@utilix-tech/mcp 0.37.0 → 0.39.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.39.0
+- Add `compare_unit_prices` tool: compare two or more package options by price and quantity to find the true cost per unit, flag the cheapest, and report how much more expensive each other option is by percentage.
+- Add `csv_to_sql_insert` tool: convert CSV data with a header row into parameterless SQL INSERT statements, with basic type inference (numbers/booleans unquoted, empty cells NULL) and ANSI/MySQL identifier quoting.
+
+## 0.38.0
+- Add `check_set_cookie_header` tool: parse a Set-Cookie header value and validate its attribute combination, flagging SameSite=None missing Secure, __Host-/__Secure- prefix violations, a missing Secure attribute, and a Max-Age past 400 days.
+- Add `test_gitignore_patterns` tool: test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules, and report which pattern and line number decided each path's outcome.
+
 ## 0.37.0
 - Add `build_link_header` tool: build an HTTP Link response header from URL/rel pairs (preload, preconnect, prefetch, canonical, pagination, etc.), including the as/type/crossorigin attributes preload needs, plus a plain-English explanation of each entry and warnings for common mistakes like a preload missing `as`.
 

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 159 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 163 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -157,7 +157,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `convert_timezone` | Convert a date/time between timezones |
 | `convert_iso8601_duration` | Parse an ISO 8601 duration into components and total seconds, or format seconds into a duration string |
 
-### Units (23 tools)
+### Units (24 tools)
 | Tool | Description |
 |------|-------------|
 | `convert_bytes` | Convert between B, KB, MB, GB, TB, KiB, MiB, GiB, TiB |
@@ -183,8 +183,9 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_emi` | Compute the Equated Monthly Installment for a loan from principal, annual rate, and tenure in years or months, with a year-by-year principal/interest breakdown |
 | `calculate_savings_goal` | Solve for months to reach a savings goal at a fixed monthly contribution, or the monthly contribution required to hit a goal by a target month count |
 | `calculate_roi` | Compute return on investment percent from an initial and final value, plus the annualized (CAGR) return given an optional holding period in years |
+| `compare_unit_prices` | Compare two or more package options by price and quantity to find the true cost per unit, flag the cheapest, and report how much more expensive each other option is |
 
-### API / Network (14 tools)
+### API / Network (15 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -201,6 +202,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `build_referrer_policy` | Build and explain an HTTP Referrer-Policy header from one or more fallback-chain policy tokens |
 | `parse_ipv6_address` | Expand an IPv6 address to its full 8-group form or compress it to its RFC 5952 canonical shortest form, classify its address type, and handle an embedded IPv4 suffix or zone ID |
 | `build_link_header` | Build and explain an HTTP Link response header from URL/rel pairs (preload, preconnect, prefetch, canonical, pagination, etc.) |
+| `check_set_cookie_header` | Parse a Set-Cookie header and validate its attribute combination: SameSite=None requires Secure, __Host-/__Secure- prefix rules, missing Secure, overly long Max-Age |
 
 ### Color (4 tools)
 | Tool | Description |
@@ -210,7 +212,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (11 tools)
+### Code (12 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -224,8 +226,9 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_github_url` | Parse a github.com URL (repo, pull request, issue, commit, file, or release) into structured components |
 | `detect_redos` | Statically flag catastrophic-backtracking (ReDoS) risk in a regex: nested quantifiers, overlapping alternation, adjacent overlapping quantifiers |
 | `lint_conventional_commit` | Lint a commit message against the Conventional Commits v1.0.0 spec: header format, blank-line separation, footer tokens, and BREAKING CHANGE casing |
+| `test_gitignore_patterns` | Test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules |
 
-### Data (8 tools)
+### Data (9 tools)
 | Tool | Description |
 |------|-------------|
 | `validate_yaml` | Validate YAML syntax |
@@ -236,6 +239,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `diff_env_example` | Diff a .env file against its .env.example template: flags keys missing from either side, plus empty placeholder values |
 | `parse_markdown_front_matter` | Split a Markdown document into its YAML front matter fields and body content |
 | `generate_markdown_toc` | Scan a Markdown document's ATX headings and build a nested table of contents with GitHub-style anchor slugs |
+| `csv_to_sql_insert` | Convert CSV data with a header row into parameterless SQL INSERT statements, with basic type inference and ANSI/MySQL identifier quoting |
 
 ### CSS (2 tools)
 | Tool | Description |

package/dist/index.js

@@ -6421,5 +6421,299 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _MAX_COOKIE_AGE_SECONDS_MCP = 400 * 24 * 60 * 60;
+function _checkSetCookieHeaderMcp(header) {
+  if (!header.trim()) return { error: "A Set-Cookie header value is required" };
+  const parts = header.split(";").map((p) => p.trim()).filter(Boolean);
+  const [nameValue, ...attrParts] = parts;
+  const eqIdx = nameValue.indexOf("=");
+  if (eqIdx === -1) return { error: "Missing name=value pair" };
+  const name = nameValue.slice(0, eqIdx).trim();
+  const value = nameValue.slice(eqIdx + 1).trim();
+  if (!name) return { error: "Cookie name cannot be empty" };
+  const cookie = {
+    name,
+    value,
+    domain: null,
+    path: null,
+    expires: null,
+    maxAge: null,
+    secure: false,
+    httpOnly: false,
+    sameSite: null
+  };
+  for (const attr of attrParts) {
+    const idx = attr.indexOf("=");
+    const key = (idx === -1 ? attr : attr.slice(0, idx)).trim().toLowerCase();
+    const val = idx === -1 ? "" : attr.slice(idx + 1).trim();
+    switch (key) {
+      case "domain":
+        cookie.domain = val || null;
+        break;
+      case "path":
+        cookie.path = val || null;
+        break;
+      case "expires":
+        cookie.expires = val || null;
+        break;
+      case "max-age": {
+        const n = Number(val);
+        cookie.maxAge = Number.isFinite(n) ? n : null;
+        break;
+      }
+      case "secure":
+        cookie.secure = true;
+        break;
+      case "httponly":
+        cookie.httpOnly = true;
+        break;
+      case "samesite": {
+        const normalized = val.toLowerCase();
+        if (normalized === "strict") cookie.sameSite = "Strict";
+        else if (normalized === "lax") cookie.sameSite = "Lax";
+        else if (normalized === "none") cookie.sameSite = "None";
+        break;
+      }
+    }
+  }
+  const issues = [];
+  const warnings = [];
+  if (cookie.sameSite === "None" && !cookie.secure) {
+    issues.push("SameSite=None requires the Secure attribute \u2014 modern browsers reject this cookie without it.");
+  }
+  if (name.startsWith("__Host-")) {
+    if (!cookie.secure) issues.push("__Host- prefixed cookies require the Secure attribute.");
+    if (cookie.domain) issues.push("__Host- prefixed cookies must not set a Domain attribute.");
+    if (cookie.path !== "/") issues.push("__Host- prefixed cookies must set Path=/.");
+  } else if (name.startsWith("__Secure-")) {
+    if (!cookie.secure) issues.push("__Secure- prefixed cookies require the Secure attribute.");
+  }
+  if (!cookie.secure) {
+    warnings.push("Missing Secure attribute \u2014 the cookie can be sent over a plain HTTP connection.");
+  }
+  if (cookie.maxAge !== null && cookie.maxAge > _MAX_COOKIE_AGE_SECONDS_MCP) {
+    warnings.push(`Max-Age (${cookie.maxAge}s) exceeds 400 days \u2014 Chromium-based browsers clamp cookie expiry to 400 days from when it's set, so this will be shortened.`);
+  }
+  return { cookie, issues, warnings, valid: issues.length === 0 };
+}
+server.tool(
+  "check_set_cookie_header",
+  "Parse a Set-Cookie header value and validate its attribute combination: SameSite=None requires Secure, the __Host-/__Secure- name prefixes each require their own attributes (__Host- additionally forbids Domain and requires Path=/), a missing Secure attribute is flagged, and a Max-Age beyond 400 days is flagged since Chromium-based browsers clamp it to that cap.",
+  {
+    header: z.string().describe('The Set-Cookie header value to parse and validate, e.g. "session=abc123; Secure; SameSite=None"')
+  },
+  async ({ header }) => {
+    const result = _checkSetCookieHeaderMcp(header);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _globSegmentToRegexSourceMcp(segment) {
+  let out = "";
+  for (let i = 0; i < segment.length; i++) {
+    const c = segment[i];
+    if (c === "*") {
+      out += "[^/]*";
+    } else if (c === "?") {
+      out += "[^/]";
+    } else if (c === "[") {
+      const close = segment.indexOf("]", i + 1);
+      if (close === -1) {
+        out += "\\[";
+      } else {
+        let cls = segment.slice(i + 1, close);
+        if (cls.startsWith("!")) cls = "^" + cls.slice(1);
+        out += `[${cls}]`;
+        i = close;
+      }
+    } else {
+      out += c.replace(/[.+^${}()|\\]/g, "\\$&");
+    }
+  }
+  return out;
+}
+function _compileGitignorePatternMcp(raw, line) {
+  let pattern = raw.replace(/\s+$/, "");
+  if (!pattern || pattern.startsWith("#")) return null;
+  let negate = false;
+  if (pattern.startsWith("!")) {
+    negate = true;
+    pattern = pattern.slice(1);
+  }
+  pattern = pattern.replace(/\\(.)/g, "$1");
+  if (!pattern) return null;
+  const dirOnly = pattern.endsWith("/") && !pattern.endsWith("\\/");
+  if (dirOnly) pattern = pattern.slice(0, -1);
+  const hasLeadingSlash = pattern.startsWith("/");
+  if (hasLeadingSlash) pattern = pattern.slice(1);
+  const anchored = hasLeadingSlash || pattern.includes("/");
+  const segments = pattern.split("/");
+  const regexParts = segments.map((seg) => {
+    if (seg === "**") return "(?:.*)";
+    return _globSegmentToRegexSourceMcp(seg);
+  });
+  let body = regexParts.join("/");
+  body = body.replace(/\(\?:\.\*\)\//g, "(?:.*/)?").replace(/\/\(\?:\.\*\)/g, "(?:/.*)?");
+  const prefix = anchored ? "^" : "^(?:.*/)?";
+  const suffix = "(?:/.*)?$";
+  const regex = new RegExp(prefix + body + suffix);
+  return { raw, line, negate, regex };
+}
+function _testGitignorePatternsMcp(gitignoreContent, paths) {
+  if (!gitignoreContent.trim()) return { error: "gitignore content is required" };
+  if (paths.length === 0) return { error: "At least one path is required" };
+  const lines = gitignoreContent.split("\n");
+  const patterns = [];
+  lines.forEach((line, idx) => {
+    const compiled = _compileGitignorePatternMcp(line, idx + 1);
+    if (compiled) patterns.push(compiled);
+  });
+  return paths.map((rawPath) => {
+    const path = rawPath.trim().replace(/^\.\//, "");
+    let ignored = false;
+    let matchedPattern = null;
+    let matchedLine = null;
+    for (const p of patterns) {
+      if (p.regex.test(path)) {
+        ignored = !p.negate;
+        matchedPattern = p.raw.trim();
+        matchedLine = p.line;
+      }
+    }
+    return { path, ignored, matchedPattern, matchedLine };
+  });
+}
+server.tool(
+  "test_gitignore_patterns",
+  "Test a list of paths against a .gitignore file's contents, following git's matching rules: a leading `!` negates a pattern, a trailing `/` restricts a pattern to directories, and a pattern with no interior `/` can match at any depth. The last matching pattern wins. Does not replicate git's rule that a negation cannot re-include a file whose parent directory was already excluded.",
+  {
+    gitignore: z.string().describe("The .gitignore file contents"),
+    paths: z.array(z.string()).min(1).describe('Relative, forward-slash separated paths to test; use a trailing "/" to mark a directory')
+  },
+  async ({ gitignore, paths }) => {
+    const result = _testGitignorePatternsMcp(gitignore, paths);
+    if (!Array.isArray(result) && "error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _compareUnitPricesMcp(items) {
+  if (!Array.isArray(items) || items.length < 2) {
+    return { error: "At least 2 items are required to compare" };
+  }
+  for (const item of items) {
+    if (!item.label || typeof item.label !== "string") {
+      return { error: "Each item must have a non-empty label" };
+    }
+    if (typeof item.price !== "number" || !Number.isFinite(item.price) || item.price <= 0) {
+      return { error: `Item "${item.label}" must have a price greater than zero` };
+    }
+    if (typeof item.quantity !== "number" || !Number.isFinite(item.quantity) || item.quantity <= 0) {
+      return { error: `Item "${item.label}" must have a quantity greater than zero` };
+    }
+  }
+  const round4 = (n) => Math.round(n * 1e4) / 1e4;
+  const unitPrices = items.map((item) => item.price / item.quantity);
+  const bestUnitPrice = Math.min(...unitPrices);
+  const results = items.map((item, i) => ({
+    label: item.label,
+    price: round4(item.price),
+    quantity: round4(item.quantity),
+    unitPrice: round4(unitPrices[i]),
+    isBest: unitPrices[i] === bestUnitPrice,
+    percentMoreThanBest: round4((unitPrices[i] - bestUnitPrice) / bestUnitPrice * 100)
+  }));
+  const bestLabel = results.find((r) => r.isBest).label;
+  return { items: results, bestLabel };
+}
+server.tool(
+  "compare_unit_prices",
+  "Compare two or more package options by price and quantity to find the true cost per unit (price / quantity) for each, flag the cheapest, and report how much more expensive each other option is by percentage. Unit-agnostic: pass quantity in whatever unit makes the options comparable (grams, litres, item count, etc.), no conversion is done.",
+  {
+    items: z.array(z.object({
+      label: z.string().describe("Name for this option"),
+      price: z.number().describe("Total price of this option (must be greater than zero)"),
+      quantity: z.number().describe("Quantity in whatever unit makes options comparable (must be greater than zero)")
+    })).min(2).describe("Two or more package options to compare")
+  },
+  async ({ items }) => {
+    const result = _compareUnitPricesMcp(items);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _parseCsvRowForSqlMcp(line, delimiter) {
+  const fields = [];
+  let cur = "";
+  let inQuote = false;
+  for (let i = 0; i < line.length; i++) {
+    if (line[i] === '"') {
+      if (inQuote && line[i + 1] === '"') {
+        cur += '"';
+        i++;
+      } else inQuote = !inQuote;
+    } else if (line[i] === delimiter && !inQuote) {
+      fields.push(cur);
+      cur = "";
+    } else {
+      cur += line[i];
+    }
+  }
+  fields.push(cur);
+  return fields;
+}
+function _quoteSqlIdentifierMcp(name, dialect) {
+  if (dialect === "mysql") return "`" + name.replace(/`/g, "``") + "`";
+  return '"' + name.replace(/"/g, '""') + '"';
+}
+function _formatSqlValueMcp(raw) {
+  const trimmed = raw.trim();
+  if (trimmed === "") return "NULL";
+  if (/^-?\d+(\.\d+)?$/.test(trimmed)) return trimmed;
+  if (/^(true|false)$/i.test(trimmed)) return trimmed.toLowerCase();
+  return "'" + trimmed.replace(/'/g, "''") + "'";
+}
+function _csvToSqlInsertMcp(input, tableName, dialect, batchSize) {
+  if (!input || input.trim() === "") return { error: "Input is empty" };
+  const lines = input.replace(/\r\n/g, "\n").split("\n").filter((l) => l.trim() !== "");
+  if (lines.length === 0) return { error: "No data found" };
+  const allRows = lines.map((l) => _parseCsvRowForSqlMcp(l, ","));
+  const headers = allRows[0].map((h) => h.trim());
+  const rows = allRows.slice(1);
+  const table = (tableName ?? "").trim() || "my_table";
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(table)) {
+    return { error: "tableName must start with a letter or underscore and contain only letters, digits, and underscores" };
+  }
+  const dial = dialect === "mysql" ? "mysql" : "ansi";
+  const batch = batchSize !== void 0 && Number.isFinite(batchSize) && batchSize > 0 ? Math.floor(batchSize) : 1;
+  const quotedTable = _quoteSqlIdentifierMcp(table, dial);
+  const quotedColumns = headers.map((h) => _quoteSqlIdentifierMcp(h, dial)).join(", ");
+  const statements = [];
+  for (let i = 0; i < rows.length; i += batch) {
+    const chunk = rows.slice(i, i + batch);
+    const tuples = chunk.map((row) => "(" + headers.map((_, idx) => _formatSqlValueMcp(row[idx] ?? "")).join(", ") + ")");
+    statements.push(`INSERT INTO ${quotedTable} (${quotedColumns}) VALUES ${tuples.join(", ")};`);
+  }
+  return {
+    sql: statements.join("\n"),
+    rowCount: rows.length,
+    columnCount: headers.length,
+    columns: headers
+  };
+}
+server.tool(
+  "csv_to_sql_insert",
+  "Paste CSV data and get parameterless SQL INSERT statements back, with basic type inference: unquoted for integers/decimals and true/false, NULL for empty cells, single-quoted (with '' escaping) for everything else. Column and table identifiers are quoted per the chosen dialect so reserved words and mixed-case names round-trip safely.",
+  {
+    csv: z.string().describe("CSV data with a header row"),
+    tableName: z.string().optional().describe('Target table name, must be a valid SQL identifier (default "my_table")'),
+    dialect: z.enum(["ansi", "mysql"]).optional().describe('Identifier quoting style: ANSI double quotes or MySQL backticks (default "ansi")'),
+    batchSize: z.number().optional().describe("Rows per INSERT statement (default 1, one statement per row)")
+  },
+  async ({ csv, tableName, dialect, batchSize }) => {
+    const result = _csvToSqlInsertMcp(csv, tableName, dialect, batchSize);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.37.0",
+  "version": "0.39.0",
   "description": "MCP server exposing 152 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",