A model asked to base64 a string or compute a CIDR range will usually produce something plausible; these tools return the actual value, and jwt_validate is explicit that it checks structure and expiry rather than the signature. Everything runs in-process, so a decoded token or a hashed password never crosses the network.
A local MCP server holding the small conversions a developer reaches for constantly. Nothing leaves the machine and nothing calls an external API: hashes, encodings, IDs, JWT inspection, JSON handling, CIDR maths and text transforms all execute in the server process.
- hash_md5, hash_sha1, hash_sha256, hash_sha512, hash_bcrypt and hash_bcrypt_verify — digests of a string, plus bcrypt hashing and verification
- base64_encode, base64_decode, url_encode, url_decode, html_encode, html_decode, hex_encode and hex_decode — the four encoding pairs in both directions
- generate_uuid, generate_nanoid, generate_password and generate_random_hex — a cryptographically secure UUID v4, a compact URL-friendly ID, a configurable password, and random hex of a given byte length
- jwt_decode and jwt_validate — read a token's header and payload without verifying the signature, and check its format, Base64URL encoding, JSON validity and expiry
- json_format, json_validate and json_path_query — pretty-print or minify, report parse errors with their approximate location, and pull a value out by dot-notation path
- timestamp_to_date, date_to_timestamp, number_base_convert, color_convert and byte_convert — Unix time in both directions, any base from 2 to 36, HEX/RGB/HSL, and byte units in binary or SI
- cidr_calculate and ip_validate — network, broadcast, host range and host count from a CIDR, and an address classified by type, class and scope
- text_stats, lorem_ipsum, case_convert, slugify, regex_test and text_diff — counts and reading time, placeholder text, casing styles, URL slugs, pattern matches with groups and indices, and a line-by-line diff
Node.js 18 or newer. Clients run it with npx -y devutils-mcp-server over stdio; a Docker image and a Cursor plugin are available too. No account, no key, no network access.
One command — npx -y devutils-mcp-server