backed by PHP's random_int / random_bytes (CSPRNG) — never the Mersenne Twister. UUIDs are RFC 4122 v4 with proper version/variant bits, or v7 with millisecond-precision timestamp.

Source and documentation

• npm: https://www.npmjs.com/package/@mate-tools/mcp-server
• Source code (single file): https://mate.tools/api/mcp/server.js
• Install guide with screenshots: https://mate.tools/api/mcp
• JSON API reference: https://mate.tools/api
• OpenAPI 3.1 spec: https://mate.tools/api/openapi.json
• llms.txt: https://mate.tools/llms.txt

Issues / feedback

Open an issue at the mate.tools contact form — please mention "@mate-tools/mcp-server" in the subject line. New tools land roughly every 1–2 weeks; if there's a specific utility you want exposed, just ask.

License

MIT — free for personal and commercial use. See LICENSE.