@utilix-tech/mcp 0.36.0 → 0.38.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.38.0
+- Add `check_set_cookie_header` tool: parse a Set-Cookie header value and validate its attribute combination, flagging SameSite=None missing Secure, __Host-/__Secure- prefix violations, a missing Secure attribute, and a Max-Age past 400 days.
+- Add `test_gitignore_patterns` tool: test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules, and report which pattern and line number decided each path's outcome.
+
+## 0.37.0
+- Add `build_link_header` tool: build an HTTP Link response header from URL/rel pairs (preload, preconnect, prefetch, canonical, pagination, etc.), including the as/type/crossorigin attributes preload needs, plus a plain-English explanation of each entry and warnings for common mistakes like a preload missing `as`.
+
 ## 0.36.0
 - Add `calculate_roi` tool: return on investment percent from an initial and final value, plus the annualized (CAGR) return given an optional holding period in years.
 - Add `lookup_emoji` tool: search a curated table of ~280 common emoji by name, keyword, or GitHub-style shortcode, or look one up exactly by shortcode, character, or category.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 158 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 161 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -184,7 +184,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_savings_goal` | Solve for months to reach a savings goal at a fixed monthly contribution, or the monthly contribution required to hit a goal by a target month count |
 | `calculate_roi` | Compute return on investment percent from an initial and final value, plus the annualized (CAGR) return given an optional holding period in years |
 
-### API / Network (13 tools)
+### API / Network (15 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -200,6 +200,8 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `build_cache_control` | Build and explain an HTTP Cache-Control response header from directives (max-age, no-store, immutable, etc.) |
 | `build_referrer_policy` | Build and explain an HTTP Referrer-Policy header from one or more fallback-chain policy tokens |
 | `parse_ipv6_address` | Expand an IPv6 address to its full 8-group form or compress it to its RFC 5952 canonical shortest form, classify its address type, and handle an embedded IPv4 suffix or zone ID |
+| `build_link_header` | Build and explain an HTTP Link response header from URL/rel pairs (preload, preconnect, prefetch, canonical, pagination, etc.) |
+| `check_set_cookie_header` | Parse a Set-Cookie header and validate its attribute combination: SameSite=None requires Secure, __Host-/__Secure- prefix rules, missing Secure, overly long Max-Age |
 
 ### Color (4 tools)
 | Tool | Description |
@@ -209,7 +211,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (11 tools)
+### Code (12 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -223,6 +225,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_github_url` | Parse a github.com URL (repo, pull request, issue, commit, file, or release) into structured components |
 | `detect_redos` | Statically flag catastrophic-backtracking (ReDoS) risk in a regex: nested quantifiers, overlapping alternation, adjacent overlapping quantifiers |
 | `lint_conventional_commit` | Lint a commit message against the Conventional Commits v1.0.0 spec: header format, blank-line separation, footer tokens, and BREAKING CHANGE casing |
+| `test_gitignore_patterns` | Test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules |
 
 ### Data (8 tools)
 | Tool | Description |

package/dist/index.js

@@ -4217,6 +4217,88 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _LINK_REL_VALUES_MCP = [
+  "preload",
+  "preconnect",
+  "prefetch",
+  "prerender",
+  "dns-prefetch",
+  "canonical",
+  "next",
+  "prev",
+  "alternate",
+  "stylesheet",
+  "icon",
+  "modulepreload"
+];
+var _LINK_REL_INFO_MCP = {
+  preload: "Tells the browser to fetch this resource early, before the parser would otherwise discover it, without blocking rendering. Requires an `as` attribute so the browser applies the right request priority and Content-Security-Policy check; omitting it commonly causes the resource to be fetched twice.",
+  preconnect: "Tells the browser to start the connection handshake (DNS, TCP, TLS) to this origin early, before any real request to it is made, so the first actual request lands faster.",
+  prefetch: "Tells the browser to fetch this resource at low priority for a likely future navigation and cache it. Unlike preload, it does not affect the current page load.",
+  prerender: "Tells the browser to fetch and render this page in the background so navigating to it feels instant, at a real bandwidth and CPU cost if the user never navigates there.",
+  "dns-prefetch": "Tells the browser to resolve this origin's DNS early, a lighter-weight version of preconnect that skips the TCP/TLS handshake.",
+  canonical: "Tells search engines which URL is the authoritative version of this page, used to consolidate duplicate-content signals across query-string or protocol variants.",
+  next: "Marks the next page in a paginated sequence, a hint search engines and some browsers use for pagination.",
+  prev: "Marks the previous page in a paginated sequence.",
+  alternate: "Points to an alternate version of this resource, such as a different language or an RSS feed.",
+  stylesheet: 'Loads an external stylesheet, the same effect as a `<link rel="stylesheet">` tag but delivered as a response header instead.',
+  icon: 'Points to this resource\'s favicon, the same effect as a `<link rel="icon">` tag but delivered as a response header instead.',
+  modulepreload: "Tells the browser to fetch and parse this JavaScript module early, ahead of when the module graph would otherwise discover it."
+};
+function _buildLinkHeaderMcp(links) {
+  if (links.length === 0) return { error: "At least one link entry is required" };
+  const entries = [];
+  for (const link of links) {
+    const url = link.url.trim();
+    const rel = link.rel.trim();
+    if (!url) return { error: "Each link entry requires a non-empty url" };
+    if (!rel) return { error: "Each link entry requires a non-empty rel" };
+    if (!_LINK_REL_VALUES_MCP.includes(rel)) {
+      return { error: `'${rel}' is not a supported rel value. Supported values: ${_LINK_REL_VALUES_MCP.join(", ")}` };
+    }
+    const as = link.as?.trim() || void 0;
+    const type = link.type?.trim() || void 0;
+    const crossorigin = link.crossorigin === true;
+    let value = `<${url}>; rel="${rel}"`;
+    if (as) value += `; as="${as}"`;
+    if (type) value += `; type="${type}"`;
+    if (crossorigin) value += "; crossorigin";
+    entries.push({ url, rel, as, type, crossorigin: crossorigin || void 0, value, explanation: _LINK_REL_INFO_MCP[rel] });
+  }
+  const warnings = [];
+  for (const entry of entries) {
+    if (entry.rel === "preload" && !entry.as) {
+      warnings.push(`preload link for "${entry.url}" is missing an \`as\` attribute \u2014 the browser may fetch it twice or apply the wrong request priority.`);
+    }
+    if ((entry.rel === "preconnect" || entry.rel === "dns-prefetch") && (entry.as || entry.type)) {
+      warnings.push(`${entry.rel} link for "${entry.url}" sets \`as\`/\`type\`, which it ignores since no specific resource is being fetched yet.`);
+    }
+  }
+  const canonicalCount = entries.filter((e) => e.rel === "canonical").length;
+  if (canonicalCount > 1) {
+    warnings.push(`${canonicalCount} canonical links present \u2014 only one canonical URL should be declared per page.`);
+  }
+  const header = entries.map((e) => e.value).join(", ");
+  return { header, headerName: "Link", snippet: `Link: ${header}`, links: entries, warnings };
+}
+server.tool(
+  "build_link_header",
+  "Build an HTTP Link response-header value from one or more URL/rel pairs (preload, preconnect, prefetch, canonical, pagination, etc.), including the as/type/crossorigin attributes preload needs, with a plain-English explanation of each entry and warnings for common mistakes like a preload missing `as`. Pure string assembly and lookup; it never fetches or validates that a URL exists.",
+  {
+    links: z.array(z.object({
+      url: z.string().describe("The linked resource URL"),
+      rel: z.enum(_LINK_REL_VALUES_MCP),
+      as: z.string().optional().describe("Resource type hint, mainly used with preload/modulepreload"),
+      type: z.string().optional().describe("MIME type of the linked resource"),
+      crossorigin: z.boolean().optional()
+    })).min(1).describe("One or more link entries")
+  },
+  async ({ links }) => {
+    const result = _buildLinkHeaderMcp(links);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 function _isValidIpv6HexGroup(g) {
   return /^[0-9a-fA-F]{1,4}$/.test(g);
 }
@@ -6339,5 +6421,180 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _MAX_COOKIE_AGE_SECONDS_MCP = 400 * 24 * 60 * 60;
+function _checkSetCookieHeaderMcp(header) {
+  if (!header.trim()) return { error: "A Set-Cookie header value is required" };
+  const parts = header.split(";").map((p) => p.trim()).filter(Boolean);
+  const [nameValue, ...attrParts] = parts;
+  const eqIdx = nameValue.indexOf("=");
+  if (eqIdx === -1) return { error: "Missing name=value pair" };
+  const name = nameValue.slice(0, eqIdx).trim();
+  const value = nameValue.slice(eqIdx + 1).trim();
+  if (!name) return { error: "Cookie name cannot be empty" };
+  const cookie = {
+    name,
+    value,
+    domain: null,
+    path: null,
+    expires: null,
+    maxAge: null,
+    secure: false,
+    httpOnly: false,
+    sameSite: null
+  };
+  for (const attr of attrParts) {
+    const idx = attr.indexOf("=");
+    const key = (idx === -1 ? attr : attr.slice(0, idx)).trim().toLowerCase();
+    const val = idx === -1 ? "" : attr.slice(idx + 1).trim();
+    switch (key) {
+      case "domain":
+        cookie.domain = val || null;
+        break;
+      case "path":
+        cookie.path = val || null;
+        break;
+      case "expires":
+        cookie.expires = val || null;
+        break;
+      case "max-age": {
+        const n = Number(val);
+        cookie.maxAge = Number.isFinite(n) ? n : null;
+        break;
+      }
+      case "secure":
+        cookie.secure = true;
+        break;
+      case "httponly":
+        cookie.httpOnly = true;
+        break;
+      case "samesite": {
+        const normalized = val.toLowerCase();
+        if (normalized === "strict") cookie.sameSite = "Strict";
+        else if (normalized === "lax") cookie.sameSite = "Lax";
+        else if (normalized === "none") cookie.sameSite = "None";
+        break;
+      }
+    }
+  }
+  const issues = [];
+  const warnings = [];
+  if (cookie.sameSite === "None" && !cookie.secure) {
+    issues.push("SameSite=None requires the Secure attribute \u2014 modern browsers reject this cookie without it.");
+  }
+  if (name.startsWith("__Host-")) {
+    if (!cookie.secure) issues.push("__Host- prefixed cookies require the Secure attribute.");
+    if (cookie.domain) issues.push("__Host- prefixed cookies must not set a Domain attribute.");
+    if (cookie.path !== "/") issues.push("__Host- prefixed cookies must set Path=/.");
+  } else if (name.startsWith("__Secure-")) {
+    if (!cookie.secure) issues.push("__Secure- prefixed cookies require the Secure attribute.");
+  }
+  if (!cookie.secure) {
+    warnings.push("Missing Secure attribute \u2014 the cookie can be sent over a plain HTTP connection.");
+  }
+  if (cookie.maxAge !== null && cookie.maxAge > _MAX_COOKIE_AGE_SECONDS_MCP) {
+    warnings.push(`Max-Age (${cookie.maxAge}s) exceeds 400 days \u2014 Chromium-based browsers clamp cookie expiry to 400 days from when it's set, so this will be shortened.`);
+  }
+  return { cookie, issues, warnings, valid: issues.length === 0 };
+}
+server.tool(
+  "check_set_cookie_header",
+  "Parse a Set-Cookie header value and validate its attribute combination: SameSite=None requires Secure, the __Host-/__Secure- name prefixes each require their own attributes (__Host- additionally forbids Domain and requires Path=/), a missing Secure attribute is flagged, and a Max-Age beyond 400 days is flagged since Chromium-based browsers clamp it to that cap.",
+  {
+    header: z.string().describe('The Set-Cookie header value to parse and validate, e.g. "session=abc123; Secure; SameSite=None"')
+  },
+  async ({ header }) => {
+    const result = _checkSetCookieHeaderMcp(header);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _globSegmentToRegexSourceMcp(segment) {
+  let out = "";
+  for (let i = 0; i < segment.length; i++) {
+    const c = segment[i];
+    if (c === "*") {
+      out += "[^/]*";
+    } else if (c === "?") {
+      out += "[^/]";
+    } else if (c === "[") {
+      const close = segment.indexOf("]", i + 1);
+      if (close === -1) {
+        out += "\\[";
+      } else {
+        let cls = segment.slice(i + 1, close);
+        if (cls.startsWith("!")) cls = "^" + cls.slice(1);
+        out += `[${cls}]`;
+        i = close;
+      }
+    } else {
+      out += c.replace(/[.+^${}()|\\]/g, "\\$&");
+    }
+  }
+  return out;
+}
+function _compileGitignorePatternMcp(raw, line) {
+  let pattern = raw.replace(/\s+$/, "");
+  if (!pattern || pattern.startsWith("#")) return null;
+  let negate = false;
+  if (pattern.startsWith("!")) {
+    negate = true;
+    pattern = pattern.slice(1);
+  }
+  pattern = pattern.replace(/\\(.)/g, "$1");
+  if (!pattern) return null;
+  const dirOnly = pattern.endsWith("/") && !pattern.endsWith("\\/");
+  if (dirOnly) pattern = pattern.slice(0, -1);
+  const hasLeadingSlash = pattern.startsWith("/");
+  if (hasLeadingSlash) pattern = pattern.slice(1);
+  const anchored = hasLeadingSlash || pattern.includes("/");
+  const segments = pattern.split("/");
+  const regexParts = segments.map((seg) => {
+    if (seg === "**") return "(?:.*)";
+    return _globSegmentToRegexSourceMcp(seg);
+  });
+  let body = regexParts.join("/");
+  body = body.replace(/\(\?:\.\*\)\//g, "(?:.*/)?").replace(/\/\(\?:\.\*\)/g, "(?:/.*)?");
+  const prefix = anchored ? "^" : "^(?:.*/)?";
+  const suffix = "(?:/.*)?$";
+  const regex = new RegExp(prefix + body + suffix);
+  return { raw, line, negate, regex };
+}
+function _testGitignorePatternsMcp(gitignoreContent, paths) {
+  if (!gitignoreContent.trim()) return { error: "gitignore content is required" };
+  if (paths.length === 0) return { error: "At least one path is required" };
+  const lines = gitignoreContent.split("\n");
+  const patterns = [];
+  lines.forEach((line, idx) => {
+    const compiled = _compileGitignorePatternMcp(line, idx + 1);
+    if (compiled) patterns.push(compiled);
+  });
+  return paths.map((rawPath) => {
+    const path = rawPath.trim().replace(/^\.\//, "");
+    let ignored = false;
+    let matchedPattern = null;
+    let matchedLine = null;
+    for (const p of patterns) {
+      if (p.regex.test(path)) {
+        ignored = !p.negate;
+        matchedPattern = p.raw.trim();
+        matchedLine = p.line;
+      }
+    }
+    return { path, ignored, matchedPattern, matchedLine };
+  });
+}
+server.tool(
+  "test_gitignore_patterns",
+  "Test a list of paths against a .gitignore file's contents, following git's matching rules: a leading `!` negates a pattern, a trailing `/` restricts a pattern to directories, and a pattern with no interior `/` can match at any depth. The last matching pattern wins. Does not replicate git's rule that a negation cannot re-include a file whose parent directory was already excluded.",
+  {
+    gitignore: z.string().describe("The .gitignore file contents"),
+    paths: z.array(z.string()).min(1).describe('Relative, forward-slash separated paths to test; use a trailing "/" to mark a directory')
+  },
+  async ({ gitignore, paths }) => {
+    const result = _testGitignorePatternsMcp(gitignore, paths);
+    if (!Array.isArray(result) && "error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.36.0",
+  "version": "0.38.0",
   "description": "MCP server exposing 152 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",