geekutil-devtools-mcp

A local-only developer toolbox exposed over the Model Context Protocol.

Give your AI agent JWT verification, JSON formatting, hashing, key generation, cron parsing and more — without your tokens, keys or payloads ever leaving your machine.

• Zero network calls. Enforced by a test that poisons net, tls, http, https and fetch and then runs every tool.
• No telemetry, no analytics, no accounts, no API keys.
• Real cryptography, via Node's built-in crypto — not a reimplementation.
• Explicit warnings where behaviour is ambiguous, instead of silently guessing.

Why

Most MCP servers are remote. Paste a JWT into one and you have handed a stranger your session claims — a JWT is Base64-encoded, not encrypted, so anyone receiving it can read the payload.

This package runs in-process. Your secrets stay in your process.

Install

npx -y geekutil-devtools-mcp

That is the whole installation. No API key, no account, no npm install first.

Claude Code / Claude Desktop

claude mcp add devtools -- npx -y geekutil-devtools-mcp

Or via config:

{
  "mcpServers": {
    "geekutil-devtools": {
      "command": "npx",
      "args": ["-y", "geekutil-devtools-mcp"]
    }
  }
}

Cursor / Windsurf / VS Code

Use the same command / args pair in your MCP client config.

Tools

| Tool | What it does | |---|---| | jwt_verify | Verify signatures locally. HS256/384/512 via secret; RS/PS/ES 256/384/512 via PEM public key. Checks exp/nbf. | | jwt_decode | Read header and payload. Explicitly does not imply trust. | | jwt_sign | Sign tokens for tests (HS*, RS*, PS*, ES*). | | json_format | Format, minify, sort, validate or repair JSON. Repair flags every change it makes. | | json_path | Extract a value via $.a.b[0].c. | | json_diff | Report added / removed / changed paths between two documents. | | base64_encode / base64_decode | Standard or URL-safe, UTF-8 / hex / latin1 output. | | url_encode / url_decode | Explicit form (+ for space) vs uri (%20) semantics. Warns on double-encoding. | | url_parse | Break a URL into parts. Parsing only — never requests it. | | html_escape | Escape for HTML body, attribute, or JS string context. | | hash_text | MD5 / SHA-1 / SHA-2 / SHA-3. Warns loudly when you pick a broken algorithm. | | hmac_sign | Message authentication. | | hash_password | scrypt or PBKDF2 with a random salt. The correct answer for passwords. | | generate_key | CSPRNG keys and UUIDs / ULIDs / nanoids, with an entropy estimate. | | cron_describe | Plain-English explanation plus next run times. | | cron_build | Assemble and validate an expression from fields. | | timestamp_convert | Unix ⇄ date. Catches the seconds-vs-milliseconds mistake. | | duration_parse | 2h30m → seconds. | | regex_test | All matches with capture groups. Bounded to survive catastrophic backtracking. | | regex_explain | Break a pattern into explained tokens. |

Design notes

Why JWT verification is the centrepiece. An agent can format JSON or encode Base64 unaided. It cannot reliably compute an HMAC or check an ECDSA signature — that needs byte-exact arithmetic. That is where a tool earns its place.

Why warnings are part of the output. hash_text with MD5 still returns the digest, plus a note that MD5 is broken. cron_describe warns when both day-of-month and day-of-week are restricted, because standard cron ORs them. Silent wrong answers are worse than none.

Why the regex tool is bounded. Caller-supplied patterns against long input can backtrack exponentially. The loop has a step budget and reports failure rather than hanging your agent.

Development

npm install
npm test        # builds, then runs unit + no-network tests
node test/e2e-stdio.test.js   # drives the real JSON-RPC transport

License

MIT. Companion to geekutil.com.