@utilix-tech/mcp 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.21.0
+- Add `build_cache_control` tool: build and explain a `Cache-Control` response header from directives.
+- Add `detect_filler_words` tool: scan text for filler words, hedge phrases, and clichés.
+
+## 0.20.0
+- Add `detect_redos` tool: statically analyze a regex for ReDoS (catastrophic-backtracking) risk.
+
 ## 0.19.0
 - Added `calculate_time_value` (present/future value) and `vector_similarity` tools.
 

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 127 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 130 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -125,7 +125,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `generate_qr` | Generate a QR code as an SVG string |
 | `generate_random_data` | Generate random mock data: names, emails, UUIDs, IPs, etc. |
 
-### Text (11 tools)
+### Text (12 tools)
 | Tool | Description |
 |------|-------------|
 | `convert_case` | Convert text case: camelCase, snake_case, PascalCase, etc. |
@@ -139,6 +139,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `line_operations` | Sort, deduplicate, reverse, shuffle, trim, or number lines |
 | `detect_passive_voice` | Flag sentences written in passive voice, e.g. "was written", "were approved by the team" |
 | `score_readability` | Score text with Flesch Reading Ease, Flesch-Kincaid Grade Level, and Gunning Fog Index |
+| `detect_filler_words` | Scan text for filler words, hedge phrases, and clichés with per-phrase counts and a density score |
 
 ### Time (5 tools)
 | Tool | Description |
@@ -165,7 +166,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_simple_interest` | Compute simple (non-compounding) interest as principal x rate x time, plus the total payoff |
 | `calculate_time_value` | Convert between present and future value (time value of money) in either direction |
 
-### API / Network (9 tools)
+### API / Network (10 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -177,6 +178,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `validate_sitemap` | Validate a sitemap.xml or sitemap index against the sitemaps.org protocol |
 | `validate_robots_txt` | Validate a robots.txt file: User-agent groups, rules, and directive syntax |
 | `parse_user_agent` | Parse a browser User-Agent string into browser, engine, OS, and device type |
+| `build_cache_control` | Build and explain an HTTP Cache-Control response header from directives (max-age, no-store, immutable, etc.) |
 
 ### Color (4 tools)
 | Tool | Description |
@@ -186,7 +188,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (9 tools)
+### Code (10 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -198,6 +200,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_docker_image` | Parse a Docker image reference into its components |
 | `lookup_mime` | Look up the MIME type for a file extension, or the extension(s) for a MIME type |
 | `parse_github_url` | Parse a github.com URL (repo, pull request, issue, commit, file, or release) into structured components |
+| `detect_redos` | Statically flag catastrophic-backtracking (ReDoS) risk in a regex: nested quantifiers, overlapping alternation, adjacent overlapping quantifiers |
 
 ### Data (6 tools)
 | Tool | Description |

package/dist/index.js

@@ -3461,5 +3461,369 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _REDOS_UNBOUNDED_MCP = /* @__PURE__ */ new Set(["*", "+"]);
+var _REDOS_ALPHABET_MCP = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_ 	.,-@/:;#%&=";
+function _redosParseQuantMcp(src, i) {
+  const ch = src[i];
+  if (ch === "*" || ch === "+" || ch === "?") {
+    let end = i + 1;
+    if (src[end] === "?" || src[end] === "+") end++;
+    return { unbounded: _REDOS_UNBOUNDED_MCP.has(ch), raw: src.slice(i, end), end };
+  }
+  if (ch === "{") {
+    const close = src.indexOf("}", i);
+    if (close === -1) return null;
+    const inner = src.slice(i + 1, close);
+    if (!/^\d+(,\d*)?$/.test(inner)) return null;
+    let end = close + 1;
+    if (src[end] === "?" || src[end] === "+") end++;
+    return { unbounded: /^\d+,$/.test(inner), raw: src.slice(i, end), end };
+  }
+  return null;
+}
+function _redosParseAlternationMcp(src, start, endExclusive) {
+  const alternatives = [];
+  let current = [];
+  let i = start;
+  while (i < endExclusive) {
+    const ch = src[i];
+    if (ch === "|") {
+      alternatives.push(current);
+      current = [];
+      i++;
+      continue;
+    }
+    let node;
+    if (ch === "\\") {
+      const atomEnd = i + 2 <= endExclusive ? i + 2 : i + 1;
+      node = { kind: "char", start: i, end: atomEnd, quant: null, quantEnd: atomEnd, raw: src.slice(i, atomEnd) };
+      i = atomEnd;
+    } else if (ch === "[") {
+      let j = i + 1;
+      if (src[j] === "^") j++;
+      if (src[j] === "]") j++;
+      while (j < endExclusive && src[j] !== "]") {
+        j += src[j] === "\\" ? 2 : 1;
+      }
+      const classEnd = j < endExclusive ? j + 1 : endExclusive;
+      node = { kind: "class", start: i, end: classEnd, quant: null, quantEnd: classEnd, raw: src.slice(i, classEnd) };
+      i = classEnd;
+    } else if (ch === "(") {
+      let depth = 1;
+      let j = i + 1;
+      while (j < endExclusive && depth > 0) {
+        const cj = src[j];
+        if (cj === "\\") {
+          j += 2;
+          continue;
+        }
+        if (cj === "[") {
+          j++;
+          if (src[j] === "^") j++;
+          if (src[j] === "]") j++;
+          while (j < endExclusive && src[j] !== "]") {
+            j += src[j] === "\\" ? 2 : 1;
+          }
+          j++;
+          continue;
+        }
+        if (cj === "(") depth++;
+        else if (cj === ")") depth--;
+        j++;
+      }
+      const closeIdx = depth === 0 ? j - 1 : endExclusive;
+      let contentStart = i + 1;
+      let lookaround = false;
+      if (src[i + 1] === "?") {
+        const after = src[i + 2];
+        if (after === ":") contentStart = i + 3;
+        else if (after === "=" || after === "!") {
+          contentStart = i + 3;
+          lookaround = true;
+        } else if (after === "<") {
+          const a3 = src[i + 3];
+          if (a3 === "=" || a3 === "!") {
+            contentStart = i + 4;
+            lookaround = true;
+          } else {
+            const gt = src.indexOf(">", i + 2);
+            contentStart = gt !== -1 && gt < closeIdx ? gt + 1 : i + 3;
+          }
+        }
+      }
+      node = {
+        kind: "group",
+        start: i,
+        end: closeIdx + 1,
+        quant: null,
+        quantEnd: closeIdx + 1,
+        raw: src.slice(i, closeIdx + 1),
+        alternatives: _redosParseAlternationMcp(src, contentStart, closeIdx),
+        lookaround
+      };
+      i = closeIdx + 1;
+    } else if (ch === ".") {
+      node = { kind: "dot", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: "." };
+      i++;
+    } else if (ch === "^" || ch === "$") {
+      node = { kind: "anchor", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: ch };
+      i++;
+    } else {
+      node = { kind: "char", start: i, end: i + 1, quant: null, quantEnd: i + 1, raw: ch };
+      i++;
+    }
+    if (node.kind !== "anchor") {
+      const q = _redosParseQuantMcp(src, i);
+      if (q) {
+        node.quant = q;
+        node.quantEnd = q.end;
+        i = q.end;
+      }
+    }
+    current.push(node);
+  }
+  alternatives.push(current);
+  return alternatives;
+}
+function _redosFirstMatcherMcp(node) {
+  if (node.kind === "dot") return (c) => c !== "\n";
+  if (node.kind === "char") {
+    if (node.raw.startsWith("\\")) {
+      const body = node.raw.slice(1);
+      if (/^[dDwWsS]$/.test(body)) {
+        try {
+          const re = new RegExp("\\" + body);
+          return (c) => re.test(c);
+        } catch {
+          return null;
+        }
+      }
+      const literal = { n: "\n", t: "	", r: "\r", f: "\f", v: "\v" }[body] ?? body;
+      return (c) => c === literal;
+    }
+    const lit = node.raw;
+    return (c) => c === lit;
+  }
+  if (node.kind === "class") {
+    try {
+      const re = new RegExp(node.raw);
+      return (c) => re.test(c);
+    } catch {
+      return null;
+    }
+  }
+  if (node.kind === "group") {
+    const first = node.alternatives?.[0]?.[0];
+    return first ? _redosFirstMatcherMcp(first) : null;
+  }
+  return null;
+}
+function _redosOverlapsMcp(a, b) {
+  const fa = _redosFirstMatcherMcp(a);
+  const fb = _redosFirstMatcherMcp(b);
+  if (!fa || !fb) return false;
+  for (const c of _REDOS_ALPHABET_MCP) if (fa(c) && fb(c)) return true;
+  return false;
+}
+function _redosAnalyzeGroupMcp(node, findings) {
+  const alts = node.alternatives ?? [];
+  const outerUnbounded = node.quant?.unbounded === true && !node.lookaround;
+  if (outerUnbounded) {
+    for (const alt of alts) {
+      const meaningful = alt.filter((n) => n.kind !== "anchor");
+      if (meaningful.length === 1 && meaningful[0].quant?.unbounded) {
+        findings.push({
+          type: "nested-quantifier",
+          severity: "high",
+          message: "Nested unbounded quantifiers: a repeated group whose body is itself unbounded-repeated can match the same input in exponentially many ways, causing catastrophic backtracking.",
+          snippet: node.raw + (node.quant?.raw ?? ""),
+          index: node.start
+        });
+        break;
+      }
+    }
+    if (alts.length > 1) {
+      const firsts = alts.map((alt) => alt.find((n) => n.kind !== "anchor")).filter((n) => !!n);
+      let flagged = false;
+      for (let x = 0; x < firsts.length && !flagged; x++) {
+        for (let y = x + 1; y < firsts.length; y++) {
+          if (_redosOverlapsMcp(firsts[x], firsts[y])) {
+            findings.push({
+              type: "overlapping-alternation",
+              severity: "medium",
+              message: "Overlapping alternation under a repetition: two branches can match the same starting input, so the engine has multiple ways to split each repeat and may backtrack heavily.",
+              snippet: node.raw + (node.quant?.raw ?? ""),
+              index: node.start
+            });
+            flagged = true;
+            break;
+          }
+        }
+      }
+    }
+  }
+  for (const alt of alts) _redosAnalyzeSequenceMcp(alt, findings);
+}
+function _redosAnalyzeSequenceMcp(seq, findings) {
+  for (let k = 0; k + 1 < seq.length; k++) {
+    const a = seq[k];
+    const b = seq[k + 1];
+    if (a.quant?.unbounded && b.quant?.unbounded && _redosOverlapsMcp(a, b)) {
+      findings.push({
+        type: "adjacent-quantifier",
+        severity: "medium",
+        message: "Adjacent unbounded quantifiers over overlapping characters: the engine can distribute the same input between them in many ways, causing quadratic backtracking.",
+        snippet: seq[k].raw + (a.quant?.raw ?? "") + seq[k + 1].raw + (b.quant?.raw ?? ""),
+        index: a.start
+      });
+    }
+  }
+  for (const node of seq) if (node.kind === "group") _redosAnalyzeGroupMcp(node, findings);
+}
+function _detectRedosMcp(pattern) {
+  if (typeof pattern !== "string" || pattern === "") return { error: "Empty pattern" };
+  if (pattern.length > 5e3) return { error: "Pattern too long (max 5,000 chars)" };
+  let valid = true;
+  let compileError;
+  try {
+    new RegExp(pattern);
+  } catch (e) {
+    valid = false;
+    compileError = e instanceof Error ? e.message : String(e);
+  }
+  const findings = [];
+  for (const alt of _redosParseAlternationMcp(pattern, 0, pattern.length)) _redosAnalyzeSequenceMcp(alt, findings);
+  const seen = /* @__PURE__ */ new Set();
+  const unique = findings.filter((f) => {
+    const key = `${f.type}:${f.index}`;
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  unique.sort((a, b) => a.index - b.index);
+  const risk = unique.some((f) => f.severity === "high") ? "high" : unique.length > 0 ? "medium" : "none";
+  return { pattern, valid, ...compileError ? { compileError } : {}, risk, safe: unique.length === 0, findings: unique };
+}
+server.tool(
+  "detect_redos",
+  "Statically analyze a regex pattern for catastrophic-backtracking (ReDoS) risk. Flags nested unbounded quantifiers ((a+)+), overlapping alternation under a repeat ((a|ab)*), and adjacent overlapping quantifiers (\\d+\\d+). Heuristic linter, not a formal proof. Pass the pattern body only, no delimiters or flags.",
+  { pattern: z.string().describe("The regex pattern body to analyze, e.g. (a+)+") },
+  async ({ pattern }) => {
+    const result = _detectRedosMcp(pattern);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+var _CC_NUM_FIELDS_MCP = ["maxAge", "sMaxAge", "staleWhileRevalidate", "staleIfError"];
+function _humanizeCacheSecondsMcp(s) {
+  if (s === 0) return "0 seconds";
+  const units = [[86400, "day"], [3600, "hour"], [60, "minute"], [1, "second"]];
+  const parts = [];
+  let rem = s;
+  for (const [size, label] of units) {
+    if (rem >= size) {
+      const n = Math.floor(rem / size);
+      rem -= n * size;
+      parts.push(`${n} ${label}${n === 1 ? "" : "s"}`);
+    }
+  }
+  return parts.slice(0, 2).join(" ");
+}
+function _buildCacheControlMcp(options) {
+  const nums = { maxAge: null, sMaxAge: null, staleWhileRevalidate: null, staleIfError: null };
+  for (const field of _CC_NUM_FIELDS_MCP) {
+    const v = options[field];
+    if (v === void 0 || v === null) continue;
+    if (typeof v !== "number" || !Number.isFinite(v) || !Number.isInteger(v) || v < 0) {
+      return { error: `${field} must be a non-negative integer number of seconds` };
+    }
+    nums[field] = v;
+  }
+  const d = [];
+  const warnings = [];
+  if (options.visibility === "public") d.push({ name: "public", value: null, explanation: "Any cache, including shared caches and CDNs, may store this response." });
+  if (options.visibility === "private") d.push({ name: "private", value: null, explanation: "Only the user's browser may cache this response; shared caches and CDNs must not." });
+  if (options.noCache) d.push({ name: "no-cache", value: null, explanation: "A cache may store the response but must revalidate it with the origin before every reuse." });
+  if (options.noStore) d.push({ name: "no-store", value: null, explanation: "No cache may store any part of this request or response." });
+  if (nums.maxAge !== null) d.push({ name: "max-age", value: String(nums.maxAge), explanation: `Considered fresh for ${_humanizeCacheSecondsMcp(nums.maxAge)} (${nums.maxAge}s), after which it becomes stale.` });
+  if (nums.sMaxAge !== null) d.push({ name: "s-maxage", value: String(nums.sMaxAge), explanation: `For shared caches (CDNs, proxies) it is fresh for ${_humanizeCacheSecondsMcp(nums.sMaxAge)} (${nums.sMaxAge}s), overriding max-age there.` });
+  if (options.mustRevalidate) d.push({ name: "must-revalidate", value: null, explanation: "Once stale, a cache must revalidate with the origin and never serve the stale copy." });
+  if (options.proxyRevalidate) d.push({ name: "proxy-revalidate", value: null, explanation: "Like must-revalidate, but the requirement applies only to shared caches." });
+  if (options.immutable) d.push({ name: "immutable", value: null, explanation: "The body will not change while fresh, so browsers should not revalidate it on reload." });
+  if (options.noTransform) d.push({ name: "no-transform", value: null, explanation: "Intermediaries must not modify the response body (for example, recompressing images)." });
+  if (nums.staleWhileRevalidate !== null) d.push({ name: "stale-while-revalidate", value: String(nums.staleWhileRevalidate), explanation: `A cache may serve the stale response for up to ${_humanizeCacheSecondsMcp(nums.staleWhileRevalidate)} (${nums.staleWhileRevalidate}s) while it revalidates in the background.` });
+  if (nums.staleIfError !== null) d.push({ name: "stale-if-error", value: String(nums.staleIfError), explanation: `A cache may serve the stale response for up to ${_humanizeCacheSecondsMcp(nums.staleIfError)} (${nums.staleIfError}s) if the origin returns an error.` });
+  if (options.mustUnderstand) d.push({ name: "must-understand", value: null, explanation: "A cache should store the response only if it understands the caching requirements of the response's status code." });
+  if (options.noStore && d.length > 1) warnings.push("no-store means nothing is cached, so the other directives have no effect.");
+  if (options.noCache && nums.maxAge !== null) warnings.push("no-cache forces revalidation on every use, so max-age has little practical effect alongside it.");
+  if (options.immutable && nums.maxAge === null) warnings.push("immutable only applies while the response is fresh \u2014 add a max-age so it has a freshness lifetime.");
+  if (d.length === 0) warnings.push("No directives set \u2014 an empty Cache-Control header has no effect.");
+  const header = d.map((x) => x.value === null ? x.name : `${x.name}=${x.value}`).join(", ");
+  return { header, headerName: "Cache-Control", snippet: `Cache-Control: ${header}`, directives: d, warnings };
+}
+server.tool(
+  "build_cache_control",
+  "Build an HTTP Cache-Control response-header value from a set of directives (public/private, no-cache, no-store, max-age, s-maxage, must-revalidate, immutable, stale-while-revalidate, etc.), with a plain-English explanation of each directive and warnings for combinations that cancel each other out. Pure string assembly, not validated against a live origin.",
+  {
+    visibility: z.enum(["public", "private"]).optional().describe("public (any cache) or private (browser only)"),
+    noCache: z.boolean().optional(),
+    noStore: z.boolean().optional(),
+    noTransform: z.boolean().optional(),
+    mustRevalidate: z.boolean().optional(),
+    proxyRevalidate: z.boolean().optional(),
+    immutable: z.boolean().optional(),
+    mustUnderstand: z.boolean().optional(),
+    maxAge: z.number().int().nonnegative().optional().describe("Freshness lifetime in seconds"),
+    sMaxAge: z.number().int().nonnegative().optional().describe("Freshness lifetime for shared caches, in seconds"),
+    staleWhileRevalidate: z.number().int().nonnegative().optional(),
+    staleIfError: z.number().int().nonnegative().optional()
+  },
+  async (opts) => {
+    const result = _buildCacheControlMcp(opts);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+var _FILLER_WORDS_MCP = ["very", "really", "just", "actually", "basically", "literally", "simply", "totally", "definitely", "certainly", "essentially", "absolutely", "completely", "extremely", "truly", "honestly", "seriously", "obviously", "clearly", "quite", "rather", "somewhat", "fairly", "virtually"];
+var _HEDGE_PHRASES_MCP = ["maybe", "perhaps", "probably", "possibly", "arguably", "kind of", "sort of", "a bit", "a little", "more or less", "in my opinion", "i think", "i believe", "to some extent"];
+var _CLICHE_PHRASES_MCP = ["at the end of the day", "think outside the box", "low-hanging fruit", "move the needle", "circle back", "touch base", "on the same page", "hit the ground running", "paradigm shift", "win-win", "game changer", "best of both worlds", "only time will tell", "back to the drawing board", "the tip of the iceberg", "a perfect storm", "needle in a haystack", "raise the bar", "push the envelope", "the elephant in the room", "boil the ocean", "when it rains it pours"];
+var _FILLER_DICTIONARY_MCP = [
+  ..._FILLER_WORDS_MCP.map((phrase) => ({ phrase, category: "filler" })),
+  ..._HEDGE_PHRASES_MCP.map((phrase) => ({ phrase, category: "hedge" })),
+  ..._CLICHE_PHRASES_MCP.map((phrase) => ({ phrase, category: "cliche" }))
+];
+function _fillerRegexMcp(phrase) {
+  const tokens = phrase.split(/\s+/).map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
+  return new RegExp("\\b" + tokens.join("\\s+") + "\\b", "gi");
+}
+function _detectFillerWordsMcp(input) {
+  const totalWords = (input.match(/[A-Za-z0-9']+/g) ?? []).length;
+  const matches = [];
+  for (const entry of _FILLER_DICTIONARY_MCP) {
+    const re = _fillerRegexMcp(entry.phrase);
+    const indices = [];
+    let m;
+    while ((m = re.exec(input)) !== null) {
+      indices.push(m.index);
+      if (m.index === re.lastIndex) re.lastIndex++;
+    }
+    if (indices.length > 0) matches.push({ phrase: entry.phrase, category: entry.category, count: indices.length, indices });
+  }
+  matches.sort((a, b) => b.count - a.count || a.category.localeCompare(b.category) || a.phrase.localeCompare(b.phrase));
+  const fillerCount = matches.filter((x) => x.category === "filler").reduce((s, x) => s + x.count, 0);
+  const hedgeCount = matches.filter((x) => x.category === "hedge").reduce((s, x) => s + x.count, 0);
+  const clicheCount = matches.filter((x) => x.category === "cliche").reduce((s, x) => s + x.count, 0);
+  const totalMatches = fillerCount + hedgeCount + clicheCount;
+  const density = totalWords > 0 ? Math.round(totalMatches / totalWords * 1e3) / 10 : 0;
+  return { totalWords, totalMatches, fillerCount, hedgeCount, clicheCount, density, matches };
+}
+server.tool(
+  "detect_filler_words",
+  "Scan prose for filler words (very, just, really), hedge phrases (kind of, I think), and clich\xE9s (at the end of the day, circle back), returning each matched phrase with its category, occurrence count, and character offsets, plus an overall density. Dictionary-based heuristic: a flagged word is a candidate to reconsider, not always wrong in context.",
+  { text: z.string().describe("The prose to scan for filler words and clich\xE9s") },
+  async ({ text: input }) => {
+    return text(JSON.stringify(_detectFillerWordsMcp(input), null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.19.0",
+  "version": "0.21.0",
   "description": "MCP server exposing 125 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",