@utilix-tech/mcp 0.76.0 → 0.78.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 Full release notes for all Utilix surfaces (browser tools, REST API, SDKs, MCP server) live at [utilix.tech/changelog](https://utilix.tech/changelog). This file tracks just this package.
 
+## 0.78.0
+- Add `ndjson_to_csv` tool: convert newline-delimited JSON (one flat object per line) into CSV, inferring the header row from the union of keys across all lines.
+
+## 0.77.0
+- Add `read_pdf_outline` tool: walk a PDF's /Outlines bookmark tree (the Root -> Outlines -> First/Next/First chain) and list every bookmark's title, nesting level, and link target, in document order.
+- Add `score_security_headers` tool: score a pasted block of raw HTTP response headers against commonly recommended security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-*), with an overall 0-100 score and A-F letter grade.
+
 ## 0.76.0
 - Add `detect_wordy_phrases` tool: scan text against a curated table of wordy/redundant phrases ("due to the fact that", "in order to") and flag each occurrence with a suggested concise replacement, an occurrence count, and character offsets.
 - Add `check_oxford_comma_consistency` tool: scan a document for comma-before-and/or usage in three-or-more-item lists and flag documents that mix Oxford comma styles.

package/README.md

@@ -1,6 +1,6 @@
 # @utilix-tech/mcp
 
-MCP server exposing 247 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
+MCP server exposing 250 developer utility tools to Claude, Cursor, VS Code Copilot, and any [Model Context Protocol](https://modelcontextprotocol.io) compatible AI assistant.
 
 No API key required. All tools run locally. Requires Node.js 18 or later.
 
@@ -213,7 +213,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `calculate_loan_prepayment_penalty` | Compute the dollar penalty cost of paying a loan off early, given its remaining payoff balance and a prepayment penalty structure: either a flat percent of the payoff balance, or a fixed number of months of interest at the loan's annual rate |
 | `estimate_data_transfer_time` | Estimate the theoretical time to transfer a file of a given size over a connection of a given speed, or (given a target time instead) the bandwidth required to hit it |
 
-### API / Network (50 tools)
+### API / Network (51 tools)
 | Tool | Description |
 |------|-------------|
 | `decode_jwt` | Decode a JWT: header, payload, and expiry |
@@ -268,6 +268,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_robots_meta_tag` | Parse an existing robots meta tag (or bare content value) into the same shape |
 | `calculate_cookie_size_budget` | Parse a Cookie header's name=value pairs and compute each cookie's and the total header's byte size against RFC 6265's 4096-byte per-cookie guarantee and a configurable budget |
 | `verify_webhook_signature` | Recompute an HMAC over a raw webhook payload and compare it to a provided signature, accepting a `sha256=` prefix style and matching against hex or base64 encoding |
+| `score_security_headers` | Score a pasted block of raw HTTP response headers against commonly recommended security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-*), with an overall 0-100 score and A-F letter grade |
 
 ### Color (4 tools)
 | Tool | Description |
@@ -312,6 +313,7 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `parse_csv` | Parse a CSV string and return the data as JSON |
 | `format_ndjson` | Validate and pretty-print newline-delimited JSON (NDJSON) |
 | `dedupe_ndjson` | Remove duplicate records from NDJSON, by exact match or by a key field |
+| `ndjson_to_csv` | Convert NDJSON into CSV, inferring the header row from the union of keys |
 | `diff_env_example` | Diff a .env file against its .env.example template: flags keys missing from either side, plus empty placeholder values |
 | `parse_markdown_front_matter` | Split a Markdown document into its YAML front matter fields and body content |
 | `generate_markdown_toc` | Scan a Markdown document's ATX headings and build a nested table of contents with GitHub-style anchor slugs |
@@ -375,11 +377,12 @@ claude mcp add utilix -- npx -y @utilix-tech/mcp
 | `read_ico_info` | Read how many images a .ico file embeds and each one's width, height, color depth, and size from its ICONDIR header |
 | `inspect_gif_frames` | Walk a GIF87a/89a file's block structure to report frame count, total animation duration, and loop count, without decoding any LZW-compressed pixel data |
 
-### PDF (2 tools)
+### PDF (3 tools)
 | Tool | Description |
 |------|-------------|
 | `read_pdf_metadata` | Read title, author, dates, page count, and encryption flag from a PDF's trailer/Info dictionary: no PDF rendering library required |
 | `read_pdf_page_dimensions` | List each page's MediaBox width/height (points and inches), rotation, and orientation, walking the Root -> Pages -> Kids tree: no PDF rendering library required |
+| `read_pdf_outline` | Walk a PDF's /Outlines bookmark tree (Root -> Outlines -> First/Next/First chain) and list every bookmark's title, nesting level, and link target, in document order: no PDF rendering library required |
 
 ### Audio (4 tools)
 | Tool | Description |

package/dist/index.js

@@ -2702,6 +2702,61 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+function _toCsvStringMcp(headers, rows) {
+  const escapeField = (field) => {
+    if (field.includes(",") || field.includes('"') || field.includes("\n") || field.includes("\r")) {
+      return `"${field.replace(/"/g, '""')}"`;
+    }
+    return field;
+  };
+  const lines = [headers.map(escapeField).join(",")];
+  for (const row of rows) lines.push(row.map(escapeField).join(","));
+  return lines.join("\n");
+}
+function _stringifyCsvValueMcp(value) {
+  if (value === void 0 || value === null) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "object") return JSON.stringify(value);
+  return String(value);
+}
+function _ndjsonToCsvMcp(input) {
+  const validated = _validateNdjson(input);
+  if (!validated.valid) {
+    const firstError = validated.lines.find((l) => !l.valid);
+    return { error: firstError ? `Line ${firstError.line}: ${firstError.error}` : "Invalid NDJSON" };
+  }
+  if (validated.lines.length === 0) return { error: "No records found" };
+  const records = validated.lines.map((l) => JSON.parse(l.raw));
+  for (const record of records) {
+    if (typeof record !== "object" || record === null || Array.isArray(record)) {
+      return { error: "Every line must be a flat JSON object to convert to CSV" };
+    }
+  }
+  const headers = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    for (const key of Object.keys(record)) {
+      if (!seen.has(key)) {
+        seen.add(key);
+        headers.push(key);
+      }
+    }
+  }
+  const rows = records.map((record) => headers.map((h) => _stringifyCsvValueMcp(record[h])));
+  return { output: _toCsvStringMcp(headers, rows) };
+}
+server.tool(
+  "ndjson_to_csv",
+  "Convert NDJSON (newline-delimited JSON, one flat object per line) into CSV, inferring the header row from the union of keys across every line.",
+  {
+    input: z.string().describe("NDJSON content: one flat JSON object per line")
+  },
+  async ({ input }) => {
+    const result = _ndjsonToCsvMcp(input);
+    if ("error" in result) return errText(result);
+    return text(result.output);
+  }
+);
 function _decodePdfString(raw, isHex) {
   const bytes = [];
   if (isHex) {
@@ -2972,6 +3027,84 @@ server.tool("read_pdf_page_dimensions", "List each page's MediaBox width/height
   if ("error" in result) return errText(result);
   return text(JSON.stringify(result, null, 2));
 });
+function _parsePdfOutlineDest(dict) {
+  const directRef = dict.match(/\/Dest\s*\[\s*(\d+)\s+(\d+)\s+R/);
+  if (directRef) return { destType: "page", target: `${directRef[1]} ${directRef[2]} R` };
+  const directName = dict.match(/\/Dest\s*\/([^\s/()<>[\]]+)/);
+  if (directName) return { destType: "named", target: directName[1] };
+  const directString = dict.match(/\/Dest\s*\(((?:\\.|[^\\()])*)\)/);
+  if (directString) return { destType: "named", target: _decodePdfString(directString[1], false) };
+  const actionUri = dict.match(/\/S\s*\/URI[\s\S]*?\/URI\s*\(((?:\\.|[^\\()])*)\)/);
+  if (actionUri) return { destType: "uri", target: _decodePdfString(actionUri[1], false) };
+  const actionGotoRef = dict.match(/\/S\s*\/GoTo[\s\S]*?\/D\s*\[\s*(\d+)\s+(\d+)\s+R/);
+  if (actionGotoRef) return { destType: "page", target: `${actionGotoRef[1]} ${actionGotoRef[2]} R` };
+  const actionGotoName = dict.match(/\/S\s*\/GoTo[\s\S]*?\/D\s*\/([^\s/()<>[\]]+)/);
+  if (actionGotoName) return { destType: "named", target: actionGotoName[1] };
+  return { destType: "none", target: null };
+}
+function _walkPdfOutlineChain(objMap, startRef, level, visited, out) {
+  let ref = startRef;
+  while (ref) {
+    if (visited.has(ref)) break;
+    visited.add(ref);
+    const body = objMap.get(ref);
+    if (!body) break;
+    const titleRaw = _extractPdfField(body, "Title");
+    const { destType, target } = _parsePdfOutlineDest(body);
+    out.push({ title: titleRaw ?? "(untitled)", level, destType, target });
+    const firstMatch = body.match(/\/First\s+(\d+)\s+(\d+)\s+R/);
+    if (firstMatch) _walkPdfOutlineChain(objMap, `${firstMatch[1]} ${firstMatch[2]}`, level + 1, visited, out);
+    const nextMatch = body.match(/\/Next\s+(\d+)\s+(\d+)\s+R/);
+    ref = nextMatch ? `${nextMatch[1]} ${nextMatch[2]}` : null;
+  }
+}
+function _readPdfOutline(bytes) {
+  if (bytes.length < 8) return { error: "File too small to be a PDF" };
+  const latin1 = (b) => {
+    let out2 = "";
+    const CHUNK = 32768;
+    for (let i = 0; i < b.length; i += CHUNK) out2 += String.fromCharCode(...b.subarray(i, i + CHUNK));
+    return out2;
+  };
+  const header = latin1(bytes.subarray(0, 16));
+  const versionMatch = header.match(/%PDF-(\d\.\d)/);
+  if (!versionMatch) return { error: "Not a valid PDF file (missing %PDF header)" };
+  const version = versionMatch[1];
+  const text2 = latin1(bytes);
+  const objBlocks = [...text2.matchAll(/(\d+)\s+(\d+)\s+obj([\s\S]*?)endobj/g)];
+  const objMap = /* @__PURE__ */ new Map();
+  for (const b of objBlocks) objMap.set(`${b[1]} ${b[2]}`, b[3]);
+  let outlinesBody = null;
+  const trailerMatches = [...text2.matchAll(/trailer\s*<<([\s\S]*?)>>/g)];
+  if (trailerMatches.length > 0) {
+    const trailer = trailerMatches[trailerMatches.length - 1][1];
+    const rootRef = trailer.match(/\/Root\s+(\d+)\s+(\d+)\s+R/);
+    if (rootRef) {
+      const catalogBody = objMap.get(`${rootRef[1]} ${rootRef[2]}`);
+      const outlinesRef = catalogBody?.match(/\/Outlines\s+(\d+)\s+(\d+)\s+R/);
+      if (outlinesRef) outlinesBody = objMap.get(`${outlinesRef[1]} ${outlinesRef[2]}`) ?? null;
+    }
+  }
+  if (!outlinesBody) {
+    for (const b of objBlocks) {
+      if (/\/Type\s*\/Outlines\b/.test(b[3])) {
+        outlinesBody = b[3];
+        break;
+      }
+    }
+  }
+  if (!outlinesBody) return { error: "No /Outlines bookmark tree found in this PDF" };
+  const out = [];
+  const firstMatch = outlinesBody.match(/\/First\s+(\d+)\s+(\d+)\s+R/);
+  if (firstMatch) _walkPdfOutlineChain(objMap, `${firstMatch[1]} ${firstMatch[2]}`, 0, /* @__PURE__ */ new Set(), out);
+  return { version, bookmarkCount: out.length, bookmarks: out };
+}
+server.tool("read_pdf_outline", "Walk a PDF's /Outlines bookmark tree (Root -> Outlines -> First/Next/First chain) and list every bookmark's title, nesting level, and link target, in document order: no PDF rendering library required. Does not resolve a page-ref target to a page number.", { pdf_base64: z.string().describe("Base64-encoded PDF bytes, optionally prefixed with a data: URL scheme") }, async ({ pdf_base64 }) => {
+  const bytes = new Uint8Array(Buffer.from(pdf_base64.replace(/^data:.*;base64,/, ""), "base64"));
+  const result = _readPdfOutline(bytes);
+  if ("error" in result) return errText(result);
+  return text(JSON.stringify(result, null, 2));
+});
 var _EXIF_ORIENTATION_LABELS = {
   1: "Normal",
   2: "Mirrored horizontal",
@@ -11731,6 +11864,135 @@ server.tool(
     return text(JSON.stringify(result, null, 2));
   }
 );
+function _parseRawHeaderBlockMcp(raw) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of raw.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const idx = trimmed.indexOf(":");
+    if (idx === -1) continue;
+    const name = trimmed.slice(0, idx).trim().toLowerCase();
+    const value = trimmed.slice(idx + 1).trim();
+    if (!map.has(name)) map.set(name, value);
+  }
+  return map;
+}
+var _SECURITY_HEADER_CHECKS_MCP = [
+  {
+    header: "Content-Security-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without a CSP, an injected script runs with full page privileges." };
+      if (/unsafe-inline|unsafe-eval/i.test(v)) return { status: "warning", note: "Contains unsafe-inline or unsafe-eval, which weakens XSS protection." };
+      return { status: "pass", note: "Present. Use the CSP Header Builder tool to validate its directives in depth." };
+    }
+  },
+  {
+    header: "Strict-Transport-Security",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without HSTS, a user's first visit (and any later downgrade) can be sent over plain HTTP." };
+      const maxAgeMatch = v.match(/max-age\s*=\s*(\d+)/i);
+      if (!maxAgeMatch) return { status: "warning", note: "Present but missing a max-age directive." };
+      const maxAge = Number(maxAgeMatch[1]);
+      if (maxAge < 31536e3) return { status: "warning", note: "max-age is below the recommended 1 year (31536000 seconds)." };
+      return { status: "pass", note: "Present with a max-age of at least 1 year." };
+    }
+  },
+  {
+    header: "X-Content-Type-Options",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, browsers may MIME-sniff a response into an unintended content type." };
+      if (v.trim().toLowerCase() !== "nosniff") return { status: "warning", note: `"nosniff" is the only valid value; this value won't take effect.` };
+      return { status: "pass", note: "Set to the only valid value, nosniff." };
+    }
+  },
+  {
+    header: "X-Frame-Options",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this (or a CSP frame-ancestors directive), the page can be framed by another site for clickjacking." };
+      const upper = v.trim().toUpperCase();
+      if (upper === "DENY" || upper === "SAMEORIGIN") return { status: "pass", note: `Framing restricted (${upper}).` };
+      if (upper.startsWith("ALLOW-FROM")) return { status: "warning", note: "ALLOW-FROM is deprecated and ignored by most modern browsers." };
+      return { status: "warning", note: "Unrecognized value." };
+    }
+  },
+  {
+    header: "Referrer-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, the browser's default referrer behavior applies, which can leak full URLs to third parties." };
+      if (v.trim().toLowerCase() === "unsafe-url") return { status: "warning", note: "unsafe-url leaks the full URL, including path and query string, to every destination." };
+      return { status: "pass", note: "Present." };
+    }
+  },
+  {
+    header: "Permissions-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without this header, embedded content can use powerful browser features (camera, geolocation, etc.) unless restricted another way." };
+      return { status: "pass", note: "Present." };
+    }
+  },
+  {
+    header: "Cross-Origin-Opener-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without COOP, this page can be put in the same browsing context group as a malicious opener window." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "same-origin") return { status: "pass", note: "Set to same-origin, the strongest isolation value." };
+      return { status: "warning", note: `Set to "${v.trim()}", which is weaker than same-origin.` };
+    }
+  },
+  {
+    header: "Cross-Origin-Embedder-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Required alongside COOP for cross-origin isolation (e.g. to use SharedArrayBuffer)." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "require-corp" || lower === "credentialless") return { status: "pass", note: `Set to ${lower}.` };
+      return { status: "warning", note: `Unrecognized value "${v.trim()}".` };
+    }
+  },
+  {
+    header: "Cross-Origin-Resource-Policy",
+    evaluate: (v) => {
+      if (!v) return { status: "missing", note: "Without CORP, this resource can be loaded cross-origin by any site that knows its URL." };
+      const lower = v.trim().toLowerCase();
+      if (lower === "same-origin" || lower === "same-site") return { status: "pass", note: `Set to ${lower}.` };
+      if (lower === "cross-origin") return { status: "warning", note: "Set to cross-origin, which allows any site to load this resource." };
+      return { status: "warning", note: `Unrecognized value "${v.trim()}".` };
+    }
+  }
+];
+function _scoreSecurityHeadersMcp(rawHeaders) {
+  if (typeof rawHeaders !== "string" || !rawHeaders.trim()) {
+    return { error: 'Paste one or more response headers, one per line in "Name: value" form' };
+  }
+  const headerMap = _parseRawHeaderBlockMcp(rawHeaders);
+  if (headerMap.size === 0) {
+    return { error: 'Could not parse any "Name: value" header lines from the input' };
+  }
+  const checks = _SECURITY_HEADER_CHECKS_MCP.map((def) => {
+    const value = headerMap.get(def.header.toLowerCase()) ?? null;
+    const { status, note } = def.evaluate(value);
+    return { header: def.header, status, value, note };
+  });
+  const passCount = checks.filter((c) => c.status === "pass").length;
+  const warningCount = checks.filter((c) => c.status === "warning").length;
+  const missingCount = checks.filter((c) => c.status === "missing").length;
+  const totalChecks = checks.length;
+  const points = passCount + warningCount * 0.5;
+  const score = Math.round(points / totalChecks * 100);
+  const grade = score >= 90 ? "A" : score >= 75 ? "B" : score >= 60 ? "C" : score >= 40 ? "D" : "F";
+  return { checks, score, grade, passCount, warningCount, missingCount, totalChecks };
+}
+server.tool(
+  "score_security_headers",
+  'Parse a pasted block of raw HTTP response headers (one "Name: value" pair per line) and score it against commonly recommended security headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and the three Cross-Origin-* isolation headers), with an overall 0-100 score and A-F letter grade. Evaluates the header text you give it, not a live request.',
+  {
+    headers: z.string().describe('Raw response headers, one "Name: value" pair per line')
+  },
+  async ({ headers }) => {
+    const result = _scoreSecurityHeadersMcp(headers);
+    if ("error" in result) return errText(result);
+    return text(JSON.stringify(result, null, 2));
+  }
+);
 function _roundMoneyPrepaymentPenaltyMcp(n) {
   return Math.round(n * 100) / 100;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@utilix-tech/mcp",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "description": "MCP server exposing 198 Utilix developer tools to Claude, Cursor, VS Code Copilot, and any MCP-compatible AI assistant.",
   "author": "Utilix <hello@utilix.tech>",
   "license": "MIT",