Install a Local MCP Utility Plugin in Cursor with DevUtils

AI assistants are useful at explaining code, but they should not improvise a SHA-256 digest, decode a JWT by hand, or guess whether an IP address belongs to a subnet. Those are small, deterministic operations that deserve a tool with a clear contract.

DevUtils MCP Plugin packages that idea for Cursor and Claude Code. It installs a local MCP server with utilities for hashing, encoding, UUID generation, JWT inspection, JSON, network calculations, and text processing. The plugin wrapper is open source under the MIT license, and its configuration starts the server through npx on your own machine.

This tutorial installs the plugin, shows the equivalent configuration, verifies the MCP stdio handshake, and explains the boundary between local processing and package downloads.

TL;DR

Install DevUtils MCP from Cursor Settings, enable the devutils server, and ask your assistant to use a deterministic utility such as UUID generation or JSON validation. The plugin manifest is version 1.0.7 on the repository's current branch. The wrapped devutils-mcp-server package requires Node.js 18 or newer.

The server exposes 36 tools. They run locally after the package is available, so the inputs you send to a tool are handled by the local MCP process rather than an API operated by the plugin author.

Prerequisites

You need:

• Cursor with MCP support, or Claude Code with plugin support.
• Node.js 18 or newer. The server README recommends Node.js 22.
• Permission to let npx download devutils-mcp-server the first time it runs.

The plugin repository is paladini/devutils-cursor-plugin. It is a wrapper and distribution package. The implementation of the 36 utilities lives in the related devutils-mcp-server repository.

Install it in Cursor

The repository documents this path for Cursor:

1. Open Cursor Settings.
2. Open Customize.
3. Search for DevUtils MCP.
4. Select Install.
5. Enable the devutils MCP server under Customize > MCPs.

You can also choose Add from GitHub and enter paladini/devutils-cursor-plugin. The repository's Cursor manifest names the plugin devutils-mcp, declares version 1.0.7, and points its MCP configuration at the devutils server.

After enabling it, start with a request that has an observable result:

Use the DevUtils MCP server to generate one UUID v4 and return only the UUID.

The important detail is the request's explicit tool choice. It gives you a way to distinguish an MCP result from an answer the model generated without calling the server.

What Cursor is launching

The plugin contains this small stdio configuration:

{
  "mcpServers": {
    "devutils": {
      "command": "npx",
      "args": ["-y", "devutils-mcp-server"]
    }
  }
}

npx -y can download the package when it is not already available. Once started, the MCP server communicates over standard input and standard output. The plugin does not add a web endpoint, API key, or remote service.

If your client does not support the plugin marketplace, the server README documents the same command for manual MCP configuration. For example, a client that uses an mcpServers object can reuse the JSON above. Keep the command and arguments unchanged unless you have a deliberate reason to pin or replace the package source.

Verify the connection without guessing

You can test the server boundary outside Cursor with a JSON-RPC initialize message. This is a protocol smoke test, not a test of every utility:

$message = '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"smoke-test","version":"1.0"}}}'
$message | npx -y devutils-mcp-server

A successful response contains a JSON-RPC result with server information and a tools capability. The server also writes a short startup line to stderr. Seeing the response confirms that Node.js can resolve the package and that the process accepts MCP input over stdio.

For a client-level verification, ask Cursor to perform a simple operation and then repeat it with a known local value:

Use DevUtils to calculate the SHA-256 hash of the exact string: hello

The result should be deterministic. You can compare it with a local command such as Get-FileHash for a file, or with a trusted library for a string. The point is not that MCP is faster than a native library. The point is that an assistant can call a named operation with a defined input instead of inventing a result.

Useful operations to try

The server README groups the tools into eight areas:

• Hashing: MD5, SHA-1, SHA-256, SHA-512, bcrypt generation, and bcrypt verification.
• Encoding: Base64, URL, HTML entity, and hexadecimal conversions.
• Generators: UUID v4, Nano ID, passwords, and random hex values.
• JWT: decoding and structure or expiration validation.
• JSON: formatting, validation, and dot-notation queries.
• Converters: timestamps, number bases, colors, and byte units.
• Network: CIDR calculations and IPv4 or IPv6 classification.
• Text: case conversion, slugs, regular-expression checks, statistics, and diffs.

These are good assistant tasks because each one has a compact input and an inspectable output. For example:

Use DevUtils to validate this JSON and explain the error location: {"enabled": true,}

Or:

Use DevUtils to calculate the network and host range for 192.168.10.0/24.

Do not send a real password, production token, customer record, or private document just to test the integration. Use synthetic values first.

Why the local boundary matters

The plugin's privacy policy says the tools process inputs on the local machine and that the plugin author does not collect or transmit them. That is a property of this plugin and server design, not a general guarantee about every MCP client or every package installed through npx.

There is still a network step: npx may fetch the npm package. The repository documents npm as a third-party service involved in that download. After the package is available, the server is intended to run locally and its README states that the utilities use no external APIs.

The security policy also makes the scope clear: the wrapper adds no network endpoints, while input validation and dependency updates belong to the server implementation. Review the server source and package provenance before using it with sensitive workflows.

Failure modes and limits

The server does not appear in Cursor

Check that the plugin is installed and that devutils is enabled under the MCP settings. Then verify node -v in a terminal. A missing Node.js installation prevents the npx command from starting.

npx cannot download the package

This is usually a registry, proxy, permission, or network problem. Run npx -y devutils-mcp-server directly and inspect the error. Do not treat a successful plugin installation as proof that the runtime package is available.

The assistant answers without using the tool

Ask it to name the DevUtils operation explicitly, then look for an MCP tool call in the client transcript. A plausible-looking answer is not verification.

You need application-level performance

Use a native library directly inside your application. The project itself says DevUtils is intended for AI-agent workflows, not as a replacement for optimized application code. MCP adds a process and protocol boundary.

You need a security guarantee

Do not infer one from the word “local.” Local software can still have bugs, compromised dependencies, unsafe inputs, or an overly privileged client. Pin dependencies where your deployment policy requires it, review the package source, and keep secrets out of exploratory prompts.

FAQ

Does the plugin require an API key?

No. The documented configuration starts the local server with npx, and the repository describes zero external API calls.

Can I use it without Cursor?

Yes. The server can be configured directly in other MCP-compatible clients. Claude Code can install the plugin with /plugin marketplace add paladini/devutils-cursor-plugin followed by /plugin install devutils-mcp@devutils-cursor-plugin.

Is the plugin the same as the server?

No. The plugin repository supplies manifests and client installation metadata. The related server repository contains the MCP implementation and utility tools.

Are JWTs sent to a cloud service?

The plugin documentation says JWT processing happens locally. Even so, use test tokens while evaluating the setup and verify the behavior of the exact client and package version you deploy.

Takeaway

DevUtils is a small, practical way to give an MCP-capable assistant deterministic developer utilities without adding a custom API service. Install the plugin, verify the stdio handshake, and start with synthetic inputs. The useful security habit is to understand both boundaries: package acquisition may use npm, while the tool operations are designed to execute locally.

Have you found a developer task where a deterministic MCP utility prevents more errors than a general-purpose coding assistant alone?

AI assistance disclosure: I used AI assistance to organize and edit this tutorial. The commands, versions, configuration, project metadata, and security notes were checked against the linked primary sources and a local MCP initialize smoke test.