Stop Letting AI Agents Guess Hashes, UUIDs, and JWTs

AI coding agents are good at reasoning over messy requirements. They should not be improvising deterministic operations such as hashing a string, generating a UUID, decoding a JWT, formatting JSON, or calculating a CIDR range.

Yet that is exactly what happens in many AI-assisted workflows. The model writes a throwaway script, reaches for a random website, produces an answer from memory, or spends several tool calls on a task that already has a precise implementation.

I wanted those small operations to be boring again. So I built DevUtils MCP Server: an open-source MCP server that exposes 36 local developer utilities to MCP-compatible AI assistants.

TL;DR

DevUtils gives Cursor, Claude Desktop, Claude Code, VS Code, Windsurf, and other MCP clients a consistent set of tools for:

• hashing and encoding;
• UUID, Nano ID, password, and random-hex generation;
• JWT inspection;
• JSON formatting and querying;
• timestamp, number-base, color, and byte conversion;
• CIDR and IP operations;
• common text transformations.

The operations run locally through an MCP stdio server and do not call external APIs. You can start it with:

npx -y devutils-mcp-server

Node.js 18 or newer is required.

The real problem is not Base64

Base64 encoding is easy. So is generating a UUID. That is why asking an AI model to handle these tasks feels harmless.

But a long agent workflow may need dozens of small, exact transformations. Each improvised implementation adds friction and another place for subtle mistakes:

• a timestamp is interpreted in the wrong timezone;
• a JWT expiration is displayed as an unreadable integer;
• malformed JSON produces a vague error;
• a CIDR calculation uses the wrong host range;
• a model describes a hash instead of actually calculating it.

These are not reasoning problems. They are tool problems.

MCP lets us give the agent explicit operations with named inputs, validated schemas, and structured results. The model decides when to use a utility; the utility performs the deterministic work.

Install DevUtils in an MCP client

For Cursor or Claude Desktop, add this server to the client's MCP configuration:

{
  "mcpServers": {
    "devutils": {
      "command": "npx",
      "args": ["-y", "devutils-mcp-server"]
    }
  }
}

Claude Desktop stores this configuration in:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json

Cursor can use the same server definition in ~/.cursor/mcp.json.

VS Code uses a slightly different top-level key:

{
  "servers": {
    "devutils": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "devutils-mcp-server"]
    }
  }
}

Restart or reload the client after changing its configuration. The exact UI varies by client, but you should see tools with names such as generate_uuid, jwt_decode, json_validate, and cidr_calculate.

I also smoke-tested the currently published npm package directly: it completed the MCP initialization handshake, and tools/list returned all 36 tools.

Try four practical workflows

1. Generate identifiers without writing a script

Ask your assistant:

Generate three UUID v4 values and return them as a JSON array.

The agent can call generate_uuid with batch support instead of inventing identifiers or creating a temporary program. For shorter URL-friendly identifiers, it can use generate_nanoid with a configured length.

2. Inspect a JWT expiration date

Ask:

Decode this JWT and explain its issued-at and expiration timestamps in UTC.

DevUtils exposes jwt_decode for the header and payload and returns human-readable dates. It also provides jwt_validate for structure and expiration checks.

There is an important boundary here: decoding a token is not the same as cryptographically verifying its signature. Do not treat a decoded payload as trusted identity data unless your application verifies the signature and expected claims with the correct key and algorithm.

3. Turn broken JSON into a useful error

Ask:

Validate this JSON. If it is invalid, show me where the syntax fails. If it is valid, format it with two-space indentation.

The agent can combine json_validate and json_format. For simple extraction, json_path_query supports dot-notation paths, which is often enough to inspect an API response without bringing in a full query language.

4. Check a network range during debugging

Ask:

Calculate the network address, broadcast address, mask, host range, and host count for 10.42.0.0/20.

That maps directly to cidr_calculate. ip_validate can also classify IPv4 and IPv6 input before another network operation uses it.

These examples are intentionally ordinary. A utility server is valuable because it removes repeated micro-decisions from larger workflows.

What else is included?

The 36 tools are grouped into eight areas:

• Hashing: MD5, SHA-1, SHA-256, SHA-512, bcrypt creation, and bcrypt verification.
• Encoding: Base64, URL, HTML entity, and hexadecimal encoding and decoding.
• Generators: UUID v4, Nano ID, password, and random hexadecimal values.
• JWT: payload decoding plus structure and expiration validation.
• JSON: formatting, validation, and path queries.
• Converters: timestamps, numeric bases, colors, and byte units.
• Network: CIDR calculation and IP validation.
• Text: statistics, case conversion, slug generation, regex tests, diffs, and placeholder text.

The server is implemented in TypeScript with the MCP SDK, Zod schemas, and stdio transport. The repository is available under the MIT license, and the package is published on npm as devutils-mcp-server.

What “local” does and does not mean

DevUtils performs its utility operations in the local MCP process. It does not send a hash input or JSON document to a separate conversion API.

That does not automatically make every prompt secret-safe. Your AI client and model may still receive the text you provide before deciding to call the tool. Do not paste production tokens, passwords, customer data, or private keys into an AI conversation merely because the final utility runs locally.

The usual cryptographic rules also still apply. MD5 and SHA-1 remain available for compatibility and checksums, not for secure password storage. Use an appropriate password-hashing design when protecting credentials.

When should you not use it?

If you are writing application code, use the standard library or a focused dependency. A direct crypto or hashlib call is faster and easier to test inside the application than routing the operation through MCP.

DevUtils is aimed at AI-agent workflows: debugging, investigation, repository maintenance, data inspection, and other multi-step tasks where the assistant benefits from reliable utilities.

It is also not useful if your client does not support MCP, and it adds process and protocol overhead compared with a direct function call. The point is consistency and tool availability, not maximum throughput.

FAQ

Does DevUtils MCP Server require an API key?

No. The server's 36 utility operations do not require external API credentials. Installing the npm package initially requires access to the npm registry unless it is already cached.

Does it work only with one AI assistant?

No. It uses MCP over stdio, so it can work with clients that support that transport. The repository documents configurations for Cursor, Claude Desktop, Claude Code, VS Code, Windsurf, and Docker-based setups.

Can it verify that a JWT is authentic?

No. The JWT tools decode tokens and validate their structure and expiration. Authenticity requires cryptographic signature verification with the correct key, algorithm, issuer, audience, and application policy.

Are all operations performed without external utility APIs?

Yes. The transformations themselves run in the local server process. Your AI client's own data handling remains a separate concern.

Make deterministic work deterministic

AI agents should spend their reasoning budget on the parts of development that actually require reasoning.

If your assistant repeatedly writes one-off scripts for hashes, IDs, encodings, timestamps, JSON, or network calculations, try DevUtils MCP Server on GitHub. Test it on a real workflow, inspect the tool calls, and open a discussion if a small developer utility is still missing.