Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
@mate-tools/mcp-server
Model Context Protocol server for mate.tools. 35 utility tools for AI agents — text analysis, encoding, hashing, password generation, JSON/CSV/XML/sitemap parsing, regex, color, date, finance, URL metadata extraction, SEO meta-tag generation, text cleanup, CSPRNG random generators, hashtag tools, DNS lookup, SSL/TLS certificate inspection, JWT decoding and more. Wraps the public mate.tools JSON API so Claude Desktop, Claude Code, Cursor, Windsurf, and any other MCP-compatible client can call them directly.
Zero dependencies · Free · No API key · CORS open · Node 18+
Quick install
Add this to your Claude Desktop / Claude Code / Cursor / Windsurf config:
{
"mcpServers": {
"mate-tools": {
"command": "npx",
"args": ["-y", "@mate-tools/mcp-server"]
}
}
}Restart your client and all 35 tools appear in the picker. That's it.
All 35 tools, by category
Text (8)
| Tool | What it does |
|---|---|
count_lines | 16 text metrics: lines, words, sentences, paragraphs, characters, duplicates, line endings (LF/CRLF/CR), longest word, reading & speaking time. |
case_convert | Convert text into 9 case styles in one call: upper, lower, title, sentence, snake, kebab, camel, pascal, constant. |
slugify | Convert any text to a URL-safe slug. Unicode-aware, configurable separator/length, optional transliteration of non-Latin characters. |
sort_lines | Sort lines: asc/desc, case-sensitivity, dedupe, natural-sort (line2 before line10), locale-aware collation. |
lorem_ipsum | Generate placeholder text — paragraphs, sentences or words. |
regex_test | Match / replace / split text with a PCRE regex. Returns capture-group offsets. ReDoS-protected. |
text_diff | Diff two strings by line, word or character. Returns structured changes + unified diff string + Jaccard similarity. |
text_cleanup | Chained cleanup pipeline: trim, collapse_spaces, dedupe_lines, strip HTML/emoji/URLs/emails, normalize quotes/dashes, lower/uppercase. |
Encoding (4)
| Tool | What it does |
|---|---|
base64_encode | Base64-encode text. Standard or URL-safe alphabet (RFC 4648 §5). |
base64_decode | Base64-decode. Auto-fixes missing padding; returns hex when not valid UTF-8. |
url_encode | Percent-encode a string. Component / form / path mode. |
url_decode | Decode percent-encoded URL strings. |
Crypto & auth (5)
| Tool | What it does |
|---|---|
hash | MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-512, CRC32 (or any subset of PHP's hash algorithms). |
password | Generate cryptographically random passwords (CSPRNG). Configurable length, count, character classes, ambiguous-char exclusion. Reports entropy. |
password_strength | Score a password 0–4 (zxcvbn-style), entropy bits, offline-GPU crack-time estimate, concerns and suggestions. |
credit_card_validate | Luhn check + brand detection (Visa, MC, Amex, Discover, JCB, Diners, UnionPay, Maestro, RuPay). PAN never logged. |
jwt_decode | Decode a JWT — header, payload, expiry status. Verify HS256/384/512 with a secret or RS256/384/512 with a PEM public key. Token never logged. |
Data & structure (13)
| Tool | What it does |
|---|---|
json_format | Validate, pretty-print, minify or analyse a JSON document. Returns structural summary (node counts, max depth, top keys). |
json_to_csv | Convert a JSON array of objects to CSV. Configurable delimiter, columns, optional flattening of nested objects (meta.city, meta.zip). |
xml_validate | Validate XML well-formedness + optional XSD schema. Errors with line/column. XXE-safe. |
sitemap_extract | Fetch + parse XML sitemaps. SSRF-protected (refuses private/loopback/link-local/cloud-metadata IPs). Optional recursive expansion of sub-sitemaps. |
stats | Descriptive statistics for a list of numbers: mean / median / mode / stddev / variance / percentiles / IQR / geometric / harmonic. |
number_base | Convert integers between bases 2..36 + Roman numerals. Big-int safe via GMP. |
finance_calc | Multi-mode financial calculations: loan, compound interest, simple interest, discount, tip, sales tax, ROI, percentage, markup. |
aspect_ratio | Compute reduced aspect ratio (16:9, 4:3, 21:9, ...) from width × height, or scale a dimension to a target ratio. |
color_convert | Convert any color into hex / rgb / rgba / hsl / hsv / cmyk + closest named color + WCAG luminance and contrast (AA / AAA flags). |
url_metadata | Fetch a URL and extract title / description / OpenGraph / Twitter Card / canonical / language / hreflang / JSON-LD / favicon / response headers / element counts. SSRF-protected, 2 MB cap. |
meta_tags_generate | Generate a full HTML head block (meta + OpenGraph + Twitter Card + JSON-LD) from title/description/url/image. Returns ready-to-paste HTML + SEO score 0-100 with concrete warnings. |
dns_lookup | Resolve DNS records (A, AAAA, MX, TXT, NS, CNAME, SOA, CAA, PTR, SRV) via the system resolver. Includes reverse PTR for A records. |
ssl_check | Inspect a domain's TLS certificate: subject, issuer, validity, fingerprint, alt names, full chain, days remaining, negotiated protocol/cipher. SSRF-protected. |
Date & time (3)
| Tool | What it does |
|---|---|
timestamp | Bidirectional epoch ↔ ISO 8601 ↔ RFC 3339 ↔ human. Auto-detects epoch resolution. Timezone-aware. Accepts natural language ("next monday", "+2 weeks"). |
date_math | Add/subtract a duration from a date, or compute the diff between two dates. Optional business-day count (Mon–Fri). |
age_calc | Calculate age in years/months/days from DOB. Returns next birthday, days until, Western zodiac sign, generation label. |
Generators & social (2)
| Tool | What it does |
|---|---|
random_gen | CSPRNG-backed generator: number, string (alpha/alphanumeric/numeric/hex/base58/base64url), word, picker (with/without replacement), team balancer, dice (NdM), coin, country, UUID v4 / v7. |
hashtag_tools | Hashtag operations on text: extract (with offsets), remove, generate (stop-word-filtered word frequency), format (camel/snake/lower/preserve). Unicode-aware. |
The catalog grows over time. npx -y always fetches the latest published version — your client just needs a restart to pick up new tools.
Install snippets for every major client
Claude Desktop
Open the Claude Desktop config:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json - Linux:
~/.config/Claude/claude_desktop_config.json
Add the mcpServers entry from the Quick install above and restart.
Claude Code
claude mcp add mate-tools npx -- -y @mate-tools/mcp-serverCursor
Add to ~/.cursor/mcp.json:
{
"mcpServers": {
"mate-tools": {
"command": "npx",
"args": ["-y", "@mate-tools/mcp-server"]
}
}
}Windsurf and other MCP clients
The server speaks MCP over stdio with the standard JSON-RPC 2.0 framing. Any MCP-compatible client can launch it as a subprocess with the same configuration shape.
Manual install (no npx)
npm install -g @mate-tools/mcp-server
mate-tools-mcp # speaks JSON-RPC over stdio; plug into a clientHow to verify it's working
Once installed, ask your AI agent any of these to confirm the tools are wired:
"Use mate-tools to count the lines and reading time of this paragraph."
>
"Hash the string secret with SHA-256.">
"Generate 10 strong passwords, 20 chars, no ambiguous characters."
>
"Score this password: correct horse battery staple.">
"Convert #ff5733 to all color spaces and tell me the WCAG contrast vs white.">
"What's the aspect ratio of 3840 × 2160?"
>
"Diff these two paragraphs for me."
>
"What's the monthly payment on a $300k loan at 6.5% APR over 30 years?"
>
"How old is someone born on 1990-04-15? What's their zodiac sign?"
>
"Extract all URLs from https://example.com/sitemap.xml recursively.">
"Fetch the metadata and OpenGraph tags from https://example.com for me.">
"Generate SEO meta tags for an article titled … and score the result.">
"Roll 4d6 drop lowest, six times, for me."
>
"Suggest hashtags for this caption."
>
"Look up the MX and TXT records for example.com."
>
"Is the SSL certificate on github.com valid? When does it expire?"
>
"Decode this JWT and tell me if it's expired."
The agent will pick the right tool automatically.
How it works
The server is a single ~600-line zero-dependency Node script. Every tool call:
- Receives a JSON-RPC
tools/callrequest from the MCP client. - Forwards the arguments to the public mate.tools API at
https://mate.tools/api/v1/{tool}.php. - Returns a human-readable summary plus the full JSON response back to the client.
Nothing runs locally besides the JSON-RPC plumbing. Computation runs on mate.tools' servers behind Cloudflare. Every endpoint is rate-limited at 60 req/min and 600 req/hour per IP.
Configuration
Override the API endpoint (e.g. for testing against a staging deployment):
MATE_TOOLS_API_BASE=https://staging.mate.tools/api/v1 npx -y @mate-tools/mcp-serverPrivacy
Each tool call:
- ✅ Sends only the arguments you provide to the MCP tool.
- ✅ Hits HTTPS in transit.
- ✅ Is processed in memory and not logged with content.
- ❌ Does not collect telemetry.
- ❌ Does not require an account, API key or sign-in.
The mate.tools server logs only request method, hashed-IP (rotating daily salt), endpoint name and duration — never request content.
credit_card_validate and password_strength are explicitly engineered so the sensitive input never leaves request-handler memory. Only the validation outcome and metrics are returned.
sitemap_extract, url_metadata, and ssl_check refuse to fetch / connect to any host whose name resolves to a private (RFC 1918), loopback, link-local, or cloud-metadata IP. For HTTP-based tools, each redirect destination is re-validated, so SSRF tricks via 302 don't work. url_metadata additionally caps the response body at 2 MB. ssl_check uses a 5-second connect timeout.
jwt_decode never logs the token. Decoding runs entirely in request-handler memory; only the algorithm name, signature verification outcome, and request duration are written to the per-day access log. Use it confidently with production tokens.
regex_test enforces a hard PCRE backtrack ceiling (100,000 steps) per request — catastrophic regex patterns return a clean 422 rather than hanging the server.
random_gen is backed by PHP's random_int / random_bytes (CSPRNG) — never the Mersenne Twister. UUIDs are RFC 4122 v4 with proper version/variant bits, or v7 with millisecond-precision timestamp.
Source and documentation
- npm: <https://www.npmjs.com/package/@mate-tools/mcp-server>
- Source code (single file): <https://mate.tools/api/mcp/server.js>
- Install guide with screenshots: <https://mate.tools/api/mcp>
- JSON API reference: <https://mate.tools/api>
- OpenAPI 3.1 spec: <https://mate.tools/api/openapi.json>
- llms.txt: <https://mate.tools/llms.txt>
Issues / feedback
Open an issue at the mate.tools contact form — please mention "@mate-tools/mcp-server" in the subject line. New tools land roughly every 1–2 weeks; if there's a specific utility you want exposed, just ask.
License
MIT — free for personal and commercial use. See LICENSE.