@utilix-tech/mcp 0.34.0 → 0.35.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.35.0
+- Add `build_referrer_policy` tool: build a Referrer-Policy header value from one or more policy tokens with a plain-English explanation of each and warnings for risky choices like unsafe-url.
+- Add `generate_markdown_toc` tool: scan a Markdown document's ATX headings and build a nested table of contents with GitHub-style anchor slugs, disambiguating duplicates.
+
 ## 0.34.0
 - Add `lint_conventional_commit` tool: lint a git commit message against the Conventional Commits v1.0.0 spec, checking header format, blank-line separation, footer tokens, and BREAKING CHANGE casing.
 - Add `calculate_savings_goal` tool: solve for months to reach a savings goal at a fixed monthly contribution, or the monthly contribution required to hit a goal by a target month count.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 154 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 156 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -182,7 +182,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_emi` | Compute the Equated Monthly Installment for a loan from principal, annual rate, and tenure in years or months, with a year-by-year principal/interest breakdown |
 | `calculate_savings_goal` | Solve for months to reach a savings goal at a fixed monthly contribution, or the monthly contribution required to hit a goal by a target month count |
 
-### API / Network (12 tools)
+### API / Network (13 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -196,6 +196,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `validate_robots_txt` | Validate a robots.txt file: User-agent groups, rules, and directive syntax |
 | `parse_user_agent` | Parse a browser User-Agent string into browser, engine, OS, and device type |
 | `build_cache_control` | Build and explain an HTTP Cache-Control response header from directives (max-age, no-store, immutable, etc.) |
+| `build_referrer_policy` | Build and explain an HTTP Referrer-Policy header from one or more fallback-chain policy tokens |
 | `parse_ipv6_address` | Expand an IPv6 address to its full 8-group form or compress it to its RFC 5952 canonical shortest form, classify its address type, and handle an embedded IPv4 suffix or zone ID |
 
 ### Color (4 tools)
@@ -221,7 +222,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `detect_redos` | Statically flag catastrophic-backtracking (ReDoS) risk in a regex: nested quantifiers, overlapping alternation, adjacent overlapping quantifiers |
 | `lint_conventional_commit` | Lint a commit message against the Conventional Commits v1.0.0 spec: header format, blank-line separation, footer tokens, and BREAKING CHANGE casing |
 
-### Data (7 tools)
+### Data (8 tools)
 | Tool | Description |
 |------|-------------|
 | `validate_yaml` | Validate YAML syntax |
@@ -231,6 +232,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `format_ndjson` | Validate and pretty-print newline-delimited JSON (NDJSON) |
 | `diff_env_example` | Diff a .env file against its .env.example template: flags keys missing from either side, plus empty placeholder values |
 | `parse_markdown_front_matter` | Split a Markdown document into its YAML front matter fields and body content |
+| `generate_markdown_toc` | Scan a Markdown document's ATX headings and build a nested table of contents with GitHub-style anchor slugs |
 
 ### CSS (2 tools)
 | Tool | Description |

package/dist/index.js

@@ -4157,6 +4157,66 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _REFERRER_POLICY_VALUES_MCP = [
+  "no-referrer",
+  "no-referrer-when-downgrade",
+  "origin",
+  "origin-when-cross-origin",
+  "same-origin",
+  "strict-origin",
+  "strict-origin-when-cross-origin",
+  "unsafe-url"
+];
+var _REFERRER_POLICY_INFO_MCP = {
+  "no-referrer": { explanation: "Never sends the Referer header, on any request. The strictest option; the destination learns nothing about where the request came from.", leaksPathAndQuery: false, sentOnDowngrade: false },
+  "no-referrer-when-downgrade": { explanation: "Sends the full URL (origin, path, and query string) for same-security-level or upgrading requests, but omits the header entirely when navigating from HTTPS to HTTP. This was the legacy browser default before strict-origin-when-cross-origin.", leaksPathAndQuery: true, sentOnDowngrade: false },
+  origin: { explanation: "Sends only the origin (scheme, host, and port) on every request, same-origin or cross-origin, including on a downgrade. The path and query string are always stripped.", leaksPathAndQuery: false, sentOnDowngrade: true },
+  "origin-when-cross-origin": { explanation: "Sends the full URL for same-origin requests, but only the origin for cross-origin requests. Still sends the origin on a downgrade.", leaksPathAndQuery: true, sentOnDowngrade: true },
+  "same-origin": { explanation: "Sends the full URL for same-origin requests, and no Referer header at all for cross-origin requests.", leaksPathAndQuery: true, sentOnDowngrade: false },
+  "strict-origin": { explanation: "Sends only the origin, and only when the security level stays the same or improves (HTTPS to HTTPS, or HTTP to anything). Nothing is sent on a downgrade from HTTPS to HTTP.", leaksPathAndQuery: false, sentOnDowngrade: false },
+  "strict-origin-when-cross-origin": { explanation: "Sends the full URL for same-origin requests, only the origin for cross-origin requests at the same or better security level, and nothing at all on a downgrade. This is the current browser default when no policy is set.", leaksPathAndQuery: true, sentOnDowngrade: false },
+  "unsafe-url": { explanation: "Always sends the full URL, including path and query string, on every request, even on a downgrade from HTTPS to HTTP. Generally discouraged: query strings can carry session tokens or other sensitive data that then leaks to third-party destinations and to the network on an insecure connection.", leaksPathAndQuery: true, sentOnDowngrade: true }
+};
+function _buildReferrerPolicyMcp(policies) {
+  const trimmed = policies.map((p) => p.trim()).filter((p) => p !== "");
+  if (trimmed.length === 0) return { error: "At least one policy value is required" };
+  const entries = [];
+  for (const value of trimmed) {
+    if (!_REFERRER_POLICY_VALUES_MCP.includes(value)) {
+      return { error: `'${value}' is not a valid Referrer-Policy value. Valid values: ${_REFERRER_POLICY_VALUES_MCP.join(", ")}` };
+    }
+    entries.push({ value, ..._REFERRER_POLICY_INFO_MCP[value] });
+  }
+  const warnings = [];
+  const last = entries[entries.length - 1];
+  if (last.value === "unsafe-url") {
+    warnings.push("unsafe-url sends the full URL, including query strings, on every request, even over an insecure downgrade. Prefer strict-origin-when-cross-origin unless you have a specific reason to leak full URLs.");
+  }
+  if (entries.length > 1 && entries.some((e, i) => i !== entries.length - 1 && e.value === last.value)) {
+    warnings.push("The same policy value appears more than once in the fallback chain, which has no effect beyond the first occurrence.");
+  }
+  const header = entries.map((e) => e.value).join(", ");
+  return {
+    header,
+    headerName: "Referrer-Policy",
+    snippet: `Referrer-Policy: ${header}`,
+    metaTag: `<meta name="referrer" content="${last.value}">`,
+    policies: entries,
+    warnings
+  };
+}
+server.tool(
+  "build_referrer_policy",
+  "Build an HTTP Referrer-Policy response-header value from one or more policy tokens (a fallback chain per the Referrer Policy spec), with a plain-English explanation of each token and warnings for risky choices like unsafe-url. Pure string assembly and lookup, not validated against live request traffic.",
+  {
+    policies: z.array(z.enum(_REFERRER_POLICY_VALUES_MCP)).min(1).describe('One or more Referrer-Policy tokens forming a fallback chain, e.g. ["strict-origin-when-cross-origin"]')
+  },
+  async ({ policies }) => {
+    const result = _buildReferrerPolicyMcp(policies);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 function _isValidIpv6HexGroup(g) {
   return /^[0-9a-fA-F]{1,4}$/.test(g);
 }
@@ -5638,6 +5698,76 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+function _stripInlineMarkdownMcp(text2) {
+  return text2.replace(/(\*\*\*|___)(.+?)\1/g, "$2").replace(/(\*\*|__)(.+?)\1/g, "$2").replace(/(\*|_)(.+?)\1/g, "$2").replace(/`([^`]+)`/g, "$1").replace(/!\[([^\]]*)\]\([^)]*\)/g, "$1").replace(/\[([^\]]+)\]\([^)]*\)/g, "$1").trim();
+}
+function _slugifyHeadingMcp(text2, seen) {
+  let slug = text2.toLowerCase().trim().replace(/[^\p{L}\p{N}\s_-]/gu, "").replace(/\s/g, "-");
+  const count = seen.get(slug) ?? 0;
+  seen.set(slug, count + 1);
+  if (count > 0) slug = `${slug}-${count}`;
+  return slug;
+}
+function _generateMarkdownTocMcp(markdown, minLevel, maxLevel, ordered) {
+  if (typeof markdown !== "string" || markdown.trim() === "") return { error: "markdown is required" };
+  if (!Number.isInteger(minLevel) || !Number.isInteger(maxLevel) || minLevel < 1 || minLevel > 6 || maxLevel < 1 || maxLevel > 6 || minLevel > maxLevel) {
+    return { error: "minLevel and maxLevel must be integers between 1 and 6, with minLevel <= maxLevel" };
+  }
+  const lines = markdown.replace(/\r\n/g, "\n").split("\n");
+  const entries = [];
+  const seen = /* @__PURE__ */ new Map();
+  let inFence = false;
+  let fenceMarker = "";
+  for (const line of lines) {
+    const fenceMatch = line.match(/^\s*(```+|~~~+)/);
+    if (fenceMatch) {
+      if (!inFence) {
+        inFence = true;
+        fenceMarker = fenceMatch[1][0];
+      } else if (fenceMatch[1][0] === fenceMarker) {
+        inFence = false;
+      }
+      continue;
+    }
+    if (inFence) continue;
+    const headingMatch = line.match(/^(#{1,6})\s+(.+?)\s*#*\s*$/);
+    if (!headingMatch) continue;
+    const level = headingMatch[1].length;
+    const text2 = _stripInlineMarkdownMcp(headingMatch[2]);
+    if (text2 === "") continue;
+    const slug = _slugifyHeadingMcp(text2, seen);
+    if (level < minLevel || level > maxLevel) continue;
+    entries.push({ level, text: text2, slug });
+  }
+  if (entries.length === 0) return { error: "No headings found in the given level range" };
+  const baseLevel = Math.min(...entries.map((e) => e.level));
+  const counters = [0, 0, 0, 0, 0, 0, 0];
+  const tocLines = entries.map((e) => {
+    const indent = "  ".repeat(e.level - baseLevel);
+    if (ordered) {
+      counters[e.level] = (counters[e.level] ?? 0) + 1;
+      for (let l = e.level + 1; l < counters.length; l++) counters[l] = 0;
+      return `${indent}${counters[e.level]}. [${e.text}](#${e.slug})`;
+    }
+    return `${indent}- [${e.text}](#${e.slug})`;
+  });
+  return { toc: tocLines.join("\n"), entries };
+}
+server.tool(
+  "generate_markdown_toc",
+  "Scan a Markdown document's ATX headings (# through ######) and build a nested table of contents with GitHub-style anchor slugs, disambiguating duplicate headings with -1, -2, ... suffixes. Setext-style headings are not recognized, and headings inside fenced code blocks are ignored.",
+  {
+    markdown: z.string().describe("The Markdown document to scan for headings"),
+    minLevel: z.number().int().min(1).max(6).optional().describe("Shallowest heading level to include, defaults to 1"),
+    maxLevel: z.number().int().min(1).max(6).optional().describe("Deepest heading level to include, defaults to 6"),
+    ordered: z.boolean().optional().describe("Render as a numbered list instead of a bullet list, defaults to false")
+  },
+  async ({ markdown, minLevel, maxLevel, ordered }) => {
+    const result = _generateMarkdownTocMcp(markdown, minLevel ?? 1, maxLevel ?? 6, ordered ?? false);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var _COMMIT_DEFAULT_TYPES_MCP = ["build", "chore", "ci", "docs", "feat", "fix", "perf", "refactor", "revert", "style", "test"];
 var _COMMIT_HEADER_RE_MCP = /^([A-Za-z][A-Za-z0-9-]*)(\(([^()]*)\))?(!)?: (.+)$/;
 var _COMMIT_FOOTER_LINE_RE_MCP = /^([A-Za-z][A-Za-z0-9-]*|BREAKING CHANGE)(: ?| #)(.*)$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.34.0",
+  "version": "0.35.0",
   "description": "MCP server exposing 152 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",