An identifier a language model makes up is not random, and a digest it compares by reading is not constant-time — these tools exist so those operations come from the platform crypto source instead. The gating is the other reason to look: the two tools that probe the host are absent from the tool list entirely until you turn them on, and private and loopback targets stay blocked behind a second flag even then, so a shared instance exposes no SSRF surface by default.
Five always-on utilities, plus two host-probing tools that stay unregistered until you enable them: cryptographic digests and constant-time comparison, CSPRNG identifiers, QR encoding, base64/hex/URL transcoding, and IP geolocation with the SSRF checks done properly.
- A cryptographic digest generated — sha256, sha512, sha1 or md5 — or a value compared against an expected digest in constant time
- Cryptographically random identifiers from the platform CSPRNG — UUIDv4, UUIDv7 or ULID — singly or in batches up to 1000, which is the right source for an ID a model must not invent
- Text or a URL encoded as a QR code: SVG markup, base64 PNG, or a string a terminal can render
- Values encoded and decoded across base64, base64url, hex and URL percent-encoding, in either direction
- A public IP or hostname resolved to country, region, city, coordinates, ASN, owning organisation and timezone — with the resolved IP echoed back, the answering provider named, and missing upstream fields reported as unknown rather than filled in
- Read-only network diagnostics from the server host — ping, traceroute, TCP connectivity, egress IP — behind an explicit flag, off by default
- The host's OS, CPU, memory, load average or network interfaces — behind a second explicit flag, also off by default
- Failures that carry a typed reason and a recovery hint, and an unreachable host that comes back as unreachable data rather than an exception
Bun 1.3.0 or newer, or Node.js 24 and above. No API key: the five always-on tools work immediately and geolocation defaults to the keyless ip-api tier, cached and capped at 45 requests a minute to match that tier's limit. A public hosted instance exists at https://toolkit.caseyjhand.com/mcp over Streamable HTTP if you would rather not run one. Locally it speaks stdio, or HTTP bound to 127.0.0.1 on port 3010 at /mcp with authentication selectable as none, jwt or oauth. The two host-probing tools are fail-closed — absent from the tool list until TOOLKIT_ENABLE_NET_DIAGNOSTICS or TOOLKIT_ENABLE_SYSTEM_INFO is set — and even with diagnostics on, private, reserved, loopback and link-local targets stay blocked until TOOLKIT_ALLOW_PRIVATE_NETWORK is set as well.
One command — npx -y @cyanheads/toolkit-mcp-server