How do I use mcp-devtools?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-devtools validate and format this JSON: {"name":"John","age":30}" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

mcp-devtools

by VBSage

Overview Schema Related Servers Score Discussions

TypeScript

Local

mcp-devtools

License: MIT

A small, production-quality Model Context Protocol (MCP) server exposing credential-free developer utilities. Built as a reference/demo of clean MCP server engineering: typed tool schemas, structured output, a resource, a prompt, unit tests, and an end-to-end protocol smoke test.

Zero credentials, zero network. Clone it, install, and it runs — nothing to configure, nothing to leak.

CI (.github/workflows/ci.yml) runs typecheck + unit tests + build + the wire-protocol smoke test on every push. Licensed MIT (see LICENSE).

Provenance: designed and reviewed by a human engineer (architecture, the decode-only security framing, the wire-protocol test strategy); implementation is AI-assisted. What's being sold is the engineering judgment, not the typing.

What it exposes

Tools (6):

Tool	Does
`json_tools`	Validate + format / minify / recursively sort-keys a JSON string
`regex_test`	Run a regex against a subject; returns every match, index, and capture group (structured output)
`hash_text`	MD5 / SHA-1 / SHA-256 / SHA-512 hex digest of text
`uuid_generate`	Generate 1–100 RFC-4122 v4 UUIDs
`base64_transform`	Base64 encode/decode, with an optional URL-safe alphabet
`jwt_inspect`	Decode a JWT's header/payload + expiry (decode only — does not verify the signature)

Resource: devtools://reference/http-status-codes — common HTTP status codes as JSON. Prompt: code_review — a parameterized code-review request.

Related MCP server: mcp-dev-utils

Install & run

npm install
npm run build        # compile to dist/
npm start            # run the server on stdio

Development (no build step, via tsx):

npm run dev

Verify it works

npm test             # unit tests for all tool logic (node:test)
npm run smoke        # end-to-end: spawns the server, drives it with a real MCP client

npm run smoke connects an actual MCP client over stdio, lists the tools/resource/prompt, and calls each tool — proving the wire protocol, not just the functions. Expected tail:

ALL CHECKS PASSED

Add it to an MCP client

Claude Code

claude mcp add devtools -- node /absolute/path/to/mcp-devtools/dist/server.js

Claude Desktop — add to claude_desktop_config.json:

{
  "mcpServers": {
    "devtools": {
      "command": "node",
      "args": ["/absolute/path/to/mcp-devtools/dist/server.js"]
    }
  }
}

Then ask the assistant things like "sort the keys in this JSON", "sha256 this string", or "decode this JWT" and it will call the tools.

Design notes (why it's built this way)

Tool logic is separated from transport (src/logic.ts vs src/server.ts) so every tool is unit-testable in isolation and the MCP layer stays thin.
Deterministic + self-contained — no network calls, no API keys, no live services. Errors are returned as isError tool results, not thrown, so the client sees a clean message.
jwt_inspect decodes only. Signature verification needs key material and a stated algorithm policy; conflating "decode" with "verify" is a common security mistake, so this tool is explicit about not verifying.
Structured output on regex_test returns a typed object (validated against the tool's outputSchema) alongside the human-readable text.

Stack

TypeScript · @modelcontextprotocol/sdk · zod · Node ≥ 20 · tests on node:test.

MIT-licensed engineering sample; provided as-is. Provenance note at the top.

Available Tools

6 tools

base64_transformBase64 encode / decodeA

Encode or decode text as Base64, with an optional URL-safe alphabet.

ParametersJSON Schema

Name	Required	Description	Default
`text`	Yes
`urlSafe`	No
`direction`	Yes

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description discloses core behavior: encoding/decoding with an optional URL-safe alphabet. It does not mention edge cases (e.g., invalid input) but is sufficient for a simple transformation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no wasted words. Purpose is front-loaded and immediately clear. Ideal conciseness for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (3 params, no output schema), the description covers the main operation and one parameter. Lacks details on output format or error handling, but is adequate for basic use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It explains 'text' (the input) and 'urlSafe' (optional alphabet), but 'direction' is only inferred from 'encode or decode'. Adds some meaning but not full parameter context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The title and description clearly state the tool performs Base64 encoding and decoding, with optional URL-safe alphabet. This distinguishes it from sibling tools like hash_text (hashing), json_tools (JSON operations), jwt_inspect, regex_test, and uuid_generate, which all serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for Base64 conversion but provides no explicit guidance on when to use this tool versus alternatives or when not to use it. No exclusions or preferred scenarios are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hash_textHash textA

Compute a cryptographic digest (hex) of UTF-8 text.

ParametersJSON Schema

Name	Required	Description	Default
`text`	Yes
`algorithm`	No		sha256

TDQS

A3.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It mentions the output is a hex digest, implying a pure computation with no side effects, but does not explicitly state idempotency, performance characteristics, or any restrictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that conveys the core functionality without redundant words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and low parameter coverage, the description is minimally adequate. It specifies the output format (hex) but omits details like output length, casing, or behavior for empty input.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds value over the schema by specifying 'UTF-8 text' for the text parameter, providing encoding context. However, the algorithm parameter (with enum options) is not described at all, leaving the agent to infer from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Compute' and the resource 'cryptographic digest (hex) of UTF-8 text', which is specific and distinguishable from sibling tools like base64_transform or json_tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives. Sibling tools exist (e.g., base64_transform for encoding, hash_text for hashing) but no comparison or exclusionary information is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

json_toolsJSON format / minify / sortA

Validate and reshape a JSON string. mode=format pretty-prints, minify compacts, sort_keys recursively alphabetizes object keys. Returns a clear error for invalid JSON.

ParametersJSON Schema

Name	Required	Description	Default
`mode`	No		format
`input`	Yes	The JSON text to process
`indent`	No	Indent width for format/sort_keys

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It explains each mode's effect (pretty-print, compact, alphabetize keys) and notes error handling for invalid JSON. It does not mention output format or potential side effects, but these are minimal for a read-only tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with purpose, and every phrase adds value. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters, no output schema, and no annotations, the description covers the core functionality and error behavior. It could explicitly describe the return value (transformed JSON string), but it is implied by the tool's purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67% (input and indent described, mode only enum). The description adds meaning by explaining each mode's effect and clarifying that indent applies to format/sort_keys, supplementing the schema's default explanation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Validate and reshape') and resource ('JSON string'), listing three distinct modes (format, minify, sort_keys). This clearly distinguishes the tool from its siblings, which operate on different data types (base64, hash, JWT, regex, UUID).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states the tool's purpose and modes, implying use when processing JSON strings. No explicit 'when not to use' or alternatives are provided, but given the unrelated siblings, the context is sufficient for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

jwt_inspectInspect a JWT (decode only)A

Decode a JWT's header and payload and report whether a signature segment is present and whether the token is expired. Does NOT verify the signature — decoding only.

ParametersJSON Schema

Name	Required	Description	Default
`token`	Yes	The compact JWT (header.payload.signature)

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but description explains what it does (decode header/payload, report signature presence and expiration) and what it does not do (no signature verification). This is sufficient transparency for a simple decode tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded, no fluff. Every word adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter and no output schema, the description covers purpose, limitations, and behavioral details. It could be improved by describing the output format (e.g., returns decoded JSON), but it's largely complete for a simple inspection tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema describes the 'token' parameter as 'compact JWT (header.payload.signature)'. The description adds meaning by explaining that the tool decodes the header and payload and reports on signature and expiration, adding context beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states it decodes a JWT's header and payload, reports signature presence and expiration, and explicitly says it does not verify signature. This distinguishes it from sibling tools like base64_transform, hash_text, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Description explicitly says 'Does NOT verify the signature — decoding only,' which tells when not to use it. It provides clear context but does not name an alternative tool for verification.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

regex_testRegex testerA

Run a JavaScript regular expression against a subject string and return each match with its index, positional capture groups, and any named groups. Flags are honored exactly: without the g flag only the first match is returned; with g, all matches.

ParametersJSON Schema

Name	Required	Description
`flags`	No	Regex flags, e.g. "g", "i", "m", "s"
`pattern`	Yes	The regular-expression source (no slashes)
`subject`	Yes	The text to search

Output Schema

ParametersJSON Schema

Name	Required	Description
`error`	No
`valid`	Yes
`matches`	No
`matchCount`	No

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses key behavior: without 'g' returns first match, with 'g' all matches. Also mentions return structure. No annotations provided, so description carries full burden and does it well.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two succinct sentences, immediately clear, no redundant words. Front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema (covers return values), the description adequately explains the tool's behavior and parameters. No gaps for a regex testing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% (all 3 params described). Description adds value by explaining the effect of the 'g' flag on matching behavior, beyond the schema's brief 'Regex flags' description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action ('Run a JavaScript regular expression against a subject string') and the output ('return each match with its index, positional capture groups, and any named groups'). Sibling tools are unrelated, so no confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes the effect of the 'g' flag, guiding when to use it. No explicit comparison to alternatives, but siblings are orthogonal, so not needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

uuid_generateGenerate UUIDsA

Generate one or more RFC-4122 version-4 UUIDs (1–100).

ParametersJSON Schema

Name	Required	Description	Default
`count`	No

TDQS

A3.5/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It only states the tool generates UUIDs, but does not confirm that the operation is random, idempotent, side-effect-free, or deterministic. Additional traits like return format or required permissions are omitted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that conveys the core purpose and parameter range without any extraneous information. Every word earns its place, and the structure is front-loaded with the key action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one optional parameter, no annotations, and no output schema, the description is mostly complete but lacks clarification on the return format (e.g., 'Returns a JSON array of UUID strings'). The agent might infer this from the name, but completeness warrants explicit mention.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains that the 'count' parameter controls the number of UUIDs generated (1–100), which aligns with the schema constraints. While it doesn't mention the default value (1) or the exact return format, it provides essential semantic context beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates RFC-4122 version-4 UUIDs, with a specific count range (1–100). It uses a specific verb ('Generate') and resource ('RFC-4122 version-4 UUIDs'), distinguishing it from sibling tools which handle data transformation, hashing, or JSON manipulation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. The description is purely functional and does not mention context, prerequisites, or exclusions. Sibling tools suggest different purposes (e.g., hashing, JSON), but the description offers no explicit comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

6 tool updatesv1.0.0Jul 14, 2026
- First observedbase64_transform
- First observedhash_text
- First observedjson_tools
- First observedjwt_inspect
- First observedregex_test
- First observeduuid_generate

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4/5.0

Disambiguation5/5

Each tool has a clearly distinct purpose: base64 encoding/decoding, hashing, JSON formatting/validation, JWT inspection, regex testing, and UUID generation. No overlap.

Naming Consistency4/5

Tools follow snake_case with descriptive names, mostly verb_noun or noun_verb pattern. 'json_tools' is slightly generic but still consistent with others.

Tool Count5/5

6 tools is well-scoped for a developer utilities server. Each tool earns its place without being too few or too many.

Completeness4/5

Covers common text/format utilities (Base64, hash, JSON, JWT, regex, UUID). Missing URL encoding/decoding but still sufficient for typical use.

Maintenance

ActivitySlowing

ResponsivenessSyncing

Resources

GitHub Repository

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

drwho.me developer tools A
me.drwho
Remote MCP server: 10 developer utilities (base64, JWT, DNS, UUID, URL, JSON, UA, IP lookup).
Developer Tools
2221
ToolPipe MCP Server
io.github.COSAI-Labs
238+ dev tools via MCP: JSON, QR, PDF, DNS, hash, UUID, code review, JWT, SSL, WHOIS, and more
Developer Tools Code Analysis App Automation
26
developer-tools B
net.programmes
65+ free in-browser developer tools (JSON, Base64, JWT, hash, regex…) callable over MCP.
Developer Tools Code Analysis
2
botoi-mcp A
io.github.XogZ3
49 developer tools via MCP: DNS, WHOIS, IP lookup, JWT, hashing, QR, and more.
Developer Tools Networking & Infrastructure
492

Related MCP Servers

mcp-server-devutils
Developer Tools Command Line
ofershap
A
license
A
quality
D
maintenance
Zero-auth MCP server with everyday developer utilities: base64, UUID, hash, JWT decode, cron, timestamps, JSON, regex.
Updated 6 months ago (2026-03-10 09:22 UTC)
17
88
4
MIT
mcp-dev-utils
Developer Tools
jegor377
F
license
A
quality
C
maintenance
A lightweight MCP server providing everyday developer utilities such as JSON formatting, UUID generation, Base64 conversion, HTTP status lookup, and Unix timestamp conversion as tools and resources.
Updated 3 months ago (2026-06-19 10:43 UTC)
5
-
toolkit-mcp
Developer Tools
pyofart
A
license
Not graded
quality
B
maintenance
An MCP server offering developer utilities including JSON validation, base64 encoding, timestamp conversion, and hashing, built with a clean architecture for easy extensibility.
Updated 2 months ago (2026-06-28 00:55 UTC)
MIT
devtool
Developer Tools
talocode
A
license
Not graded
quality
B
maintenance
A unified developer toolbox MCP server providing utilities for base64, JWT, timestamps, UUID, JSON formatting, hashing, URL handling, case conversion, color conversion, number bases, string operations, and regex.
Updated 2 months ago (2026-07-12 07:57 UTC)
15
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/VBSage/mcp-devtools'

If you have feedback or need assistance with the MCP directory API, please join our Discord server