base64_decode
Decode a Base64 string back to plain text.
LABSCO SUMMARY
The conversions a model gets subtly wrong, executed instead of recalled.
A model asked to base64 a string or compute a CIDR range will usually produce something plausible; these tools return the actual value, and jwt_validate is explicit that it checks structure and expiry rather than the signature. Everything runs in-process, so a decoded token or a hashed password never crosses the network.
What it is
A local MCP server holding the small conversions a developer reaches for constantly. Nothing leaves the machine and nothing calls an external API: hashes, encodings, IDs, JWT inspection, JSON handling, CIDR maths and text transforms all execute in the server process.
What you get
- hash_md5, hash_sha1, hash_sha256, hash_sha512, hash_bcrypt and hash_bcrypt_verify — digests of a string, plus bcrypt hashing and verification
- base64_encode, base64_decode, url_encode, url_decode, html_encode, html_decode, hex_encode and hex_decode — the four encoding pairs in both directions
- generate_uuid, generate_nanoid, generate_password and generate_random_hex — a cryptographically secure UUID v4, a compact URL-friendly ID, a configurable password, and random hex of a given byte length
- jwt_decode and jwt_validate — read a token's header and payload without verifying the signature, and check its format, Base64URL encoding, JSON validity and expiry
- json_format, json_validate and json_path_query — pretty-print or minify, report parse errors with their approximate location, and pull a value out by dot-notation path
- timestamp_to_date, date_to_timestamp, number_base_convert, color_convert and byte_convert — Unix time in both directions, any base from 2 to 36, HEX/RGB/HSL, and byte units in binary or SI
- cidr_calculate and ip_validate — network, broadcast, host range and host count from a CIDR, and an address classified by type, class and scope
- text_stats, lorem_ipsum, case_convert, slugify, regex_test and text_diff — counts and reading time, placeholder text, casing styles, URL slugs, pattern matches with groups and indices, and a line-by-line diff
Requirements
Node.js 18 or newer. Clients run it with npx -y devutils-mcp-server over stdio; a Docker image and a Cursor plugin are available too. No account, no key, no network access.
Setup effort
One command — npx -y devutils-mcp-server
USE CASES
01
Debugging an auth problem
Decode the token to see its claims, then check whether it is well-formed and still valid.
02
Working out a subnet
Turn a CIDR into its network, broadcast, host range and count, and classify an address against it.
03
Cleaning up a payload
Validate the JSON, pretty-print it, and pull out the one field you need by path.
04
Seeding test data
Generate UUIDs, a strong password and some placeholder prose in one pass.
05
Turning a title into a URL
Slugify the string, or convert it between casing styles for a code identifier.
36 tools
Counted once with only startup setup. Other versions, modes or optional credentials may expose a different list.
base64_encode
Encode a string to Base64.
byte_convert
Convert between byte units (B, KB, MB, GB, TB, PB). Supports both binary (1024) and SI (1000) standards.
case_convert
Convert a string between different casing styles: camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE, Title Case, and more.
cidr_calculate
Calculate network details from a CIDR notation (e.g., '192.168.1.0/24'). Returns network address, broadcast, host range, and host count.
color_convert
Convert colors between HEX, RGB, and HSL formats.
date_to_timestamp
Convert a date string to a Unix timestamp. Accepts ISO 8601 and common date formats.
generate_nanoid
Generate a NanoID — a compact, URL-friendly unique ID.
generate_password
Generate a secure random password with configurable options.
generate_random_hex
Generate a random hexadecimal string of the specified byte length.
generate_uuid
Generate a cryptographically secure UUID v4.
hash_bcrypt
Generate a bcrypt hash of the given input string. Useful for password hashing.
hash_bcrypt_verify
Verify a string against a bcrypt hash. Returns true if matches.
hash_md5
Generate an MD5 hash of the given input string.
hash_sha1
Generate a SHA-1 hash of the given input string.
hash_sha256
Generate a SHA-256 hash of the given input string.
hash_sha512
Generate a SHA-512 hash of the given input string.
hex_decode
Decode a hexadecimal string back to plain text.
hex_encode
Encode a string to its hexadecimal representation.
html_decode
Decode HTML entities in a string back to their original characters.
html_encode
Encode special characters in a string to HTML entities.
ip_validate
Validate and classify an IPv4 or IPv6 address. Returns type, class, scope, and whether it's private/loopback/multicast.
json_format
Format (pretty-print) a JSON string with configurable indentation. Can also minify JSON.
json_path_query
Extract a value from a JSON object using a dot-notation path (e.g., 'user.address.city' or 'items[0].name').
json_validate
Validate a JSON string and report any parsing errors with their approximate location.
jwt_decode
Decode a JWT (JSON Web Token) and display its header and payload without verifying the signature. Useful for debugging and inspecting tokens.
jwt_validate
Validate the structure of a JWT. Checks format, Base64URL encoding, JSON validity, and expiration status. Does NOT verify the cryptographic signature.
lorem_ipsum
Generate Lorem Ipsum placeholder text.
number_base_convert
Convert a number between different bases (binary, octal, decimal, hexadecimal, or any base 2-36).
regex_test
Test a regular expression pattern against an input string. Returns all matches with groups and indices.
slugify
Convert a string to a URL-friendly slug. Removes special characters, replaces spaces with hyphens, and lowercases everything.
text_diff
Compare two strings and show a simple line-by-line diff. Lines prefixed with '+' are additions, '-' are deletions, ' ' are unchanged.
text_stats
Analyze text and return detailed statistics: character count, word count, line count, sentence count, paragraph count, and reading time.
timestamp_to_date
Convert a Unix timestamp (seconds or milliseconds) to a human-readable ISO 8601 date string.
url_decode
Decode a URL-encoded string.
url_encode
URL-encode a string (percent-encoding).
BEFORE YOU INSTALL
What to know first
Tools you get
36 tools when we connected.
Requires
npx on PATH
CONTEXT COST
Moderate Standing cost
Rated by the size of the 36 tool definitions that ride along on every turn, not by how many there are
INSTALLATION
Connect your client
Server setup
TERMINAL
npx -y devutils-mcp-serverMCP Clients
Cursor, Claude Desktop, Windsurf
JSON
{
"mcpServers": {
"devutils": {
"command": "npx",
"args": [
"-y",
"devutils-mcp-server"
]
}
}
}Claude Desktop — Docker
CLAUDE DESKTOP — DOCKER · JSON
{
"mcpServers": {
"devutils": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"ghcr.io/paladini/devutils-mcp-server"
]
}
}
}Claude Code
CLAUDE CODE · IN CLIENT
/plugin marketplace add paladini/devutils-cursor-plugin
/plugin install devutils-mcp@devutils-cursor-pluginVS Code
VS CODE · JSON
{
"servers": {
"devutils": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"devutils-mcp-server"
]
}
}
}
