@utilix-tech/mcp 0.53.0 → 0.55.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.55.0
+- Add `validate_package_exports` tool: parse a package.json's exports field and flag common dual-package (ESM/CJS) misconfigurations, a types condition not listed first, a missing default fallback, mismatched require/import extensions, mixed subpath/condition keys, and pattern mismatches.
+- Add `build_x_content_type_options_header` tool: build the fixed X-Content-Type-Options: nosniff header, validate a pasted value, and assess MIME-sniffing risk for a given Content-Type.
+
+## 0.54.0
+- Add `calculate_credit_utilization` tool: compute per-account and overall credit utilization (balance / limit) from one or more credit accounts, plus a qualitative tier matching common credit-scoring guidance.
+- Add `analyze_caption_speed` tool: parse an SRT or WebVTT file and report the words-per-minute reading speed of every cue, flagging ones that exceed common broadcast accessibility guidelines.
+
 ## 0.53.0
 - Add `validate_editorconfig` tool: parse an .editorconfig file into its root flag and glob sections, and flag structural mistakes against the EditorConfig spec.
 - Add `validate_tsconfig` tool: parse a tsconfig.json file as JSONC and flag unknown keys, unknown compilerOptions, and type mismatches against a curated list of known options.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 194 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 198 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -160,7 +160,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `convert_timezone` | Convert a date/time between timezones |
 | `convert_iso8601_duration` | Parse an ISO 8601 duration into components and total seconds, or format seconds into a duration string |
 
-### Units (32 tools)
+### Units (33 tools)
 | Tool | Description |
 |------|-------------|
 | `convert_bytes` | Convert between B, KB, MB, GB, TB, KiB, MiB, GiB, TiB |
@@ -195,8 +195,9 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_cash_rounding` | Round a cashless total to the nearest payable cash denomination ("Swedish rounding"), with round-nearest, round-up, and round-down modes |
 | `calculate_moving_averages` | Compute simple moving average (SMA) and exponential moving average (EMA) series from a list of numbers and a window size |
 | `calculate_gpa` | Compute a weighted GPA from a list of courses, each with a letter grade and credit hours, using the standard 4.0-capped scale |
+| `calculate_credit_utilization` | Compute per-account and overall credit utilization (balance / limit) from one or more credit accounts, plus a qualitative tier matching common credit-scoring guidance |
 
-### API / Network (28 tools)
+### API / Network (29 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -227,6 +228,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_client_hint_headers` | Decode raw Client Hints request-header text into structured values: brand/version pairs, booleans, strings, and numbers |
 | `build_content_disposition` | Build a Content-Disposition response header for a file download or inline display, with an RFC 5987 filename* parameter for non-ASCII filenames |
 | `parse_content_disposition` | Parse a Content-Disposition header value into its disposition type, decoded filename, and raw parameters |
+| `build_x_content_type_options_header` | Build the fixed X-Content-Type-Options: nosniff header, validate a pasted value, or assess MIME-sniffing risk for a given Content-Type |
 
 ### Color (4 tools)
 | Tool | Description |
@@ -236,7 +238,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (14 tools)
+### Code (15 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -253,8 +255,9 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `test_gitignore_patterns` | Test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules |
 | `validate_editorconfig` | Validate an .editorconfig file: root flag, glob sections, and structural mistakes against the EditorConfig spec |
 | `validate_tsconfig` | Validate a tsconfig.json file (JSONC-aware): unknown keys, unknown compilerOptions, and type mismatches |
+| `validate_package_exports` | Validate a package.json "exports" field: dual-package (ESM/CJS) misconfigurations like a missing default fallback or a require/import pointing at the wrong extension |
 
-### Data (12 tools)
+### Data (13 tools)
 | Tool | Description |
 |------|-------------|
 | `validate_yaml` | Validate YAML syntax |
@@ -269,6 +272,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `csv_to_sql_insert` | Convert CSV data with a header row into parameterless SQL INSERT statements, with basic type inference and ANSI/MySQL identifier quoting |
 | `find_csv_duplicate_rows` | Group CSV/TSV rows that share the same value across a chosen set of key columns, or the entire row |
 | `calculate_markdown_task_list_progress` | Parse a Markdown document's checkbox task list and report completion percentage overall and per section, grouped by the nearest preceding heading |
+| `analyze_caption_speed` | Parse an SRT or WebVTT file and report the words-per-minute reading speed of every cue, flagging ones that exceed common broadcast accessibility guidelines |
 
 ### CSS (2 tools)
 | Tool | Description |

package/dist/index.js

@@ -8864,5 +8864,350 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+function _classifyUtilizationMcp(percent) {
+  if (percent < 10) return "excellent";
+  if (percent < 30) return "good";
+  if (percent < 50) return "fair";
+  return "poor";
+}
+function _calculateCreditUtilizationMcp(accounts) {
+  if (!Array.isArray(accounts) || accounts.length === 0) {
+    return { error: "accounts must be a non-empty array" };
+  }
+  const round2 = (n) => Math.round(n * 100) / 100;
+  let totalBalance = 0;
+  let totalLimit = 0;
+  const results = [];
+  for (let i = 0; i < accounts.length; i++) {
+    const account = accounts[i];
+    if (typeof account.balance !== "number" || !Number.isFinite(account.balance) || account.balance < 0) {
+      return { error: `account ${i + 1}: balance must be a finite, non-negative number` };
+    }
+    if (typeof account.limit !== "number" || !Number.isFinite(account.limit) || account.limit <= 0) {
+      return { error: `account ${i + 1}: limit must be a finite number greater than zero` };
+    }
+    const utilizationPercent = round2(account.balance / account.limit * 100);
+    totalBalance += account.balance;
+    totalLimit += account.limit;
+    results.push({
+      label: account.label?.trim() || `Account ${i + 1}`,
+      balance: account.balance,
+      limit: account.limit,
+      utilizationPercent,
+      tier: _classifyUtilizationMcp(utilizationPercent)
+    });
+  }
+  const overallUtilizationPercent = round2(totalBalance / totalLimit * 100);
+  return {
+    accounts: results,
+    totalBalance: round2(totalBalance),
+    totalLimit: round2(totalLimit),
+    overallUtilizationPercent,
+    overallTier: _classifyUtilizationMcp(overallUtilizationPercent)
+  };
+}
+server.tool(
+  "calculate_credit_utilization",
+  "Compute per-account and overall credit utilization (balance / limit) from one or more credit accounts, plus a qualitative tier matching common credit-scoring guidance: under 10% is excellent, under 30% is good (the generally recommended ceiling), under 50% is fair, and 50%+ is poor. Overall utilization is total balance over total limit, not an average of the per-account percentages.",
+  {
+    accounts: z.array(z.object({
+      label: z.string().optional().describe("Optional account label"),
+      balance: z.number().min(0).describe("Current balance on the account"),
+      limit: z.number().positive().describe("Credit limit on the account")
+    })).min(1).describe("A non-empty list of credit accounts")
+  },
+  async ({ accounts }) => {
+    const result = _calculateCreditUtilizationMcp(accounts);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+var _CAPTION_TIMESTAMP_RE_MCP = /(\d+):(\d{1,2}):(\d{1,2})[.,](\d{1,3})|(\d{1,3}):(\d{1,2})[.,](\d{1,3})/;
+var _CAPTION_SKIP_BLOCK_KEYWORDS_MCP = ["NOTE", "STYLE", "REGION"];
+function _parseCaptionTimestampMcp(raw) {
+  const m = _CAPTION_TIMESTAMP_RE_MCP.exec(raw.trim());
+  if (!m || m.index !== 0) return null;
+  let hours, minutes, seconds, millis;
+  if (m[1] !== void 0) {
+    hours = Number(m[1]);
+    minutes = Number(m[2]);
+    seconds = Number(m[3]);
+    millis = m[4];
+  } else {
+    hours = 0;
+    minutes = Number(m[5]);
+    seconds = Number(m[6]);
+    millis = m[7];
+  }
+  if (minutes > 59 || seconds > 59) return null;
+  return hours * 3600 + minutes * 60 + seconds + Number(millis.padEnd(3, "0")) / 1e3;
+}
+function _extractCaptionCuesMcp(input) {
+  const stripped = input.charCodeAt(0) === 65279 ? input.slice(1) : input;
+  let body = stripped.replace(/\r\n?/g, "\n");
+  const headerMatch = /^\s*WEBVTT[^\n]*\n?/.exec(body);
+  if (headerMatch) body = body.slice(headerMatch[0].length);
+  const blocks = body.split(/\n[ \t]*\n+/).map((b) => b.trim()).filter((b) => b.length > 0);
+  const cues = [];
+  for (const block of blocks) {
+    const lines = block.split("\n");
+    const arrowIdx = lines.findIndex((l) => l.includes("-->"));
+    if (arrowIdx === -1) continue;
+    if (_CAPTION_SKIP_BLOCK_KEYWORDS_MCP.some((k) => lines[0] === k || lines[0].startsWith(`${k} `))) continue;
+    const [leftRaw, rightRaw] = lines[arrowIdx].split("-->");
+    const start = _parseCaptionTimestampMcp(leftRaw ?? "");
+    const end = _parseCaptionTimestampMcp((rightRaw ?? "").trim());
+    if (start === null || end === null || end <= start) continue;
+    const text2 = lines.slice(arrowIdx + 1).join(" ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+    if (text2.length === 0) continue;
+    cues.push({ start, end, text: text2 });
+  }
+  return cues;
+}
+function _analyzeCaptionSpeedMcp(input, wpmThreshold, cpsThreshold) {
+  if (typeof input !== "string" || input.trim().length === 0) return { error: "Subtitle input is empty" };
+  if (!Number.isFinite(wpmThreshold) || wpmThreshold <= 0) {
+    return { error: "wpmThreshold must be a finite number greater than zero" };
+  }
+  if (!Number.isFinite(cpsThreshold) || cpsThreshold <= 0) {
+    return { error: "cpsThreshold must be a finite number greater than zero" };
+  }
+  const rawCues = _extractCaptionCuesMcp(input);
+  if (rawCues.length === 0) return { error: "No subtitle cues with timing and text were found" };
+  const round1 = (n) => Math.round(n * 10) / 10;
+  const cues = rawCues.map((cue, i) => {
+    const durationSeconds = cue.end - cue.start;
+    const wordCount = cue.text.split(" ").filter(Boolean).length;
+    const charCount = cue.text.length;
+    const wpm = wordCount / durationSeconds * 60;
+    const charsPerSecond = charCount / durationSeconds;
+    return {
+      index: i + 1,
+      start: round1(cue.start),
+      end: round1(cue.end),
+      text: cue.text,
+      durationSeconds: round1(durationSeconds),
+      wordCount,
+      charCount,
+      wpm: round1(wpm),
+      charsPerSecond: round1(charsPerSecond),
+      exceedsWpm: wpm > wpmThreshold,
+      exceedsCps: charsPerSecond > cpsThreshold
+    };
+  });
+  const wpmValues = cues.map((c) => c.wpm);
+  return {
+    cueCount: cues.length,
+    cues,
+    averageWpm: round1(wpmValues.reduce((a, b) => a + b, 0) / wpmValues.length),
+    maxWpm: round1(Math.max(...wpmValues)),
+    flaggedCount: cues.filter((c) => c.exceedsWpm || c.exceedsCps).length,
+    wpmThreshold,
+    cpsThreshold
+  };
+}
+server.tool(
+  "analyze_caption_speed",
+  "Parse an SRT or WebVTT file and report the words-per-minute reading speed implied by each cue's word count and duration, flagging cues that exceed common broadcast accessibility guidelines (default: ~180 WPM, ~20 characters/second). HTML-style cue tags like <i> are stripped before counting words and characters.",
+  {
+    input: z.string().describe("The SRT or WebVTT file contents"),
+    wpmThreshold: z.number().positive().optional().describe("Words-per-minute above which a cue is flagged (default 180)"),
+    cpsThreshold: z.number().positive().optional().describe("Characters-per-second above which a cue is flagged (default 20)")
+  },
+  async ({ input, wpmThreshold, cpsThreshold }) => {
+    const result = _analyzeCaptionSpeedMcp(input, wpmThreshold ?? 180, cpsThreshold ?? 20);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _collectExportsStringLeavesMcp(value, out = []) {
+  if (typeof value === "string") out.push(value);
+  else if (Array.isArray(value)) value.forEach((v) => _collectExportsStringLeavesMcp(v, out));
+  else if (value && typeof value === "object") Object.values(value).forEach((v) => _collectExportsStringLeavesMcp(v, out));
+  return out;
+}
+function _checkExportsPatternMatchMcp(key, value, path, issues) {
+  const keyHasStar = key.includes("*");
+  const leaves = _collectExportsStringLeavesMcp(value);
+  if (keyHasStar) {
+    const bad = leaves.filter((l) => !l.includes("*"));
+    if (bad.length > 0) {
+      issues.push({ severity: "error", path, message: `pattern key "${key}" contains "*" but target ${bad.map((l) => `"${l}"`).join(", ")} has no "*" to receive the matched text` });
+    }
+  } else {
+    const bad = leaves.filter((l) => l.includes("*"));
+    if (bad.length > 0) {
+      issues.push({ severity: "error", path, message: `target ${bad.map((l) => `"${l}"`).join(", ")} contains "*" but key "${key}" has no "*" pattern to match against` });
+    }
+  }
+}
+function _validateExportsValueMcp(value, path, issues) {
+  if (value === null) return;
+  if (typeof value === "string") {
+    if (!value.startsWith("./")) {
+      issues.push({ severity: "error", path, message: `target "${value}" must start with "./"` });
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      issues.push({ severity: "warning", path, message: "empty fallback array will never resolve" });
+    }
+    value.forEach((v, i) => _validateExportsValueMcp(v, `${path}[${i}]`, issues));
+    return;
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj);
+    if (keys.length === 0) {
+      issues.push({ severity: "warning", path, message: "empty object will never resolve" });
+      return;
+    }
+    const hasDotKeys = keys.some((k) => k.startsWith("."));
+    const hasNonDotKeys = keys.some((k) => !k.startsWith("."));
+    if (hasDotKeys && hasNonDotKeys) {
+      issues.push({ severity: "error", path, message: 'cannot mix subpath keys (starting with ".") with condition keys in the same object' });
+      return;
+    }
+    if (hasDotKeys) {
+      for (const key of keys) {
+        const subpath = `${path}["${key}"]`;
+        if (key !== "." && !key.startsWith("./")) {
+          issues.push({ severity: "error", path: subpath, message: `subpath key "${key}" must be "." or start with "./"` });
+        }
+        _checkExportsPatternMatchMcp(key, obj[key], subpath, issues);
+        _validateExportsValueMcp(obj[key], subpath, issues);
+      }
+      return;
+    }
+    if (keys.includes("types") && keys[0] !== "types") {
+      issues.push({ severity: "warning", path, message: '"types" condition should be listed first so TypeScript resolves it before any other condition matches' });
+    }
+    if (keys.includes("default") && keys[keys.length - 1] !== "default") {
+      issues.push({ severity: "warning", path, message: '"default" condition should be listed last; conditions are matched in order and anything after "default" is unreachable' });
+    }
+    if ((keys.includes("import") || keys.includes("require")) && !keys.includes("default")) {
+      issues.push({ severity: "warning", path, message: 'no "default" fallback condition; resolution fails for any importer using a condition not listed here' });
+    }
+    const requireVal = obj.require;
+    if (typeof requireVal === "string" && requireVal.endsWith(".mjs")) {
+      issues.push({ severity: "error", path: `${path}.require`, message: `"require" condition points to a .mjs file ("${requireVal}"), but .mjs is always treated as ESM and cannot be required` });
+    }
+    const importVal = obj.import;
+    if (typeof importVal === "string" && importVal.endsWith(".cjs")) {
+      issues.push({ severity: "error", path: `${path}.import`, message: `"import" condition points to a .cjs file ("${importVal}"), but .cjs is always treated as CommonJS and cannot be imported as ESM` });
+    }
+    for (const key of keys) {
+      _validateExportsValueMcp(obj[key], `${path}.${key}`, issues);
+    }
+    return;
+  }
+  issues.push({ severity: "error", path, message: `unexpected value type at "${path}"` });
+}
+function _validatePackageExportsMcp(packageJsonText) {
+  if (!packageJsonText || !packageJsonText.trim()) return { error: "Input is empty" };
+  let parsed;
+  try {
+    parsed = JSON.parse(packageJsonText);
+  } catch (e) {
+    return { error: `Invalid JSON: ${e.message}` };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { error: "Root of package.json must be an object" };
+  }
+  const obj = parsed;
+  if (!("exports" in obj)) return { error: 'package.json has no "exports" field' };
+  const exportsValue = obj.exports;
+  const issues = [];
+  let exportsShape;
+  if (exportsValue === null) {
+    exportsShape = "null";
+  } else if (typeof exportsValue === "string") {
+    exportsShape = "string";
+  } else if (Array.isArray(exportsValue)) {
+    exportsShape = "array";
+  } else if (typeof exportsValue === "object") {
+    const keys = Object.keys(exportsValue);
+    exportsShape = keys.some((k) => k.startsWith(".")) ? "subpaths" : "conditions";
+  } else {
+    return { error: '"exports" must be a string, array, object, or null' };
+  }
+  _validateExportsValueMcp(exportsValue, "exports", issues);
+  const subpaths = exportsShape === "subpaths" ? Object.keys(exportsValue) : ["."];
+  const valid = !issues.some((i) => i.severity === "error");
+  return { parsed: true, exportsShape, subpaths, issues, valid };
+}
+server.tool(
+  "validate_package_exports",
+  'Validate a package.json "exports" field: flag common dual-package (ESM/CJS) misconfigurations \u2014 a "types" condition not listed first, a missing "default" fallback, a "require"/"import" pointing at the wrong file extension, mixing subpath and condition keys in the same object, and a subpath pattern with no matching "*" in its target.',
+  {
+    text: z.string().describe('The full package.json file contents (only the "exports" field is read)')
+  },
+  async ({ text: packageJsonText }) => {
+    const result = _validatePackageExportsMcp(packageJsonText);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+var _X_CONTENT_TYPE_OPTIONS_HEADER_MCP = "X-Content-Type-Options: nosniff";
+var _X_CONTENT_TYPE_EXACT_RISK_TABLE_MCP = {
+  "text/plain": { risk: "high", reason: "Browsers historically sniff text/plain responses and may render them as HTML if the body looks like markup, letting user-controlled text (comments, error pages, logs) execute as script." },
+  "application/octet-stream": { risk: "high", reason: "A generic fallback type with no format hint, so browsers are the most likely to sniff its real content and may render it as HTML." },
+  "": { risk: "high", reason: "A missing Content-Type header gives the browser nothing to trust, so it falls back to sniffing the response body entirely." }
+};
+var _X_CONTENT_TYPE_PREFIX_RISK_TABLE_MCP = [
+  { prefix: "text/html", risk: "medium", reason: "Already interpreted as HTML, so sniffing mostly matters if the type is wrong on purpose; nosniff still protects against a mismatched charset or embedded polyglot content." },
+  { prefix: "image/", risk: "low", reason: 'Browsers rarely upgrade an image response to HTML, but a crafted "GIFAR"-style polyglot file can still be sniffed as HTML in older engines.' },
+  { prefix: "audio/", risk: "low", reason: "Media types are rarely reinterpreted as HTML by modern sniffing algorithms." },
+  { prefix: "video/", risk: "low", reason: "Media types are rarely reinterpreted as HTML by modern sniffing algorithms." },
+  { prefix: "font/", risk: "low", reason: "Font types are rarely reinterpreted as HTML by modern sniffing algorithms." },
+  { prefix: "application/pdf", risk: "low", reason: "PDF has a strong magic-number signature, so sniffing rarely reclassifies it, though nosniff is still worth setting for user-uploaded PDFs." },
+  { prefix: "application/json", risk: "medium", reason: "Structurally distinct from HTML, but user-controlled JSONP-style responses served with a wrong or missing type have been used in real sniffing attacks." },
+  { prefix: "application/javascript", risk: "medium", reason: "Already executable; nosniff mainly protects against it being served where a script tag was not expected, such as inside an <img> or <object> tag." },
+  { prefix: "application/xml", risk: "medium", reason: "XML can be reinterpreted in ways that overlap with HTML/XHTML parsing in some legacy sniffing paths." }
+];
+function _assessContentTypeRiskMcp(contentType) {
+  const normalized = contentType.trim().toLowerCase().split(";")[0].trim();
+  if (normalized in _X_CONTENT_TYPE_EXACT_RISK_TABLE_MCP) {
+    const entry = _X_CONTENT_TYPE_EXACT_RISK_TABLE_MCP[normalized];
+    return { contentType: contentType.trim() || "(empty)", risk: entry.risk, reason: entry.reason };
+  }
+  const prefixMatch = _X_CONTENT_TYPE_PREFIX_RISK_TABLE_MCP.find((e) => normalized.startsWith(e.prefix));
+  if (prefixMatch) {
+    return { contentType: contentType.trim(), risk: prefixMatch.risk, reason: prefixMatch.reason };
+  }
+  return {
+    contentType: contentType.trim(),
+    risk: "medium",
+    reason: "Not a well-known type in this tool's lookup table. Treat any response type as sniffable unless you've confirmed the serving browser trusts it, and set nosniff regardless of type as a baseline defense."
+  };
+}
+server.tool(
+  "build_x_content_type_options_header",
+  'Build the X-Content-Type-Options header (only one valid value, "nosniff") with a plain-English explanation of the MIME-sniffing attack it prevents, optionally validating a pasted header value or assessing MIME-sniffing risk for a given Content-Type.',
+  {
+    headerValue: z.string().optional().describe('A pasted header value or full header line to validate, e.g. "nosniff"'),
+    contentType: z.string().optional().describe('A Content-Type value to assess MIME-sniffing risk for, e.g. "text/plain"')
+  },
+  async ({ headerValue, contentType }) => {
+    if (typeof headerValue === "string") {
+      const withoutLabel = headerValue.trim().replace(/^x-content-type-options\s*:\s*/i, "");
+      const value = withoutLabel.trim();
+      if (value === "") return errText({ error: 'No value found after "X-Content-Type-Options:"' });
+      if (value.toLowerCase() === "nosniff") {
+        return text(JSON.stringify({ raw: value, valid: true, message: "Valid. The browser will not MIME-sniff this response." }, null, 2));
+      }
+      return text(JSON.stringify({ raw: value, valid: false, message: `"${value}" is not a recognized value. The only value browsers act on is "nosniff" (case-insensitive); anything else is silently ignored, same as omitting the header.` }, null, 2));
+    }
+    if (typeof contentType === "string") {
+      return text(JSON.stringify(_assessContentTypeRiskMcp(contentType), null, 2));
+    }
+    return text(JSON.stringify({
+      header: _X_CONTENT_TYPE_OPTIONS_HEADER_MCP,
+      value: "nosniff",
+      explanation: `Tells the browser to strictly honor the declared Content-Type header instead of "sniffing" a response's bytes to guess its real type. Without it, a browser that decides an oddly-typed response looks like HTML or JavaScript may render or execute it, letting a file that was only ever meant to be downloaded or displayed as plain text be used to run a cross-site scripting attack.`
+    }, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.53.0",
-  "description": "MCP server exposing 188 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
+  "version": "0.55.0",
+  "description": "MCP server exposing 198 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",
   "homepage": "https://utilix.tech/mcp",