@utilix-tech/mcp 0.18.0 → 0.20.0

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.20.0
+- Add `detect_redos` tool: statically analyze a regex for ReDoS (catastrophic-backtracking) risk.
+
+## 0.19.0
+- Added `calculate_time_value` (present/future value) and `vector_similarity` tools.
+
 ## 0.18.0
 - Added `parse_user_agent` and `parse_github_url` tools.
 

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 125 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 128 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -149,7 +149,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `date_diff` | Calculate the difference between two dates |
 | `convert_timezone` | Convert a date/time between timezones |
 
-### Units (11 tools)
+### Units (12 tools)
 | Tool | Description |
 |------|-------------|
 | `convert_bytes` | Convert between B, KB, MB, GB, TB, KiB, MiB, GiB, TiB |
@@ -163,6 +163,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `validate_isbn` | Validate an ISBN-10 or ISBN-13 checksum and convert it to the other format where possible |
 | `calculate_tip_split` | Compute a tip on a bill amount and split the bill, tip, and total evenly across N people |
 | `calculate_simple_interest` | Compute simple (non-compounding) interest as principal x rate x time, plus the total payoff |
+| `calculate_time_value` | Convert between present and future value (time value of money) in either direction |
 
 ### API / Network (9 tools)
 | Tool | Description |
@@ -185,7 +186,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (9 tools)
+### Code (10 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -197,6 +198,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_docker_image` | Parse a Docker image reference into its components |
 | `lookup_mime` | Look up the MIME type for a file extension, or the extension(s) for a MIME type |
 | `parse_github_url` | Parse a github.com URL (repo, pull request, issue, commit, file, or release) into structured components |
+| `detect_redos` | Statically flag catastrophic-backtracking (ReDoS) risk in a regex: nested quantifiers, overlapping alternation, adjacent overlapping quantifiers |
 
 ### Data (6 tools)
 | Tool | Description |
@@ -221,7 +223,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `unicode_inspect` | Inspect Unicode code points of a string |
 | `optimize_svg` | Optimize and minify an SVG string |
 
-### AI / Agent (25 tools)
+### AI / Agent (26 tools)
 | Tool | Description |
 |------|-------------|
 | `estimate_tokens` | Estimate token count and cost for an LLM prompt |
@@ -249,6 +251,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `compress_markdown` | Compress Markdown for LLM context budgets |
 | `compress_json` | Compress JSON for LLM context budgets |
 | `diff_json_detailed` | Diff two parsed JSON values, returning every path with its op and unchanged paths |
+| `vector_similarity` | Cosine similarity, dot product, and Euclidean / Manhattan distance between two numeric vectors |
 
 ### Image (3 tools)
 | Tool | Description |

package/dist/index.js

@@ -74,7 +74,7 @@ import { formatSql, formatHtml, testRegex, minifyJs, formatGql, parseDockerImage
 import { validateYaml, tomlToJson, xmlToJson, parseCsv } from "@utilix-tech/sdk/data";
 import { generateGradient, minifyCss } from "@utilix-tech/sdk/css";
 import { optimizeSvg, charToCodePoint, numberToWords } from "@utilix-tech/sdk/misc";
-import { estimateTokens, estimateCost, detectPii, redactPii, detectSecrets, detectPromptInjection, repairJson, trimToTokens, chunkText, extractUrls, sanitizeHtml, flattenJson, unflattenJson, mergeJson, extractJson, deduplicateLines, extractKeywords, validateJsonSchema, diffJson as diffJsonDetailed, extractTables, extractEntities, compressHtml, compressMarkdown, compressJson, rerankChunks, scoreRelevance, expandQuery, summarizeForLlm } from "@utilix-tech/sdk/ai_agent";
+import { estimateTokens, estimateCost, detectPii, redactPii, detectSecrets, detectPromptInjection, repairJson, trimToTokens, chunkText, extractUrls, sanitizeHtml, flattenJson, unflattenJson, mergeJson, extractJson, deduplicateLines, extractKeywords, validateJsonSchema, diffJson as diffJsonDetailed, extractTables, extractEntities, compressHtml, compressMarkdown, compressJson, rerankChunks, scoreRelevance, expandQuery, summarizeForLlm, vectorSimilarity } from "@utilix-tech/sdk/ai_agent";
 var CRON_DAY_MAP = {
   SUN: "0",
   MON: "1",
@@ -1140,6 +1140,11 @@ server.tool("score_relevance", "Score a passage relevance to a query (0-1 score
 server.tool("expand_query", "Expand a search query with synonyms and stemmed variants for better retrieval.", { query: z.string(), max_synonyms: z.number().int().min(1).max(5).default(2) }, async ({ query, max_synonyms }) => {
   return { content: [{ type: "text", text: JSON.stringify(expandQuery(query, max_synonyms), null, 2) }] };
 });
+server.tool("vector_similarity", "Compute cosine similarity, dot product, Euclidean distance, and Manhattan distance between two equal-length numeric vectors (e.g. embeddings from an external model).", { a: z.array(z.number()), b: z.array(z.number()) }, async ({ a, b }) => {
+  const result = vectorSimilarity(a, b);
+  if ("error" in result) return errText(result);
+  return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+});
 server.tool("summarize_for_llm", "Extractive summarization: pick key sentences to fit a token budget.", { text: z.string(), max_tokens: z.number().int().min(10).default(200), strategy: z.enum(["extractive", "first", "last"]).default("extractive") }, async ({ text: text2, max_tokens, strategy }) => {
   return { content: [{ type: "text", text: JSON.stringify(summarizeForLlm(text2, max_tokens, strategy), null, 2) }] };
 });
@@ -2295,6 +2300,55 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+function _calculateTimeValueMcp(amount, annualRatePercent, years, direction, compoundsPerYear = 1) {
+  if (!Number.isFinite(amount) || amount < 0) return { error: "Amount must be zero or a positive number" };
+  if (!Number.isFinite(annualRatePercent) || annualRatePercent < 0) return { error: "Annual interest rate must be zero or a positive number" };
+  if (!Number.isFinite(years) || years <= 0) return { error: "Years must be a positive number" };
+  if (!Number.isInteger(compoundsPerYear) || compoundsPerYear <= 0) return { error: "Compounding frequency must be a positive whole number of periods per year" };
+  if (direction !== "future" && direction !== "present") return { error: 'Direction must be "future" or "present"' };
+  const round2 = (n) => Math.round(n * 100) / 100;
+  const round6 = (n) => Math.round(n * 1e6) / 1e6;
+  const ratePerPeriod = annualRatePercent / 100 / compoundsPerYear;
+  const totalPeriods = years * compoundsPerYear;
+  const growthFactor = Math.pow(1 + ratePerPeriod, totalPeriods);
+  let presentValue;
+  let futureValue;
+  if (direction === "future") {
+    presentValue = amount;
+    futureValue = amount * growthFactor;
+  } else {
+    futureValue = amount;
+    presentValue = amount / growthFactor;
+  }
+  return {
+    direction,
+    annualRatePercent,
+    years,
+    compoundsPerYear,
+    totalPeriods,
+    ratePerPeriodPercent: round6(ratePerPeriod * 100),
+    growthFactor: round6(growthFactor),
+    presentValue: round2(presentValue),
+    futureValue: round2(futureValue),
+    interest: round2(futureValue - presentValue)
+  };
+}
+server.tool(
+  "calculate_time_value",
+  'Convert between present and future value (time value of money). With direction "future" the amount is a present value grown to its future value at the given annual rate; with direction "present" it is a future value discounted back to present value. Compounds compoundsPerYear times per year (1 = annually).',
+  {
+    amount: z.number().describe('The known value: a present value when direction is "future", or a future value when direction is "present"'),
+    annualRatePercent: z.number().describe("Annual interest / discount rate as a percent, e.g. 5"),
+    years: z.number().describe("Number of years, may be fractional"),
+    direction: z.enum(["future", "present"]).describe("Whether to grow the amount to a future value or discount it to a present value"),
+    compoundsPerYear: z.number().int().default(1).describe("Compounding periods per year (1 = annually)")
+  },
+  async ({ amount, annualRatePercent, years, direction, compoundsPerYear }) => {
+    const result = _calculateTimeValueMcp(amount, annualRatePercent, years, direction, compoundsPerYear);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var _BASE58_ALPHABET_MCP = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 var _BASE62_ALPHABET_MCP = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
 function _encodeBytesToBaseMcp(bytes, alphabet) {
@@ -3407,5 +3461,258 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _REDOS_UNBOUNDED_MCP = /* @__PURE__ */ new Set(["*", "+"]);
+var _REDOS_ALPHABET_MCP = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_ 	.,-@/:;#%&=";
+function _redosParseQuantMcp(src, i) {
+  const ch = src[i];
+  if (ch === "*" || ch === "+" || ch === "?") {
+    let end = i + 1;
+    if (src[end] === "?" || src[end] === "+") end++;
+    return { unbounded: _REDOS_UNBOUNDED_MCP.has(ch), raw: src.slice(i, end), end };
+  }
+  if (ch === "{") {
+    const close = src.indexOf("}", i);
+    if (close === -1) return null;
+    const inner = src.slice(i + 1, close);
+    if (!/^\d+(,\d*)?$/.test(inner)) return null;
+    let end = close + 1;
+    if (src[end] === "?" || src[end] === "+") end++;
+    return { unbounded: /^\d+,$/.test(inner), raw: src.slice(i, end), end };
+  }
+  return null;
+}
+function _redosParseAlternationMcp(src, start, endExclusive) {
+  const alternatives = [];
+  let current = [];
+  let i = start;
+  while (i < endExclusive) {
+    const ch = src[i];
+    if (ch === "|") {
+      alternatives.push(current);
+      current = [];
+      i++;
+      continue;
+    }
+    let node;
+    if (ch === "\\") {
+      const atomEnd = i + 2 <= endExclusive ? i + 2 : i + 1;
+      node = { kind: "char", start: i, end: atomEnd, quant: null, quantEnd: atomEnd, raw: src.slice(i, atomEnd) };
+      i = atomEnd;
+    } else if (ch === "[") {
+      let j = i + 1;
+      if (src[j] === "^") j++;
+      if (src[j] === "]") j++;
+      while (j < endExclusive && src[j] !== "]") {
+        j += src[j] === "\\" ? 2 : 1;
+      }
+      const classEnd = j < endExclusive ? j + 1 : endExclusive;
+      node = { kind: "class", start: i, end: classEnd, quant: null, quantEnd: classEnd, raw: src.slice(i, classEnd) };
+      i = classEnd;
+    } else if (ch === "(") {
+      let depth = 1;
+      let j = i + 1;
+      while (j < endExclusive && depth > 0) {
+        const cj = src[j];
+        if (cj === "\\") {
+          j += 2;
+          continue;
+        }
+        if (cj === "[") {
+          j++;
+          if (src[j] === "^") j++;
+          if (src[j] === "]") j++;
+          while (j < endExclusive && src[j] !== "]") {
+            j += src[j] === "\\" ? 2 : 1;
+          }
+          j++;
+          continue;
+        }
+        if (cj === "(") depth++;
+        else if (cj === ")") depth--;
+        j++;
+      }
+      const closeIdx = depth === 0 ? j - 1 : endExclusive;
+      let contentStart = i + 1;
+      let lookaround = false;
+      if (src[i + 1] === "?") {
+        const after = src[i + 2];
+        if (after === ":") contentStart = i + 3;
+        else if (after === "=" || after === "!") {
+          contentStart = i + 3;
+          lookaround = true;
+        } else if (after === "<") {
+          const a3 = src[i + 3];
+          if (a3 === "=" || a3 === "!") {
+            contentStart = i + 4;
+            lookaround = true;
+          } else {
+            const gt = src.indexOf(">", i + 2);
+            contentStart = gt !== -1 && gt < closeIdx ? gt + 1 : i + 3;
+          }
+        }
+      }
+      node = {
+        kind: "group",
+        start: i,
+        end: closeIdx + 1,
+        quant: null,
+        quantEnd: closeIdx + 1,
+        raw: src.slice(i, closeIdx + 1),
+        alternatives: _redosParseAlternationMcp(src, contentStart, closeIdx),
+        lookaround
+      };
+      i = closeIdx + 1;
+    } else if (ch === ".") {
+      node = { kind: "dot", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: "." };
+      i++;
+    } else if (ch === "^" || ch === "$") {
+      node = { kind: "anchor", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: ch };
+      i++;
+    } else {
+      node = { kind: "char", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: ch };
+      i++;
+    }
+    if (node.kind !== "anchor") {
+      const q = _redosParseQuantMcp(src, i);
+      if (q) {
+        node.quant = q;
+        node.quantEnd = q.end;
+        i = q.end;
+      }
+    }
+    current.push(node);
+  }
+  alternatives.push(current);
+  return alternatives;
+}
+function _redosFirstMatcherMcp(node) {
+  if (node.kind === "dot") return (c) => c !== "\n";
+  if (node.kind === "char") {
+    if (node.raw.startsWith("\\")) {
+      const body = node.raw.slice(1);
+      if (/^[dDwWsS]$/.test(body)) {
+        try {
+          const re = new RegExp("\\" + body);
+          return (c) => re.test(c);
+        } catch {
+          return null;
+        }
+      }
+      const literal = { n: "\n", t: "	", r: "\r", f: "\f", v: "\v" }[body] ?? body;
+      return (c) => c === literal;
+    }
+    const lit = node.raw;
+    return (c) => c === lit;
+  }
+  if (node.kind === "class") {
+    try {
+      const re = new RegExp(node.raw);
+      return (c) => re.test(c);
+    } catch {
+      return null;
+    }
+  }
+  if (node.kind === "group") {
+    const first = node.alternatives?.[0]?.[0];
+    return first ? _redosFirstMatcherMcp(first) : null;
+  }
+  return null;
+}
+function _redosOverlapsMcp(a, b) {
+  const fa = _redosFirstMatcherMcp(a);
+  const fb = _redosFirstMatcherMcp(b);
+  if (!fa || !fb) return false;
+  for (const c of _REDOS_ALPHABET_MCP) if (fa(c) && fb(c)) return true;
+  return false;
+}
+function _redosAnalyzeGroupMcp(node, findings) {
+  const alts = node.alternatives ?? [];
+  const outerUnbounded = node.quant?.unbounded === true && !node.lookaround;
+  if (outerUnbounded) {
+    for (const alt of alts) {
+      const meaningful = alt.filter((n) => n.kind !== "anchor");
+      if (meaningful.length === 1 && meaningful[0].quant?.unbounded) {
+        findings.push({
+          type: "nested-quantifier",
+          severity: "high",
+          message: "Nested unbounded quantifiers: a repeated group whose body is itself unbounded-repeated can match the same input in exponentially many ways, causing catastrophic backtracking.",
+          snippet: node.raw + (node.quant?.raw ?? ""),
+          index: node.start
+        });
+        break;
+      }
+    }
+    if (alts.length > 1) {
+      const firsts = alts.map((alt) => alt.find((n) => n.kind !== "anchor")).filter((n) => !!n);
+      let flagged = false;
+      for (let x = 0; x < firsts.length && !flagged; x++) {
+        for (let y = x + 1; y < firsts.length; y++) {
+          if (_redosOverlapsMcp(firsts[x], firsts[y])) {
+            findings.push({
+              type: "overlapping-alternation",
+              severity: "medium",
+              message: "Overlapping alternation under a repetition: two branches can match the same starting input, so the engine has multiple ways to split each repeat and may backtrack heavily.",
+              snippet: node.raw + (node.quant?.raw ?? ""),
+              index: node.start
+            });
+            flagged = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  for (const alt of alts) _redosAnalyzeSequenceMcp(alt, findings);
+}
+function _redosAnalyzeSequenceMcp(seq, findings) {
+  for (let k = 0; k + 1 < seq.length; k++) {
+    const a = seq[k];
+    const b = seq[k + 1];
+    if (a.quant?.unbounded && b.quant?.unbounded && _redosOverlapsMcp(a, b)) {
+      findings.push({
+        type: "adjacent-quantifier",
+        severity: "medium",
+        message: "Adjacent unbounded quantifiers over overlapping characters: the engine can distribute the same input between them in many ways, causing quadratic backtracking.",
+        snippet: seq[k].raw + (a.quant?.raw ?? "") + seq[k + 1].raw + (b.quant?.raw ?? ""),
+        index: a.start
+      });
+    }
+  }
+  for (const node of seq) if (node.kind === "group") _redosAnalyzeGroupMcp(node, findings);
+}
+function _detectRedosMcp(pattern) {
+  if (typeof pattern !== "string" || pattern === "") return { error: "Empty pattern" };
+  if (pattern.length > 5e3) return { error: "Pattern too long (max 5,000 chars)" };
+  let valid = true;
+  let compileError;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    valid = false;
+    compileError = e instanceof Error ? e.message : String(e);
+  }
+  const findings = [];
+  for (const alt of _redosParseAlternationMcp(pattern, 0, pattern.length)) _redosAnalyzeSequenceMcp(alt, findings);
+  const seen = /* @__PURE__ */ new Set();
+  const unique = findings.filter((f) => {
+    const key = `${f.type}:${f.index}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  unique.sort((a, b) => a.index - b.index);
+  const risk = unique.some((f) => f.severity === "high") ? "high" : unique.length > 0 ? "medium" : "none";
+  return { pattern, valid, ...compileError ? { compileError } : {}, risk, safe: unique.length === 0, findings: unique };
+}
+server.tool(
+  "detect_redos",
+  "Statically analyze a regex pattern for catastrophic-backtracking (ReDoS) risk. Flags nested unbounded quantifiers ((a+)+), overlapping alternation under a repeat ((a|ab)*), and adjacent overlapping quantifiers (\\d+\\d+). Heuristic linter, not a formal proof. Pass the pattern body only, no delimiters or flags.",
+  { pattern: z.string().describe("The regex pattern body to analyze, e.g. (a+)+") },
+  async ({ pattern }) => {
+    const result = _detectRedosMcp(pattern);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.18.0",
+  "version": "0.20.0",
   "description": "MCP server exposing 125 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",