@utilix-tech/mcp 0.54.0 → 0.55.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.55.0
+- Add `validate_package_exports` tool: parse a package.json's exports field and flag common dual-package (ESM/CJS) misconfigurations, a types condition not listed first, a missing default fallback, mismatched require/import extensions, mixed subpath/condition keys, and pattern mismatches.
+- Add `build_x_content_type_options_header` tool: build the fixed X-Content-Type-Options: nosniff header, validate a pasted value, and assess MIME-sniffing risk for a given Content-Type.
+
 ## 0.54.0
 - Add `calculate_credit_utilization` tool: compute per-account and overall credit utilization (balance / limit) from one or more credit accounts, plus a qualitative tier matching common credit-scoring guidance.
 - Add `analyze_caption_speed` tool: parse an SRT or WebVTT file and report the words-per-minute reading speed of every cue, flagging ones that exceed common broadcast accessibility guidelines.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 196 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 198 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -197,7 +197,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_gpa` | Compute a weighted GPA from a list of courses, each with a letter grade and credit hours, using the standard 4.0-capped scale |
 | `calculate_credit_utilization` | Compute per-account and overall credit utilization (balance / limit) from one or more credit accounts, plus a qualitative tier matching common credit-scoring guidance |
 
-### API / Network (28 tools)
+### API / Network (29 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -228,6 +228,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_client_hint_headers` | Decode raw Client Hints request-header text into structured values: brand/version pairs, booleans, strings, and numbers |
 | `build_content_disposition` | Build a Content-Disposition response header for a file download or inline display, with an RFC 5987 filename* parameter for non-ASCII filenames |
 | `parse_content_disposition` | Parse a Content-Disposition header value into its disposition type, decoded filename, and raw parameters |
+| `build_x_content_type_options_header` | Build the fixed X-Content-Type-Options: nosniff header, validate a pasted value, or assess MIME-sniffing risk for a given Content-Type |
 
 ### Color (4 tools)
 | Tool | Description |
@@ -237,7 +238,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (14 tools)
+### Code (15 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -254,6 +255,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `test_gitignore_patterns` | Test a list of paths against a .gitignore file's patterns, following git's last-match-wins and negation rules |
 | `validate_editorconfig` | Validate an .editorconfig file: root flag, glob sections, and structural mistakes against the EditorConfig spec |
 | `validate_tsconfig` | Validate a tsconfig.json file (JSONC-aware): unknown keys, unknown compilerOptions, and type mismatches |
+| `validate_package_exports` | Validate a package.json "exports" field: dual-package (ESM/CJS) misconfigurations like a missing default fallback or a require/import pointing at the wrong extension |
 
 ### Data (13 tools)
 | Tool | Description |

package/dist/index.js

@@ -9020,5 +9020,194 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+function _collectExportsStringLeavesMcp(value, out = []) {
+  if (typeof value === "string") out.push(value);
+  else if (Array.isArray(value)) value.forEach((v) => _collectExportsStringLeavesMcp(v, out));
+  else if (value && typeof value === "object") Object.values(value).forEach((v) => _collectExportsStringLeavesMcp(v, out));
+  return out;
+}
+function _checkExportsPatternMatchMcp(key, value, path, issues) {
+  const keyHasStar = key.includes("*");
+  const leaves = _collectExportsStringLeavesMcp(value);
+  if (keyHasStar) {
+    const bad = leaves.filter((l) => !l.includes("*"));
+    if (bad.length > 0) {
+      issues.push({ severity: "error", path, message: `pattern key "${key}" contains "*" but target ${bad.map((l) => `"${l}"`).join(", ")} has no "*" to receive the matched text` });
+    }
+  } else {
+    const bad = leaves.filter((l) => l.includes("*"));
+    if (bad.length > 0) {
+      issues.push({ severity: "error", path, message: `target ${bad.map((l) => `"${l}"`).join(", ")} contains "*" but key "${key}" has no "*" pattern to match against` });
+    }
+  }
+}
+function _validateExportsValueMcp(value, path, issues) {
+  if (value === null) return;
+  if (typeof value === "string") {
+    if (!value.startsWith("./")) {
+      issues.push({ severity: "error", path, message: `target "${value}" must start with "./"` });
+    }
+    return;
+  }
+  if (Array.isArray(value)) {
+    if (value.length === 0) {
+      issues.push({ severity: "warning", path, message: "empty fallback array will never resolve" });
+    }
+    value.forEach((v, i) => _validateExportsValueMcp(v, `${path}[${i}]`, issues));
+    return;
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    const keys = Object.keys(obj);
+    if (keys.length === 0) {
+      issues.push({ severity: "warning", path, message: "empty object will never resolve" });
+      return;
+    }
+    const hasDotKeys = keys.some((k) => k.startsWith("."));
+    const hasNonDotKeys = keys.some((k) => !k.startsWith("."));
+    if (hasDotKeys && hasNonDotKeys) {
+      issues.push({ severity: "error", path, message: 'cannot mix subpath keys (starting with ".") with condition keys in the same object' });
+      return;
+    }
+    if (hasDotKeys) {
+      for (const key of keys) {
+        const subpath = `${path}["${key}"]`;
+        if (key !== "." && !key.startsWith("./")) {
+          issues.push({ severity: "error", path: subpath, message: `subpath key "${key}" must be "." or start with "./"` });
+        }
+        _checkExportsPatternMatchMcp(key, obj[key], subpath, issues);
+        _validateExportsValueMcp(obj[key], subpath, issues);
+      }
+      return;
+    }
+    if (keys.includes("types") && keys[0] !== "types") {
+      issues.push({ severity: "warning", path, message: '"types" condition should be listed first so TypeScript resolves it before any other condition matches' });
+    }
+    if (keys.includes("default") && keys[keys.length - 1] !== "default") {
+      issues.push({ severity: "warning", path, message: '"default" condition should be listed last; conditions are matched in order and anything after "default" is unreachable' });
+    }
+    if ((keys.includes("import") || keys.includes("require")) && !keys.includes("default")) {
+      issues.push({ severity: "warning", path, message: 'no "default" fallback condition; resolution fails for any importer using a condition not listed here' });
+    }
+    const requireVal = obj.require;
+    if (typeof requireVal === "string" && requireVal.endsWith(".mjs")) {
+      issues.push({ severity: "error", path: `${path}.require`, message: `"require" condition points to a .mjs file ("${requireVal}"), but .mjs is always treated as ESM and cannot be required` });
+    }
+    const importVal = obj.import;
+    if (typeof importVal === "string" && importVal.endsWith(".cjs")) {
+      issues.push({ severity: "error", path: `${path}.import`, message: `"import" condition points to a .cjs file ("${importVal}"), but .cjs is always treated as CommonJS and cannot be imported as ESM` });
+    }
+    for (const key of keys) {
+      _validateExportsValueMcp(obj[key], `${path}.${key}`, issues);
+    }
+    return;
+  }
+  issues.push({ severity: "error", path, message: `unexpected value type at "${path}"` });
+}
+function _validatePackageExportsMcp(packageJsonText) {
+  if (!packageJsonText || !packageJsonText.trim()) return { error: "Input is empty" };
+  let parsed;
+  try {
+    parsed = JSON.parse(packageJsonText);
+  } catch (e) {
+    return { error: `Invalid JSON: ${e.message}` };
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    return { error: "Root of package.json must be an object" };
+  }
+  const obj = parsed;
+  if (!("exports" in obj)) return { error: 'package.json has no "exports" field' };
+  const exportsValue = obj.exports;
+  const issues = [];
+  let exportsShape;
+  if (exportsValue === null) {
+    exportsShape = "null";
+  } else if (typeof exportsValue === "string") {
+    exportsShape = "string";
+  } else if (Array.isArray(exportsValue)) {
+    exportsShape = "array";
+  } else if (typeof exportsValue === "object") {
+    const keys = Object.keys(exportsValue);
+    exportsShape = keys.some((k) => k.startsWith(".")) ? "subpaths" : "conditions";
+  } else {
+    return { error: '"exports" must be a string, array, object, or null' };
+  }
+  _validateExportsValueMcp(exportsValue, "exports", issues);
+  const subpaths = exportsShape === "subpaths" ? Object.keys(exportsValue) : ["."];
+  const valid = !issues.some((i) => i.severity === "error");
+  return { parsed: true, exportsShape, subpaths, issues, valid };
+}
+server.tool(
+  "validate_package_exports",
+  'Validate a package.json "exports" field: flag common dual-package (ESM/CJS) misconfigurations \u2014 a "types" condition not listed first, a missing "default" fallback, a "require"/"import" pointing at the wrong file extension, mixing subpath and condition keys in the same object, and a subpath pattern with no matching "*" in its target.',
+  {
+    text: z.string().describe('The full package.json file contents (only the "exports" field is read)')
+  },
+  async ({ text: packageJsonText }) => {
+    const result = _validatePackageExportsMcp(packageJsonText);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+var _X_CONTENT_TYPE_OPTIONS_HEADER_MCP = "X-Content-Type-Options: nosniff";
+var _X_CONTENT_TYPE_EXACT_RISK_TABLE_MCP = {
+  "text/plain": { risk: "high", reason: "Browsers historically sniff text/plain responses and may render them as HTML if the body looks like markup, letting user-controlled text (comments, error pages, logs) execute as script." },
+  "application/octet-stream": { risk: "high", reason: "A generic fallback type with no format hint, so browsers are the most likely to sniff its real content and may render it as HTML." },
+  "": { risk: "high", reason: "A missing Content-Type header gives the browser nothing to trust, so it falls back to sniffing the response body entirely." }
+};
+var _X_CONTENT_TYPE_PREFIX_RISK_TABLE_MCP = [
+  { prefix: "text/html", risk: "medium", reason: "Already interpreted as HTML, so sniffing mostly matters if the type is wrong on purpose; nosniff still protects against a mismatched charset or embedded polyglot content." },
+  { prefix: "image/", risk: "low", reason: 'Browsers rarely upgrade an image response to HTML, but a crafted "GIFAR"-style polyglot file can still be sniffed as HTML in older engines.' },
+  { prefix: "audio/", risk: "low", reason: "Media types are rarely reinterpreted as HTML by modern sniffing algorithms." },
+  { prefix: "video/", risk: "low", reason: "Media types are rarely reinterpreted as HTML by modern sniffing algorithms." },
+  { prefix: "font/", risk: "low", reason: "Font types are rarely reinterpreted as HTML by modern sniffing algorithms." },
+  { prefix: "application/pdf", risk: "low", reason: "PDF has a strong magic-number signature, so sniffing rarely reclassifies it, though nosniff is still worth setting for user-uploaded PDFs." },
+  { prefix: "application/json", risk: "medium", reason: "Structurally distinct from HTML, but user-controlled JSONP-style responses served with a wrong or missing type have been used in real sniffing attacks." },
+  { prefix: "application/javascript", risk: "medium", reason: "Already executable; nosniff mainly protects against it being served where a script tag was not expected, such as inside an <img> or <object> tag." },
+  { prefix: "application/xml", risk: "medium", reason: "XML can be reinterpreted in ways that overlap with HTML/XHTML parsing in some legacy sniffing paths." }
+];
+function _assessContentTypeRiskMcp(contentType) {
+  const normalized = contentType.trim().toLowerCase().split(";")[0].trim();
+  if (normalized in _X_CONTENT_TYPE_EXACT_RISK_TABLE_MCP) {
+    const entry = _X_CONTENT_TYPE_EXACT_RISK_TABLE_MCP[normalized];
+    return { contentType: contentType.trim() || "(empty)", risk: entry.risk, reason: entry.reason };
+  }
+  const prefixMatch = _X_CONTENT_TYPE_PREFIX_RISK_TABLE_MCP.find((e) => normalized.startsWith(e.prefix));
+  if (prefixMatch) {
+    return { contentType: contentType.trim(), risk: prefixMatch.risk, reason: prefixMatch.reason };
+  }
+  return {
+    contentType: contentType.trim(),
+    risk: "medium",
+    reason: "Not a well-known type in this tool's lookup table. Treat any response type as sniffable unless you've confirmed the serving browser trusts it, and set nosniff regardless of type as a baseline defense."
+  };
+}
+server.tool(
+  "build_x_content_type_options_header",
+  'Build the X-Content-Type-Options header (only one valid value, "nosniff") with a plain-English explanation of the MIME-sniffing attack it prevents, optionally validating a pasted header value or assessing MIME-sniffing risk for a given Content-Type.',
+  {
+    headerValue: z.string().optional().describe('A pasted header value or full header line to validate, e.g. "nosniff"'),
+    contentType: z.string().optional().describe('A Content-Type value to assess MIME-sniffing risk for, e.g. "text/plain"')
+  },
+  async ({ headerValue, contentType }) => {
+    if (typeof headerValue === "string") {
+      const withoutLabel = headerValue.trim().replace(/^x-content-type-options\s*:\s*/i, "");
+      const value = withoutLabel.trim();
+      if (value === "") return errText({ error: 'No value found after "X-Content-Type-Options:"' });
+      if (value.toLowerCase() === "nosniff") {
+        return text(JSON.stringify({ raw: value, valid: true, message: "Valid. The browser will not MIME-sniff this response." }, null, 2));
+      }
+      return text(JSON.stringify({ raw: value, valid: false, message: `"${value}" is not a recognized value. The only value browsers act on is "nosniff" (case-insensitive); anything else is silently ignored, same as omitting the header.` }, null, 2));
+    }
+    if (typeof contentType === "string") {
+      return text(JSON.stringify(_assessContentTypeRiskMcp(contentType), null, 2));
+    }
+    return text(JSON.stringify({
+      header: _X_CONTENT_TYPE_OPTIONS_HEADER_MCP,
+      value: "nosniff",
+      explanation: `Tells the browser to strictly honor the declared Content-Type header instead of "sniffing" a response's bytes to guess its real type. Without it, a browser that decides an oddly-typed response looks like HTML or JavaScript may render or execute it, letting a file that was only ever meant to be downloaded or displayed as plain text be used to run a cross-site scripting attack.`
+    }, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.54.0",
-  "description": "MCP server exposing 188 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
+  "version": "0.55.0",
+  "description": "MCP server exposing 198 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",
   "homepage": "https://utilix.tech/mcp",