@utilix-tech/mcp 0.37.0 → 0.38.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.38.0
+- Add `check_set_cookie_header` tool: parse a Set-Cookie header value and validate its attribute combination, flagging SameSite=None missing Secure, __Host-/__Secure- prefix violations, a missing Secure attribute, and a Max-Age past 400 days.
+- Add `test_gitignore_patterns` tool: test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules, and report which pattern and line number decided each path's outcome.
+
 ## 0.37.0
 - Add `build_link_header` tool: build an HTTP Link response header from URL/rel pairs (preload, preconnect, prefetch, canonical, pagination, etc.), including the as/type/crossorigin attributes preload needs, plus a plain-English explanation of each entry and warnings for common mistakes like a preload missing `as`.
 

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 159 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 161 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -184,7 +184,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_savings_goal` | Solve for months to reach a savings goal at a fixed monthly contribution, or the monthly contribution required to hit a goal by a target month count |
 | `calculate_roi` | Compute return on investment percent from an initial and final value, plus the annualized (CAGR) return given an optional holding period in years |
 
-### API / Network (14 tools)
+### API / Network (15 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -201,6 +201,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `build_referrer_policy` | Build and explain an HTTP Referrer-Policy header from one or more fallback-chain policy tokens |
 | `parse_ipv6_address` | Expand an IPv6 address to its full 8-group form or compress it to its RFC 5952 canonical shortest form, classify its address type, and handle an embedded IPv4 suffix or zone ID |
 | `build_link_header` | Build and explain an HTTP Link response header from URL/rel pairs (preload, preconnect, prefetch, canonical, pagination, etc.) |
+| `check_set_cookie_header` | Parse a Set-Cookie header and validate its attribute combination: SameSite=None requires Secure, __Host-/__Secure- prefix rules, missing Secure, overly long Max-Age |
 
 ### Color (4 tools)
 | Tool | Description |
@@ -210,7 +211,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (11 tools)
+### Code (12 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -224,6 +225,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_github_url` | Parse a github.com URL (repo, pull request, issue, commit, file, or release) into structured components |
 | `detect_redos` | Statically flag catastrophic-backtracking (ReDoS) risk in a regex: nested quantifiers, overlapping alternation, adjacent overlapping quantifiers |
 | `lint_conventional_commit` | Lint a commit message against the Conventional Commits v1.0.0 spec: header format, blank-line separation, footer tokens, and BREAKING CHANGE casing |
+| `test_gitignore_patterns` | Test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules |
 
 ### Data (8 tools)
 | Tool | Description |

package/dist/index.js

@@ -6421,5 +6421,180 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _MAX_COOKIE_AGE_SECONDS_MCP = 400 * 24 * 60 * 60;
+function _checkSetCookieHeaderMcp(header) {
+  if (!header.trim()) return { error: "A Set-Cookie header value is required" };
+  const parts = header.split(";").map((p) => p.trim()).filter(Boolean);
+  const [nameValue, ...attrParts] = parts;
+  const eqIdx = nameValue.indexOf("=");
+  if (eqIdx === -1) return { error: "Missing name=value pair" };
+  const name = nameValue.slice(0, eqIdx).trim();
+  const value = nameValue.slice(eqIdx + 1).trim();
+  if (!name) return { error: "Cookie name cannot be empty" };
+  const cookie = {
+    name,
+    value,
+    domain: null,
+    path: null,
+    expires: null,
+    maxAge: null,
+    secure: false,
+    httpOnly: false,
+    sameSite: null
+  };
+  for (const attr of attrParts) {
+    const idx = attr.indexOf("=");
+    const key = (idx === -1 ? attr : attr.slice(0, idx)).trim().toLowerCase();
+    const val = idx === -1 ? "" : attr.slice(idx + 1).trim();
+    switch (key) {
+      case "domain":
+        cookie.domain = val || null;
+        break;
+      case "path":
+        cookie.path = val || null;
+        break;
+      case "expires":
+        cookie.expires = val || null;
+        break;
+      case "max-age": {
+        const n = Number(val);
+        cookie.maxAge = Number.isFinite(n) ? n : null;
+        break;
+      }
+      case "secure":
+        cookie.secure = true;
+        break;
+      case "httponly":
+        cookie.httpOnly = true;
+        break;
+      case "samesite": {
+        const normalized = val.toLowerCase();
+        if (normalized === "strict") cookie.sameSite = "Strict";
+        else if (normalized === "lax") cookie.sameSite = "Lax";
+        else if (normalized === "none") cookie.sameSite = "None";
+        break;
+      }
+    }
+  }
+  const issues = [];
+  const warnings = [];
+  if (cookie.sameSite === "None" && !cookie.secure) {
+    issues.push("SameSite=None requires the Secure attribute \u2014 modern browsers reject this cookie without it.");
+  }
+  if (name.startsWith("__Host-")) {
+    if (!cookie.secure) issues.push("__Host- prefixed cookies require the Secure attribute.");
+    if (cookie.domain) issues.push("__Host- prefixed cookies must not set a Domain attribute.");
+    if (cookie.path !== "/") issues.push("__Host- prefixed cookies must set Path=/.");
+  } else if (name.startsWith("__Secure-")) {
+    if (!cookie.secure) issues.push("__Secure- prefixed cookies require the Secure attribute.");
+  }
+  if (!cookie.secure) {
+    warnings.push("Missing Secure attribute \u2014 the cookie can be sent over a plain HTTP connection.");
+  }
+  if (cookie.maxAge !== null && cookie.maxAge > _MAX_COOKIE_AGE_SECONDS_MCP) {
+    warnings.push(`Max-Age (${cookie.maxAge}s) exceeds 400 days \u2014 Chromium-based browsers clamp cookie expiry to 400 days from when it's set, so this will be shortened.`);
+  }
+  return { cookie, issues, warnings, valid: issues.length === 0 };
+}
+server.tool(
+  "check_set_cookie_header",
+  "Parse a Set-Cookie header value and validate its attribute combination: SameSite=None requires Secure, the __Host-/__Secure- name prefixes each require their own attributes (__Host- additionally forbids Domain and requires Path=/), a missing Secure attribute is flagged, and a Max-Age beyond 400 days is flagged since Chromium-based browsers clamp it to that cap.",
+  {
+    header: z.string().describe('The Set-Cookie header value to parse and validate, e.g. "session=abc123; Secure; SameSite=None"')
+  },
+  async ({ header }) => {
+    const result = _checkSetCookieHeaderMcp(header);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _globSegmentToRegexSourceMcp(segment) {
+  let out = "";
+  for (let i = 0; i < segment.length; i++) {
+    const c = segment[i];
+    if (c === "*") {
+      out += "[^/]*";
+    } else if (c === "?") {
+      out += "[^/]";
+    } else if (c === "[") {
+      const close = segment.indexOf("]", i + 1);
+      if (close === -1) {
+        out += "\\[";
+      } else {
+        let cls = segment.slice(i + 1, close);
+        if (cls.startsWith("!")) cls = "^" + cls.slice(1);
+        out += `[${cls}]`;
+        i = close;
+      }
+    } else {
+      out += c.replace(/[.+^${}()|\\]/g, "\\$&");
+    }
+  }
+  return out;
+}
+function _compileGitignorePatternMcp(raw, line) {
+  let pattern = raw.replace(/\s+$/, "");
+  if (!pattern || pattern.startsWith("#")) return null;
+  let negate = false;
+  if (pattern.startsWith("!")) {
+    negate = true;
+    pattern = pattern.slice(1);
+  }
+  pattern = pattern.replace(/\\(.)/g, "$1");
+  if (!pattern) return null;
+  const dirOnly = pattern.endsWith("/") && !pattern.endsWith("\\/");
+  if (dirOnly) pattern = pattern.slice(0, -1);
+  const hasLeadingSlash = pattern.startsWith("/");
+  if (hasLeadingSlash) pattern = pattern.slice(1);
+  const anchored = hasLeadingSlash || pattern.includes("/");
+  const segments = pattern.split("/");
+  const regexParts = segments.map((seg) => {
+    if (seg === "**") return "(?:.*)";
+    return _globSegmentToRegexSourceMcp(seg);
+  });
+  let body = regexParts.join("/");
+  body = body.replace(/\(\?:\.\*\)\//g, "(?:.*/)?").replace(/\/\(\?:\.\*\)/g, "(?:/.*)?");
+  const prefix = anchored ? "^" : "^(?:.*/)?";
+  const suffix = "(?:/.*)?$";
+  const regex = new RegExp(prefix + body + suffix);
+  return { raw, line, negate, regex };
+}
+function _testGitignorePatternsMcp(gitignoreContent, paths) {
+  if (!gitignoreContent.trim()) return { error: "gitignore content is required" };
+  if (paths.length === 0) return { error: "At least one path is required" };
+  const lines = gitignoreContent.split("\n");
+  const patterns = [];
+  lines.forEach((line, idx) => {
+    const compiled = _compileGitignorePatternMcp(line, idx + 1);
+    if (compiled) patterns.push(compiled);
+  });
+  return paths.map((rawPath) => {
+    const path = rawPath.trim().replace(/^\.\//, "");
+    let ignored = false;
+    let matchedPattern = null;
+    let matchedLine = null;
+    for (const p of patterns) {
+      if (p.regex.test(path)) {
+        ignored = !p.negate;
+        matchedPattern = p.raw.trim();
+        matchedLine = p.line;
+      }
+    }
+    return { path, ignored, matchedPattern, matchedLine };
+  });
+}
+server.tool(
+  "test_gitignore_patterns",
+  "Test a list of paths against a .gitignore file's contents, following git's matching rules: a leading `!` negates a pattern, a trailing `/` restricts a pattern to directories, and a pattern with no interior `/` can match at any depth. The last matching pattern wins. Does not replicate git's rule that a negation cannot re-include a file whose parent directory was already excluded.",
+  {
+    gitignore: z.string().describe("The .gitignore file contents"),
+    paths: z.array(z.string()).min(1).describe('Relative, forward-slash separated paths to test; use a trailing "/" to mark a directory')
+  },
+  async ({ gitignore, paths }) => {
+    const result = _testGitignorePatternsMcp(gitignore, paths);
+    if (!Array.isArray(result) && "error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "MCP server exposing 152 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",