@utilix-tech/mcp 0.44.0 → 0.45.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.45.0
+- Add `build_permissions_policy`, `parse_permissions_policy` tools: build a `Permissions-Policy` response header from browser features and their per-feature allowlist with a plain-English note per feature, or parse an existing one into the same shape.
+- Add `calculate_payback_period` tool: compute the simple and discounted payback period from an initial investment and a series of periodic cash flows.
+
 ## 0.44.0
 - Add `validate_manifest` tool: validate a web app manifest.json against the W3C Web App Manifest spec's installability requirements, including a 512x512 icon and a maskable icon check.
 - Add `lint_tool_schema` tool: lint an LLM tool/function-calling definition (OpenAI, Anthropic, or MCP format) for missing descriptions, invalid names, empty enums, and required/properties mismatches.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 175 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 178 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -159,7 +159,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `convert_timezone` | Convert a date/time between timezones |
 | `convert_iso8601_duration` | Parse an ISO 8601 duration into components and total seconds, or format seconds into a duration string |
 
-### Units (26 tools)
+### Units (27 tools)
 | Tool | Description |
 |------|-------------|
 | `convert_bytes` | Convert between B, KB, MB, GB, TB, KiB, MiB, GiB, TiB |
@@ -188,8 +188,9 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `compare_unit_prices` | Compare two or more package options by price and quantity to find the true cost per unit, flag the cheapest, and report how much more expensive each other option is |
 | `calculate_cash_breakdown` | Break a cash amount down into the minimum count of bills/coins from a set of denominations, largest first |
 | `calculate_change` | Compute change owed for a payment/tender pair and break it down into the minimum count of bills/coins |
+| `calculate_payback_period` | Compute the simple and discounted payback period from an initial investment and a series of periodic cash flows |
 
-### API / Network (21 tools)
+### API / Network (23 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -213,6 +214,8 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `build_vary_header` | Build a Vary response header from request-header names, with a plain-English caching note per header |
 | `parse_vary_header` | Parse an existing Vary header value into its individual header names, each with a caching note |
 | `validate_manifest` | Validate a web app manifest.json against the W3C spec's installability requirements: name/short_name, start_url, display mode, and icon coverage |
+| `build_permissions_policy` | Build a Permissions-Policy response header from browser features and their per-feature allowlist, with a plain-English note per feature |
+| `parse_permissions_policy` | Parse an existing Permissions-Policy header value into its individual feature directives, each with a plain-English note |
 
 ### Color (4 tools)
 | Tool | Description |

package/dist/index.js

@@ -7436,5 +7436,199 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _PERMISSIONS_POLICY_NOTES_MCP = {
+  camera: "Controls access to video capture devices (getUserMedia video).",
+  microphone: "Controls access to audio capture devices (getUserMedia audio).",
+  geolocation: "Controls access to the Geolocation API.",
+  autoplay: "Controls whether media elements can autoplay without a user gesture.",
+  fullscreen: "Controls access to the Fullscreen API (requestFullscreen).",
+  payment: "Controls access to the Payment Request API.",
+  usb: "Controls access to the WebUSB API.",
+  accelerometer: "Controls access to the Accelerometer sensor API.",
+  gyroscope: "Controls access to the Gyroscope sensor API.",
+  magnetometer: "Controls access to the Magnetometer sensor API.",
+  midi: "Controls access to the Web MIDI API.",
+  "picture-in-picture": "Controls whether video elements can enter picture-in-picture mode.",
+  "sync-xhr": "Controls whether synchronous XMLHttpRequest is allowed.",
+  "display-capture": "Controls access to screen/tab capture (getDisplayMedia).",
+  "encrypted-media": "Controls access to the Encrypted Media Extensions API (DRM playback).",
+  "clipboard-read": "Controls read access to the async Clipboard API.",
+  "clipboard-write": "Controls write access to the async Clipboard API.",
+  "screen-wake-lock": "Controls access to the Screen Wake Lock API.",
+  "web-share": "Controls access to the Web Share API.",
+  "xr-spatial-tracking": "Controls access to WebXR device sensors and spatial tracking."
+};
+function _formatPermissionsPolicyAllowlistMcp(allowlist) {
+  if (allowlist.includes("*")) return "*";
+  if (allowlist.length === 0) return "()";
+  return "(" + allowlist.map((o) => o === "self" ? "self" : `"${o}"`).join(" ") + ")";
+}
+function _buildPermissionsPolicyMcp(features) {
+  if (!Array.isArray(features) || features.length === 0) return { error: "At least one feature is required" };
+  const warnings = [];
+  const seen = /* @__PURE__ */ new Map();
+  for (const f of features) {
+    if (!f || typeof f.feature !== "string" || f.feature.trim() === "") continue;
+    const name = f.feature.trim().toLowerCase();
+    const allowlist = Array.isArray(f.allowlist) ? f.allowlist.map((o) => typeof o === "string" ? o.trim() : "").filter((o) => o.length > 0) : [];
+    if (seen.has(name)) warnings.push(`duplicate feature "${name}" was merged, the last occurrence wins`);
+    seen.set(name, { feature: name, allowlist });
+  }
+  if (seen.size === 0) return { error: "At least one feature is required" };
+  const directives = [];
+  for (const { feature, allowlist } of seen.values()) {
+    if (!_PERMISSIONS_POLICY_NOTES_MCP[feature]) {
+      warnings.push(`"${feature}" is not a widely recognized feature name, it will still be included as written`);
+    }
+    if (allowlist.includes("*") && allowlist.length > 1) {
+      warnings.push(`"${feature}" combines "*" with other origins; "*" already allows every origin so the others are redundant`);
+    }
+    const invalidOrigin = allowlist.find((o) => o !== "self" && o !== "*" && !/^https?:\/\//i.test(o));
+    if (invalidOrigin) {
+      warnings.push(`"${invalidOrigin}" on "${feature}" doesn't look like an origin (expected "self", "*", or an http(s):// URL); it will still be quoted as written`);
+    }
+    directives.push({
+      feature,
+      value: _formatPermissionsPolicyAllowlistMcp(allowlist),
+      note: _PERMISSIONS_POLICY_NOTES_MCP[feature] ?? `Controls access to the "${feature}" feature.`
+    });
+  }
+  const headerValue = directives.map((d) => `${d.feature}=${d.value}`).join(", ");
+  return { header: `Permissions-Policy: ${headerValue}`, headerValue, directives, warnings };
+}
+function _splitPermissionsPolicyTopLevelMcp(input) {
+  const segments = [];
+  let depth = 0;
+  let current = "";
+  for (const ch of input) {
+    if (ch === "(") depth++;
+    if (ch === ")") depth--;
+    if (ch === "," && depth === 0) {
+      if (current.trim()) segments.push(current.trim());
+      current = "";
+    } else {
+      current += ch;
+    }
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+function _parsePermissionsPolicyAllowlistMcp(rawValue) {
+  if (rawValue === "*") return ["*"];
+  if (rawValue === "()" || rawValue === "") return [];
+  const inner = rawValue.replace(/^\(/, "").replace(/\)$/, "");
+  const tokens = inner.match(/"[^"]*"|\S+/g) ?? [];
+  return tokens.map((t) => t.replace(/^"|"$/g, ""));
+}
+function _parsePermissionsPolicyMcp(raw) {
+  if (!raw || raw.trim() === "") return { error: "Input is empty" };
+  const withoutLabel = raw.trim().replace(/^permissions-policy:\s*/i, "");
+  const segments = _splitPermissionsPolicyTopLevelMcp(withoutLabel);
+  if (segments.length === 0) return { error: "No directives found" };
+  const features = [];
+  for (const segment of segments) {
+    const eq = segment.indexOf("=");
+    if (eq === -1) continue;
+    const feature = segment.slice(0, eq).trim();
+    const rawValue = segment.slice(eq + 1).trim();
+    features.push({ feature, allowlist: _parsePermissionsPolicyAllowlistMcp(rawValue) });
+  }
+  if (features.length === 0) return { error: "No directives found" };
+  return _buildPermissionsPolicyMcp(features);
+}
+server.tool(
+  "build_permissions_policy",
+  'Build a Permissions-Policy response-header value from a list of browser features (e.g. camera, microphone, geolocation) and their per-feature allowlist ("self", specific origins, "*" for all origins, or an empty allowlist to disable the feature entirely), attaching a plain-English note on what each feature restricts.',
+  {
+    features: z.array(z.object({
+      feature: z.string().describe('The Permissions-Policy feature name, e.g. "camera"'),
+      allowlist: z.array(z.string()).describe('Origins allowed to use the feature: "self", "*" for all origins, specific https:// origins, or an empty array to disable it entirely')
+    })).min(1).describe("Features and their allowlists to include in the header")
+  },
+  async ({ features }) => {
+    const result = _buildPermissionsPolicyMcp(features);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+server.tool(
+  "parse_permissions_policy",
+  'Parse an existing Permissions-Policy header value (with or without a leading "Permissions-Policy:" label) into its individual feature directives, each with a plain-English note on what it restricts.',
+  {
+    header: z.string().min(1).describe("The Permissions-Policy header value to parse")
+  },
+  async ({ header }) => {
+    const result = _parsePermissionsPolicyMcp(header);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _computePaybackMcp(initialInvestment, flows) {
+  const round4 = (n) => Math.round(n * 1e4) / 1e4;
+  let cumulative = 0;
+  const cumulativeCashFlows = [];
+  let period = null;
+  for (let i = 0; i < flows.length; i++) {
+    const prevCumulative = cumulative;
+    cumulative += flows[i];
+    cumulativeCashFlows.push(round4(cumulative));
+    if (period === null && cumulative >= initialInvestment) {
+      const remaining = initialInvestment - prevCumulative;
+      const fraction = flows[i] !== 0 ? remaining / flows[i] : 0;
+      period = i + fraction;
+    }
+  }
+  return { cumulative: cumulativeCashFlows, period };
+}
+function _calculatePaybackPeriodMcp(initialInvestment, cashFlows, discountRatePercent) {
+  const round4 = (n) => Math.round(n * 1e4) / 1e4;
+  if (typeof initialInvestment !== "number" || !Number.isFinite(initialInvestment) || initialInvestment <= 0) {
+    return { error: "initialInvestment must be a finite number greater than zero" };
+  }
+  if (!Array.isArray(cashFlows) || cashFlows.length === 0) {
+    return { error: "cashFlows must be a non-empty array of numbers" };
+  }
+  if (cashFlows.some((f) => typeof f !== "number" || !Number.isFinite(f))) {
+    return { error: "Every cash flow must be a finite number" };
+  }
+  const { cumulative, period } = _computePaybackMcp(initialInvestment, cashFlows);
+  const result = {
+    initialInvestment: round4(initialInvestment),
+    cashFlows: cashFlows.map(round4),
+    cumulativeCashFlows: cumulative,
+    paybackPeriod: period !== null ? round4(period) : null,
+    paybackPeriodRounded: period !== null ? Math.ceil(period) : null,
+    recovered: period !== null
+  };
+  if (discountRatePercent !== void 0) {
+    if (typeof discountRatePercent !== "number" || !Number.isFinite(discountRatePercent) || discountRatePercent < 0) {
+      return { error: "discountRatePercent must be a finite, non-negative number when provided" };
+    }
+    const r = discountRatePercent / 100;
+    const discountedCashFlows = cashFlows.map((f, i) => f / Math.pow(1 + r, i + 1));
+    const { cumulative: discountedCumulative, period: discountedPeriod } = _computePaybackMcp(initialInvestment, discountedCashFlows);
+    result.discountRatePercent = round4(discountRatePercent);
+    result.discountedCashFlows = discountedCashFlows.map(round4);
+    result.discountedCumulativeCashFlows = discountedCumulative;
+    result.discountedPaybackPeriod = discountedPeriod !== null ? round4(discountedPeriod) : null;
+    result.discountedPaybackPeriodRounded = discountedPeriod !== null ? Math.ceil(discountedPeriod) : null;
+    result.discountedRecovered = discountedPeriod !== null;
+  }
+  return result;
+}
+server.tool(
+  "calculate_payback_period",
+  "From an initial investment and a series of periodic cash flows, compute the simple payback period (the point where cumulative cash flow turns positive), plus the discounted payback period when a discount rate is supplied. Pure arithmetic over a running cumulative sum, no live rate feed.",
+  {
+    initialInvestment: z.number().describe("The initial investment amount (must be greater than zero)"),
+    cashFlows: z.array(z.number()).min(1).describe("Net cash flow for each period, in order"),
+    discountRatePercent: z.number().optional().describe("Optional discount rate per period, as a percent; when provided, also computes the discounted payback period")
+  },
+  async ({ initialInvestment, cashFlows, discountRatePercent }) => {
+    const result = _calculatePaybackPeriodMcp(initialInvestment, cashFlows, discountRatePercent);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "MCP server exposing 175 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",