@utilix-tech/mcp 0.57.0 → 0.58.0

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.58.0
+- Add `apply_json_merge_patch` tool: apply an RFC 7396 JSON Merge Patch document to a target JSON document, with null-valued patch keys removing the matching target key.
+- Add `generate_csp_nonce` tool: generate a cryptographically random, base64-encoded Content-Security-Policy nonce with ready-to-paste header directive and script/style tag snippets.
+
 ## 0.57.0
 - Add `build_accept_language`, `parse_accept_language` tools: build an Accept-Language request-header value from locale/quality pairs sorted by descending preference, or parse an existing one into its ranked entries.
 - Add `calculate_blended_loan_rate` tool: compute the single weighted-average interest rate across a list of loan balances, plus combined monthly and annual interest accrual.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 203 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 205 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -75,7 +75,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 
 ## Tools
 
-### JSON (15 tools)
+### JSON (16 tools)
 | Tool | Description |
 |------|-------------|
 | `format_json` | Pretty-print and validate a JSON string |
@@ -85,6 +85,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `csv_to_json` | Convert CSV text to a JSON array |
 | `jsonpath` | Evaluate a JSONPath expression |
 | `resolve_json_pointer` | Resolve an RFC 6901 JSON Pointer against a JSON document |
+| `apply_json_merge_patch` | Apply an RFC 7396 JSON Merge Patch document to a target JSON document |
 | `validate_json` | Validate JSON against a JSON Schema |
 | `yaml_to_json` | Convert YAML to JSON |
 | `json_to_yaml` | Convert JSON to YAML |
@@ -120,7 +121,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `generate_sri_hash` | Compute a Subresource Integrity hash (SHA-256/384/512) for a script or stylesheet's content, formatted for an HTML `integrity` attribute |
 | `generate_etag` | Compute a content-hash ETag (MD5/SHA-1/SHA-256) for a response header, with an optional weak-validator prefix |
 
-### Generators (6 tools)
+### Generators (7 tools)
 | Tool | Description |
 |------|-------------|
 | `generate_uuid` | Generate UUID v4 or v7 |
@@ -129,6 +130,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `estimate_password_entropy` | Estimate a password's entropy in bits, strength label, and crack-time estimates |
 | `generate_qr` | Generate a QR code as an SVG string |
 | `generate_random_data` | Generate random mock data: names, emails, UUIDs, IPs, etc. |
+| `generate_csp_nonce` | Generate a cryptographically random CSP nonce with ready-to-paste header directive and script/style tag snippets |
 
 ### Text (16 tools)
 | Tool | Description |

package/dist/index.js

@@ -4,7 +4,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { createHash } from "crypto";
+import { createHash, randomBytes } from "crypto";
 import * as yaml from "js-yaml";
 import {
   parseJson,
@@ -4655,6 +4655,45 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+function _isMergePatchObjectMcp(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function _mergeJsonPatchMcp(target, patch) {
+  if (!_isMergePatchObjectMcp(patch)) return patch;
+  const result = _isMergePatchObjectMcp(target) ? { ...target } : {};
+  for (const key of Object.keys(patch)) {
+    const value = patch[key];
+    if (value === null) {
+      delete result[key];
+    } else {
+      result[key] = _mergeJsonPatchMcp(result[key], value);
+    }
+  }
+  return result;
+}
+server.tool(
+  "apply_json_merge_patch",
+  "Apply an RFC 7396 JSON Merge Patch document to a target JSON document and return the merged result. A null-valued key in the patch removes that key from the target; a patch that is not itself a JSON object replaces the target wholesale, which is how arrays are replaced rather than merged element by element.",
+  {
+    target: z.string().describe("The target JSON document, as a JSON string"),
+    patch: z.string().describe("The RFC 7396 JSON Merge Patch document, as a JSON string")
+  },
+  async ({ target, patch }) => {
+    let targetParsed;
+    try {
+      targetParsed = JSON.parse(target);
+    } catch {
+      return errText({ error: "Target is not valid JSON" });
+    }
+    let patchParsed;
+    try {
+      patchParsed = JSON.parse(patch);
+    } catch {
+      return errText({ error: "Patch is not valid JSON" });
+    }
+    return text(JSON.stringify({ result: _mergeJsonPatchMcp(targetParsed, patchParsed) }, null, 2));
+  }
+);
 function _convertAprApyMcp(rate, compoundsPerYear, direction) {
   if (!Number.isFinite(rate) || rate < 0) return { error: "Rate must be zero or a positive number" };
   if (!Number.isInteger(compoundsPerYear) || compoundsPerYear <= 0) return { error: "Compounding frequency must be a positive whole number of periods per year" };
@@ -9461,5 +9500,24 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+server.tool(
+  "generate_csp_nonce",
+  'Generate a cryptographically random, base64-encoded nonce for a Content-Security-Policy script-src or style-src directive, along with ready-to-paste header directive and <script>/<style nonce="..."> tag snippets. Generates a fresh, unique value on every call.',
+  {
+    byteLength: z.number().int().min(8).max(64).optional().describe("Number of random bytes to encode (default 16 = 128 bits, the CSP spec's recommended minimum)")
+  },
+  async ({ byteLength }) => {
+    const length = byteLength ?? 16;
+    const nonce = randomBytes(length).toString("base64");
+    return text(JSON.stringify({
+      nonce,
+      byteLength: length,
+      scriptSrcDirective: `script-src 'nonce-${nonce}'`,
+      styleSrcDirective: `style-src 'nonce-${nonce}'`,
+      scriptTag: `<script nonce="${nonce}">`,
+      styleTag: `<style nonce="${nonce}">`
+    }, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.57.0",
+  "version": "0.58.0",
   "description": "MCP server exposing 198 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",