@utilix-tech/mcp 0.68.0 → 0.70.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.70.0
+- Add `generate_hotp`, `generate_totp` tools: generate an HOTP code (RFC 4226) for a counter value, or the current TOTP code (RFC 6238) plus seconds until rotation, from a base32-encoded shared secret, supporting SHA-1/SHA-256/SHA-512 and 6-8 digit codes.
+- Add `calculate_tax_equivalent_yield` tool: convert between a tax-free municipal bond yield and its taxable equivalent given a marginal federal (plus optional state) tax rate, in both directions.
+
+## 0.69.0
+- Add `parse_commit_trailers` tool: parse a commit message's trailer block (Co-authored-by, Signed-off-by, Fixes, Reviewed-by, etc.) per git's RFC 822-style trailer convention, returning each trailer's key and value plus the body with the trailer block removed.
+- Add `extract_markdown_footnotes` tool: extract every Markdown-Extra-style footnote reference and definition from a document, flagging references with no matching definition and definitions that are never referenced.
+
 ## 0.68.0
 - Add `build_robots_meta_tag`, `parse_robots_meta_tag` tools: build a `<meta name="robots" content="...">` tag from the same directive vocabulary as X-Robots-Tag, optionally scoped to a crawler via the name attribute, or parse an existing tag into the same shape.
 - Add `extract_svg_sprite_symbols` tool: parse an SVG sprite sheet's `<symbol>` definitions and list each one's id, viewBox, width, and height, alongside a ready-to-paste `<use href="#id"></use>` usage snippet.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 231 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 236 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -179,6 +179,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_time_value` | Convert between present and future value (time value of money) in either direction |
 | `calculate_percentage_change` | Compute the percentage change between two numbers, with absolute change, direction, and multiplier |
 | `convert_apr_apy` | Convert between a nominal APR and effective APY for a given compounding frequency, in both directions |
+| `calculate_tax_equivalent_yield` | Convert between a tax-free municipal bond yield and its taxable equivalent given a marginal federal (plus optional state) tax rate, in both directions |
 | `calculate_margin_markup` | Given any two of cost, price, margin percent, and markup percent, solve for the other two plus gross profit |
 | `calculate_discount` | Solve a sale price, amount saved, or discount percent from any one of them, or stack successive discounts in order |
 | `convert_subtitles` | Convert subtitles between SubRip (.srt) and WebVTT (.vtt), with an optional time shift to resync every cue |
@@ -211,6 +212,8 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
 | `parse_jwks` | Parse a JWKS (or a single bare JWK): type, use, algorithm, key ID, and size per key |
 | `compute_jwk_thumbprint` | Compute the RFC 7638 canonical thumbprint of a single JWK (SHA-256/384/512) |
+| `generate_hotp` | Generate an HOTP code (RFC 4226) for a counter value from a base32-encoded shared secret |
+| `generate_totp` | Generate the current TOTP code (RFC 6238) from a base32-encoded shared secret, plus seconds until rotation |
 | `build_curl` | Build a cURL command from method, URL, headers, and body |
 | `curl_to_code` | Convert a cURL command to fetch, axios, Python, Go, PHP, or Ruby |
 | `cors_headers` | Generate CORS response headers for a configuration |
@@ -265,7 +268,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `color_palette` | Generate a color palette from a base color |
 | `color_shades` | Generate shades or tints from a base color |
 
-### Code (18 tools)
+### Code (20 tools)
 | Tool | Description |
 |------|-------------|
 | `format_sql` | Format a SQL query with proper indentation |
@@ -286,6 +289,8 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `validate_package_exports` | Validate a package.json "exports" field: dual-package (ESM/CJS) misconfigurations like a missing default fallback or a require/import pointing at the wrong extension |
 | `audit_dependency_ranges` | Classify each package.json dependency's version range type and flag wildcard ranges, the "latest" tag, git/URL/file/link dependencies, and packages listed with conflicting or redundant ranges across sections |
 | `extract_svg_sprite_symbols` | Parse an SVG sprite sheet's `<symbol>` definitions and list each one's id, viewBox, width, and height, alongside a ready-to-paste `<use href="#id"></use>` usage snippet |
+| `parse_commit_trailers` | Parse a commit message's trailer block (Co-authored-by, Signed-off-by, Fixes, Reviewed-by, etc.) per git's RFC 822-style trailer convention, returning each trailer's key/value plus the body with the trailer block removed |
+| `extract_markdown_footnotes` | Extract every Markdown-Extra-style footnote reference and definition from a document, flagging references with no matching definition and definitions that are never referenced |
 
 ### Data (16 tools)
 | Tool | Description |

package/dist/index.js

@@ -4,7 +4,7 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { z } from "zod";
-import { createHash, randomBytes } from "crypto";
+import { createHash, createHmac, randomBytes } from "crypto";
 import * as yaml from "js-yaml";
 import {
   parseJson,
@@ -11010,5 +11010,259 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+var _TRAILER_LINE_REGEX_MCP = /^([A-Za-z][A-Za-z0-9-]*): (.+)$/;
+var _TRAILER_CONTINUATION_REGEX_MCP = /^[ \t]+\S/;
+function _parseCommitTrailersMcp(message) {
+  const lines = message.replace(/\r\n/g, "\n").split("\n");
+  while (lines.length > 0 && lines[lines.length - 1].trim() === "") lines.pop();
+  if (lines.length === 0) return { error: "Empty input" };
+  let start = 0;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    if (lines[i].trim() === "") {
+      start = i + 1;
+      break;
+    }
+  }
+  const paragraph = lines.slice(start);
+  const trailers = [];
+  let valid = true;
+  for (const line of paragraph) {
+    const m = line.match(_TRAILER_LINE_REGEX_MCP);
+    if (m) {
+      trailers.push({ key: m[1], value: m[2].trim() });
+    } else if (_TRAILER_CONTINUATION_REGEX_MCP.test(line) && trailers.length > 0) {
+      trailers[trailers.length - 1].value += " " + line.trim();
+    } else {
+      valid = false;
+      break;
+    }
+  }
+  if (!valid || trailers.length === 0) {
+    return { trailers: [], body: lines.join("\n").trim(), hasTrailers: false };
+  }
+  const body = lines.slice(0, start).join("\n").trim();
+  return { trailers, body, hasTrailers: true };
+}
+server.tool(
+  "parse_commit_trailers",
+  `Parse a commit message's trailer block (Co-authored-by, Signed-off-by, Fixes, Reviewed-by, etc.) per git's RFC 822-style trailer convention (git-interpret-trailers): the last paragraph of the message, where every line is either a "Key: value" pair or an indented continuation of the previous trailer's value. Returns the trailers plus the message body with the trailer block removed.`,
+  {
+    message: z.string().min(1).describe("The full commit message")
+  },
+  async ({ message }) => {
+    const result = _parseCommitTrailersMcp(message);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+var _FOOTNOTE_DEFINITION_LINE_REGEX_MCP = /^\[\^([^\]]+)\]:\s?(.*)$/;
+var _FOOTNOTE_CONTINUATION_REGEX_MCP = /^(?: {4}|\t)/;
+var _FOOTNOTE_REFERENCE_REGEX_MCP = /\[\^([^\]]+)\]/g;
+function _extractMarkdownFootnotesMcp(markdown) {
+  const trimmed = markdown.trim();
+  if (!trimmed) return { error: "Empty input" };
+  if (!trimmed.includes("[^")) return { error: "No footnote references or definitions found" };
+  const lines = markdown.replace(/\r\n/g, "\n").split("\n");
+  const definitions = [];
+  const definedLabels = /* @__PURE__ */ new Set();
+  const consumed = new Array(lines.length).fill(false);
+  let i = 0;
+  while (i < lines.length) {
+    const match = lines[i].match(_FOOTNOTE_DEFINITION_LINE_REGEX_MCP);
+    if (!match) {
+      i++;
+      continue;
+    }
+    const label = match[1];
+    const textLines = [match[2]];
+    consumed[i] = true;
+    let j = i + 1;
+    while (j < lines.length && (_FOOTNOTE_CONTINUATION_REGEX_MCP.test(lines[j]) || lines[j].trim() === "" && j + 1 < lines.length && _FOOTNOTE_CONTINUATION_REGEX_MCP.test(lines[j + 1]))) {
+      textLines.push(lines[j].trim() === "" ? "" : lines[j].replace(_FOOTNOTE_CONTINUATION_REGEX_MCP, ""));
+      consumed[j] = true;
+      j++;
+    }
+    if (!definedLabels.has(label)) {
+      definedLabels.add(label);
+      definitions.push({ label, text: textLines.join("\n").trim() });
+    }
+    i = j;
+  }
+  const referenceScanText = lines.filter((_, idx) => !consumed[idx]).join("\n");
+  const refOrder = [];
+  const refCounts = /* @__PURE__ */ new Map();
+  for (const m of referenceScanText.matchAll(_FOOTNOTE_REFERENCE_REGEX_MCP)) {
+    const label = m[1];
+    if (!refCounts.has(label)) {
+      refCounts.set(label, 0);
+      refOrder.push(label);
+    }
+    refCounts.set(label, (refCounts.get(label) ?? 0) + 1);
+  }
+  const references = refOrder.map((label) => ({ label, count: refCounts.get(label) ?? 0 }));
+  const referencedSet = new Set(refOrder);
+  const unresolvedReferences = refOrder.filter((label) => !definedLabels.has(label));
+  const unusedDefinitions = definitions.filter((d) => !referencedSet.has(d.label)).map((d) => d.label);
+  const referenceCount = refOrder.reduce((sum, label) => sum + (refCounts.get(label) ?? 0), 0);
+  if (definitions.length === 0 && references.length === 0) {
+    return { error: "No footnote references or definitions found" };
+  }
+  return { definitionCount: definitions.length, referenceCount, definitions, references, unresolvedReferences, unusedDefinitions };
+}
+server.tool(
+  "extract_markdown_footnotes",
+  "Extract every Markdown-Extra-style footnote reference ([^label]) and definition ([^label]: text, with 4-space/tab-indented continuation lines) from a document, then flag references with no matching definition and definitions that are never referenced.",
+  {
+    markdown: z.string().min(1).describe("The Markdown document text")
+  },
+  async ({ markdown }) => {
+    const result = _extractMarkdownFootnotesMcp(markdown);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+function _calculateTaxEquivalentYieldMcp(inputYieldPercent, federalTaxRatePercent, stateTaxRatePercent, direction) {
+  if (typeof inputYieldPercent !== "number" || !Number.isFinite(inputYieldPercent) || inputYieldPercent < 0) {
+    return { error: "Yield must be zero or a positive number" };
+  }
+  if (typeof federalTaxRatePercent !== "number" || !Number.isFinite(federalTaxRatePercent) || federalTaxRatePercent < 0 || federalTaxRatePercent >= 100) {
+    return { error: "Federal tax rate must be a percentage between 0 and 100 (exclusive of 100)" };
+  }
+  const stateRate = stateTaxRatePercent ?? 0;
+  if (typeof stateRate !== "number" || !Number.isFinite(stateRate) || stateRate < 0 || stateRate >= 100) {
+    return { error: "State tax rate must be a percentage between 0 and 100 (exclusive of 100)" };
+  }
+  if (direction !== "tax-free-to-taxable" && direction !== "taxable-to-tax-free") {
+    return { error: 'Direction must be "tax-free-to-taxable" or "taxable-to-tax-free"' };
+  }
+  const combinedTaxRatePercent = federalTaxRatePercent + stateRate;
+  if (combinedTaxRatePercent >= 100) {
+    return { error: "Combined federal and state tax rate must be less than 100%" };
+  }
+  const round6 = (n) => Math.round(n * 1e6) / 1e6;
+  const combinedRateDecimal = combinedTaxRatePercent / 100;
+  let taxFreeYield;
+  let taxableYield;
+  if (direction === "tax-free-to-taxable") {
+    taxFreeYield = inputYieldPercent;
+    taxableYield = taxFreeYield / (1 - combinedRateDecimal);
+  } else {
+    taxableYield = inputYieldPercent;
+    taxFreeYield = taxableYield * (1 - combinedRateDecimal);
+  }
+  return {
+    direction,
+    inputYield: round6(inputYieldPercent),
+    federalTaxRatePercent: round6(federalTaxRatePercent),
+    stateTaxRatePercent: round6(stateRate),
+    combinedTaxRatePercent: round6(combinedTaxRatePercent),
+    taxFreeYield: round6(taxFreeYield),
+    taxableYield: round6(taxableYield),
+    yieldDifference: round6(taxableYield - taxFreeYield)
+  };
+}
+server.tool(
+  "calculate_tax_equivalent_yield",
+  'Convert between a tax-free municipal bond yield and the equivalent taxable-bond yield given a marginal federal tax rate (plus an optional state rate, summed into a combined rate). With direction "tax-free-to-taxable", taxableYield = taxFreeYield / (1 - combinedRate); with "taxable-to-tax-free", taxFreeYield = taxableYield * (1 - combinedRate). Pure formula, no live bond pricing.',
+  {
+    inputYield: z.number().min(0).describe('The known yield as a percent: the tax-free yield when direction is "tax-free-to-taxable", or the taxable yield when direction is "taxable-to-tax-free"'),
+    federalTaxRatePercent: z.number().min(0).max(99.999).describe("Marginal federal tax rate as a percent"),
+    stateTaxRatePercent: z.number().min(0).max(99.999).optional().describe("Optional marginal state tax rate as a percent, summed with the federal rate"),
+    direction: z.enum(["tax-free-to-taxable", "taxable-to-tax-free"]).describe("Which yield the input represents and which to compute")
+  },
+  async ({ inputYield, federalTaxRatePercent, stateTaxRatePercent, direction }) => {
+    const result = _calculateTaxEquivalentYieldMcp(inputYield, federalTaxRatePercent, stateTaxRatePercent ?? 0, direction);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+var _OTP_ALG_TO_NODE_HASH_MCP = { SHA1: "sha1", SHA256: "sha256", SHA512: "sha512" };
+function _decodeBase32SecretMcp(secret) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+  const cleaned = (secret ?? "").toUpperCase().replace(/[\s=]/g, "");
+  if (!cleaned) return { error: "Secret must not be empty" };
+  const bytes = [];
+  let buffer = 0;
+  let bitsLeft = 0;
+  for (const char of cleaned) {
+    const val = alphabet.indexOf(char);
+    if (val === -1) return { error: `Invalid base32 character '${char}' in secret` };
+    buffer = buffer << 5 | val;
+    bitsLeft += 5;
+    if (bitsLeft >= 8) {
+      bitsLeft -= 8;
+      bytes.push(buffer >> bitsLeft & 255);
+    }
+  }
+  return Buffer.from(bytes);
+}
+function _hotpFromCounterMcp(keyBytes, counter, digits, algorithm) {
+  const counterBuffer = Buffer.alloc(8);
+  counterBuffer.writeUInt32BE(Math.floor(counter / 4294967296), 0);
+  counterBuffer.writeUInt32BE(counter % 4294967296, 4);
+  const hmac = createHmac(_OTP_ALG_TO_NODE_HASH_MCP[algorithm], keyBytes).update(counterBuffer).digest();
+  const offset = hmac[hmac.length - 1] & 15;
+  const binCode = (hmac[offset] & 127) << 24 | (hmac[offset + 1] & 255) << 16 | (hmac[offset + 2] & 255) << 8 | hmac[offset + 3] & 255;
+  return (binCode % 10 ** digits).toString().padStart(digits, "0");
+}
+function _generateHotpMcp(secret, counter, digits, algorithm) {
+  if (!Number.isInteger(counter) || counter < 0) {
+    return { error: "Counter must be a non-negative whole number" };
+  }
+  if (!Number.isInteger(digits) || digits < 6 || digits > 8) {
+    return { error: "Digits must be an integer between 6 and 8" };
+  }
+  if (!(algorithm in _OTP_ALG_TO_NODE_HASH_MCP)) {
+    return { error: "Algorithm must be one of SHA1, SHA256, SHA512" };
+  }
+  const keyBytes = _decodeBase32SecretMcp(secret);
+  if ("error" in keyBytes) return keyBytes;
+  return { code: _hotpFromCounterMcp(keyBytes, counter, digits, algorithm), counter, digits, algorithm };
+}
+function _generateTotpMcp(secret, digits, algorithm, periodSeconds, timestamp) {
+  const period = periodSeconds ?? 30;
+  const ts = timestamp ?? Math.floor(Date.now() / 1e3);
+  if (!Number.isFinite(period) || period <= 0) {
+    return { error: "Period must be a positive number of seconds" };
+  }
+  if (!Number.isFinite(ts) || ts < 0) {
+    return { error: "Timestamp must be a non-negative number of seconds" };
+  }
+  const counter = Math.floor(ts / period);
+  const hotp = _generateHotpMcp(secret, counter, digits, algorithm);
+  if ("error" in hotp) return hotp;
+  const secondsRemaining = period - ts % period;
+  return { ...hotp, periodSeconds: period, secondsRemaining };
+}
+server.tool(
+  "generate_hotp",
+  "Generate an HOTP code (RFC 4226) for a given counter value from a base32-encoded shared secret. Supports 6-8 digit codes and SHA-1/SHA-256/SHA-512 (SHA-1 is the default per the RFC). The secret is never stored, only used for this one HMAC computation.",
+  {
+    secret: z.string().min(1).describe("The base32-encoded shared secret (RFC 4648, case-insensitive, padding optional)"),
+    counter: z.number().int().min(0).describe("The HOTP counter value"),
+    digits: z.number().int().min(6).max(8).optional().describe("Code length, default 6"),
+    algorithm: z.enum(["SHA1", "SHA256", "SHA512"]).optional().describe("HMAC algorithm, default SHA1")
+  },
+  async ({ secret, counter, digits, algorithm }) => {
+    const result = _generateHotpMcp(secret, counter, digits ?? 6, algorithm ?? "SHA1");
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
+server.tool(
+  "generate_totp",
+  "Generate the current TOTP code (RFC 6238) from a base32-encoded shared secret, plus how many seconds remain before it rotates. Defaults (30s period, 6 digits, SHA-1) match what Google Authenticator and most other authenticator apps use. Pass an explicit timestamp for deterministic/testable output.",
+  {
+    secret: z.string().min(1).describe("The base32-encoded shared secret (RFC 4648, case-insensitive, padding optional)"),
+    digits: z.number().int().min(6).max(8).optional().describe("Code length, default 6"),
+    algorithm: z.enum(["SHA1", "SHA256", "SHA512"]).optional().describe("HMAC algorithm, default SHA1"),
+    periodSeconds: z.number().int().min(1).optional().describe("Time-step window in seconds, default 30"),
+    timestamp: z.number().int().min(0).optional().describe("Unix timestamp in seconds to compute the code for; defaults to the current time")
+  },
+  async ({ secret, digits, algorithm, periodSeconds, timestamp }) => {
+    const result = _generateTotpMcp(secret, digits ?? 6, algorithm ?? "SHA1", periodSeconds ?? 30, timestamp);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 var transport = new StdioServerTransport();
 await server.connect(transport);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.68.0",
+  "version": "0.70.0",
   "description": "MCP server exposing 198 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",