io.github.matetools/mcp-server
NPM · @MATE-TOOLS/MCP-SERVER · SCANNED SEP 25
35 utility tools for AI agents — mate.tools API. Hash, regex, SEO, random, DNS, SSL, JWT.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 130 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability74
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 3255 tokens (~93/item across 35 items; 35 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
- Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage75
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 25% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 35 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 35 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
How do I install the io.github.matetools/mcp-server server?
io.github.matetools/mcp-server runs locally as an npm package, launched with npx -y @mate-tools/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @mate-tools/mcp-server
claude mcp add matetools-mcp-server -- npx -y @mate-tools/mcp-server
{
"mcpServers": {
"matetools-mcp-server": {
"command": "npx",
"args": [
"-y",
"@mate-tools/mcp-server"
]
}
}
} {
"servers": {
"matetools-mcp-server": {
"command": "npx",
"args": [
"-y",
"@mate-tools/mcp-server"
]
}
}
} codex mcp add matetools-mcp-server -- npx -y @mate-tools/mcp-server
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"matetools-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@mate-tools/mcp-server"
],
"enabled": true
}
}
} openclaw mcp add matetools-mcp-server --command npx --arg -y --arg @mate-tools/mcp-server
mcp_servers:
matetools-mcp-server:
command: "npx"
args: ["-y", "@mate-tools/mcp-server"] {
"McpServers": {
"matetools-mcp-server": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"@mate-tools/mcp-server"
]
}
}
} assistant mcp add matetools-mcp-server -t stdio -c npx -a -y @mate-tools/mcp-server
{
"mcpServers": {
"matetools-mcp-server": {
"command": "npx",
"args": [
"-y",
"@mate-tools/mcp-server"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 25 Sept 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 24 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 80 to 83. That category is still filling its 30-day observation window: 24 days of observed history at the previous scan, 25 at this one. The score rises as the window fills, whether or not the server changes.
- 23 Sept 26 −3
- Stability: pass → 0.80 functional
- 22 Sept 26 0
- Stability: 0.97 → pass security
- 21 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.
- 19 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 87 to 90. That category is still filling its 30-day observation window: 26 days of observed history at the previous scan, 27 at this one. The score rises as the window fills, whether or not the server changes.
- 17 Sept 26 −2
- Stability: pass → 0.83 functional
- 16 Sept 26 0
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 25 Sept 2026 · Analysed npm/@mate-tools/mcp-server@1.5.0
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
age_calc ~94
Compute age in years/months/days from a date of birth. Returns next birthday, days until, Western zodiac sign, generation (Gen Z / Millennial / Gen X / Boomer / Silent / Greatest / Gen Alpha), birth weekday, and leap-year info.
| Name | Type | Req | Description |
|---|---|---|---|
| date_of_birth | string | yes | – |
| reference | string | – | Date to compute age against. Default: now. |
| timezone | string | – | – |
No output schema declared.
No examples provided.
aspect_ratio ~87
Compute the reduced aspect ratio (16:9, 4:3, 21:9, ...) from a width and height; OR scale a given width OR height to a target ratio.
| Name | Type | Req | Description |
|---|---|---|---|
| height | number | – | – |
| ratio | string | – | e.g. "16:9", "4:3", "1.85:1". |
| width | number | – | – |
No output schema declared.
No examples provided.
base64_decode ~50
Base64-decode a string. Accepts both standard and URL-safe Base64; missing padding is auto-fixed. Returns text when valid UTF-8, otherwise hex.
| Name | Type | Req | Description |
|---|---|---|---|
| encoded | string | yes | – |
No output schema declared.
No examples provided.
base64_encode ~62
Base64-encode a string. Optional URL-safe variant (RFC 4648 §5: `-`/`_` instead of `+`/`/`, no padding).
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | – |
| url_safe | boolean | – | – |
No output schema declared.
No examples provided.
case_convert ~61
Convert text into multiple case styles in one call: upper, lower, title, sentence, snake, kebab, camel, pascal, constant. Pass `cases` to limit the response.
| Name | Type | Req | Description |
|---|---|---|---|
| cases | array | – | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
color_convert ~98
Convert any color (hex, rgb, rgba, hsl, hsla, named) into all standard color spaces. Returns hex, rgb, rgba, hsl, hsv, cmyk, closest CSS named color, WCAG luminance and contrast ratios vs. white and black (with AA/AAA flags).
| Name | Type | Req | Description |
|---|---|---|---|
| color | string | yes | #ff5733, rgb(255,87,51), hsl(...), tomato, ... |
No output schema declared.
No examples provided.
count_lines ~72
Count lines, words, sentences, paragraphs and characters in a chunk of text. Returns sixteen text metrics including duplicate-line detection, longest word, reading and speaking time estimates, and the dominant line-ending style (LF, CRLF or CR).
| Name | Type | Req | Description |
|---|---|---|---|
| text | string | yes | UTF-8 text. Max 1 MB. |
No output schema declared.
No examples provided.
credit_card_validate ~92
Validate a card number using the Luhn algorithm and detect the brand (Visa, MasterCard, Amex, Discover, JCB, Diners, UnionPay, Maestro, RuPay). The card number is never logged — only its length, IIN prefix, last 4, masked form, and Luhn outcome leave the server.
| Name | Type | Req | Description |
|---|---|---|---|
| number | string | yes | Card number (spaces and dashes OK). |
No output schema declared.
No examples provided.
date_math ~124
Date arithmetic. Two modes: provide `start` + `add` (e.g. "+90 days", "-2 weeks") to compute the resulting date, OR provide `start` + `end` to compute the diff. Diff mode optionally counts business days only.
| Name | Type | Req | Description |
|---|---|---|---|
| add | string | – | Relative duration like "+90 days", "-2 weeks", "next friday". |
| business_days | boolean | – | – |
| end | string | – | Optional end date — when present, returns a diff instead. |
| start | string | yes | ISO 8601 / human-readable date. |
No output schema declared.
No examples provided.
dns_lookup ~117
Resolve DNS records for a domain via the system resolver. Default lookup covers A, AAAA, MX, TXT, NS, CNAME, SOA, CAA. Also resolves reverse PTR records for A results. Use this to debug mail config (MX), domain ownership signals (TXT), name-server delegation (NS), CAA policy, and IP resolution. No SSRF risk — DNS only, no outbound connections.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Hostname (not URL). e.g. example.com |
| types | array | – | – |
No output schema declared.
No examples provided.
finance_calc ~85
Multi-mode financial calculations. `mode` selects: loan (principal+rate+term [+extra]), compound_interest (principal+rate+years [+contribution]), simple_interest, discount, tip, sales_tax, roi (gain+cost), percentage (sub_mode: of / is_what_percent / change / increase), markup (cost + percent).
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | – |
No output schema declared.
No examples provided.
hash ~67
Compute one or more cryptographic hashes of a text input. Defaults to MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, SHA3-256, SHA3-512.
| Name | Type | Req | Description |
|---|---|---|---|
| algorithms | array | – | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
hashtag_tools ~134
Hashtag operations on text. mode=extract (pull #hashtags out of text with offsets), remove (strip them out + tidy whitespace), generate (suggest #hashtags from text content via stop-word-filtered word frequency), format (normalize an array of hashtag strings to camel/snake/lower/preserve style). Unicode-aware (#日本語 works).
| Name | Type | Req | Description |
|---|---|---|---|
| hashtags | array | – | For format. |
| max | integer | – | For generate. |
| min_length | integer | – | For generate. |
| mode | string | yes | – |
| style | string | – | For format. |
| text | string | – | For extract / remove / generate. |
No output schema declared.
No examples provided.
json_format ~57
Validate, pretty-print, minify or analyse a JSON document. Returns a structural summary (node counts, max depth, top distinct keys).
| Name | Type | Req | Description |
|---|---|---|---|
| indent | integer | – | – |
| json | string | yes | – |
| mode | string | – | – |
No output schema declared.
No examples provided.
json_to_csv ~94
Convert a JSON array of objects to CSV. Configurable delimiter, columns, optional flattening of nested objects with dot-keys (e.g. `meta.city`). Max 50,000 rows per request.
| Name | Type | Req | Description |
|---|---|---|---|
| columns | array | – | – |
| delimiter | string | – | – |
| flatten | boolean | – | – |
| include_headers | boolean | – | – |
| json | string | yes | – |
| newline | string | – | – |
No output schema declared.
No examples provided.
jwt_decode ~182
Decode a JSON Web Token (JWT) and analyse its claims. Always returns header, payload, signature info, and expiry status (active/expired/not_yet_valid) computed from exp/nbf/iat. When `secret` is provided, verifies HS256/HS384/HS512 via HMAC. When `public_key` is provided in PEM format, verifies RS256/RS384/RS512 via openssl_verify. ES* and EdDSA are decoded but not verified. The token is never logged.
| Name | Type | Req | Description |
|---|---|---|---|
| public_key | string | – | PEM-format RSA public key for RS256/384/512 verification. Optional. |
| secret | string | – | Shared secret for HS256/384/512 verification. Optional. |
| token | string | yes | Full JWT (three base64url segments joined with dots). "Bearer " prefix is stripped automatically. |
No output schema declared.
No examples provided.
lorem_ipsum ~56
Generate placeholder text — N paragraphs, sentences or words of lorem ipsum. Suitable for mocks, fixtures and test data.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| kind | string | – | – |
| start_with_lorem | boolean | – | – |
No output schema declared.
No examples provided.
meta_tags_generate ~165
Generate a complete HTML head block — standard <meta>, OpenGraph, Twitter Card and Schema.org JSON-LD — from a small set of inputs (title, description, url, image, author, keywords, type). Returns ready-to-paste HTML plus an SEO score 0-100 with concrete warnings (title length, description length, missing OG image, etc.).
| Name | Type | Req | Description |
|---|---|---|---|
| author | string | – | – |
| description | string | yes | – |
| image | string | – | – |
| keywords | array | – | – |
| locale | string | – | – |
| site_name | string | – | – |
| title | string | yes | – |
| twitter_card | string | – | – |
| twitter_site | string | – | @handle |
| type | string | – | – |
| url | string | – | – |
No output schema declared.
No examples provided.
number_base ~103
Convert integers between any base 2..36 plus Roman numerals. Big-int safe when GMP is available. Use from_base="roman" to parse a Roman numeral input, or include "roman" in to_bases to convert to Roman.
| Name | Type | Req | Description |
|---|---|---|---|
| from_base | – | – | Integer 2..36 or "roman". |
| to_bases | array | – | Bases to convert to. Each is an integer 2..36 or "roman". |
| value | string | yes | – |
No output schema declared.
No examples provided.
password ~83
Generate cryptographically random passwords using a CSPRNG. Configurable length, count, character classes and ambiguous-character exclusion.
| Name | Type | Req | Description |
|---|---|---|---|
| count | integer | – | – |
| digits | boolean | – | – |
| exclude_ambiguous | boolean | – | – |
| length | integer | – | – |
| lowercase | boolean | – | – |
| symbols | boolean | – | – |
| uppercase | boolean | – | – |
No output schema declared.
No examples provided.
password_strength ~53
Score a password (0-4 zxcvbn-style), compute entropy bits, identify common-password fingerprints and keyboard sequences, and estimate offline-GPU crack time. Password is never logged.
| Name | Type | Req | Description |
|---|---|---|---|
| password | string | yes | – |
No output schema declared.
No examples provided.
random_gen ~109
Cryptographically random generator backed by random_int / random_bytes. mode=number (min/max), string (length + charset: alpha/alphanumeric/numeric/lower/upper/hex/hex_upper/base58/base64url), word (English word list), picker (pick N from a list, with/without replacement), team (balanced round-robin team allocation), dice (NdM notation), coin, country (ISO list), uuid (v4 or v7).
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | yes | – |
No output schema declared.
No examples provided.
regex_test ~96
Match, replace or split text with a PCRE regular expression. Returns offsets and capture groups. ReDoS-protected: catastrophic patterns return an error rather than hanging.
| Name | Type | Req | Description |
|---|---|---|---|
| flags | string | – | any of i, m, s, u, x |
| operation | string | – | – |
| pattern | string | yes | – |
| replacement | string | – | – |
| split_limit | integer | – | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
sitemap_extract ~126
Fetch and parse an XML sitemap or sitemap index from a public HTTPS URL (or paste raw XML). SSRF-protected: refuses private/loopback/link-local/cloud-metadata addresses, re-validates redirects. Optional recursive expansion of sub-sitemaps. Returns lastmod, changefreq, priority when present.
| Name | Type | Req | Description |
|---|---|---|---|
| include_metadata | boolean | – | – |
| max_sub_sitemaps | integer | – | – |
| max_urls | integer | – | – |
| recursive | boolean | – | – |
| url | string | – | – |
| xml | string | – | Paste raw XML instead of fetching by URL. |
No output schema declared.
No examples provided.
slugify ~86
Convert any text to a URL-safe slug. Unicode-aware: by default transliterates non-Latin characters to ASCII (set `transliterate=false` to keep them). Configurable separator and length.
| Name | Type | Req | Description |
|---|---|---|---|
| lowercase | boolean | – | – |
| max_length | integer | – | – |
| separator | string | – | – |
| text | string | yes | – |
| transliterate | boolean | – | – |
No output schema declared.
No examples provided.
sort_lines ~107
Sort lines of text. Supports asc/desc, case-insensitive, locale-aware collation, natural-sort (line2 before line10), dedupe, line-trim and empty-line drop.
| Name | Type | Req | Description |
|---|---|---|---|
| case_sensitive | boolean | – | – |
| dedupe | boolean | – | – |
| drop_empty | boolean | – | – |
| locale | string | – | – |
| natural | boolean | – | – |
| order | string | – | – |
| text | string | yes | – |
| trim_lines | boolean | – | – |
No output schema declared.
No examples provided.
ssl_check ~126
Connect to {domain}:{port} over TLS and return the leaf certificate + full chain: subject, issuer, validity dates, days remaining, fingerprint (SHA-256), subject alternative names, signature algorithm, negotiated protocol and cipher. Useful for verifying a domain has HTTPS, the cert is not expired, and the chain is properly configured. SSRF-protected: refuses private/loopback/link-local/cloud-metadata IPs. 5s connect timeout.
| Name | Type | Req | Description |
|---|---|---|---|
| domain | string | yes | Hostname only (no scheme/path). e.g. example.com |
| port | integer | – | – |
No output schema declared.
No examples provided.
stats ~66
Descriptive statistics for a list of numbers: count, sum, mean, median, mode, min/max/range, variance, stddev (population AND sample), MAD, quartiles, IQR, percentiles (1-99), geometric mean, harmonic mean.
| Name | Type | Req | Description |
|---|---|---|---|
| numbers | – | yes | – |
No output schema declared.
No examples provided.
text_cleanup ~105
Apply chained text cleanup operations in sequence. Operations: trim, collapse_spaces, normalize_whitespace, remove_line_breaks, normalize_line_breaks, dedupe_lines, reverse_lines, strip_html, strip_emoji, strip_urls, strip_emails, normalize_quotes (curly → straight), normalize_dashes (em/en → hyphen), lowercase, uppercase. Returns cleaned text plus per-operation chars/lines removed.
| Name | Type | Req | Description |
|---|---|---|---|
| operations | array | yes | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
text_diff ~84
Diff two strings by line, word or character. Returns structured changes (+/-/=), git-style unified diff, and a Jaccard similarity score. Use line mode for code/config; word mode for prose; char mode for short strings.
| Name | Type | Req | Description |
|---|---|---|---|
| a | string | yes | – |
| b | string | yes | – |
| context | integer | – | – |
| mode | string | – | – |
No output schema declared.
No examples provided.
timestamp ~103
Convert any moment in time between formats. Bidirectional Unix epoch ↔ ISO 8601 ↔ RFC 3339 ↔ human-readable. Auto-detects epoch resolution. Accepts strtotime-style natural language ("next monday", "+2 weeks"). Optional timezone for local components.
| Name | Type | Req | Description |
|---|---|---|---|
| input | string | – | Date/time string or Unix epoch as a string. Omit for current time. |
| timezone | string | – | IANA timezone name e.g. 'Europe/Madrid' |
No output schema declared.
No examples provided.
url_decode ~50
Decode a percent-encoded URL string. mode=component (rawurldecode, default) or form (interprets + as space).
| Name | Type | Req | Description |
|---|---|---|---|
| encoded | string | yes | – |
| mode | string | – | – |
No output schema declared.
No examples provided.
url_encode ~60
Percent-encode a string for URL use. mode=component (RFC 3986 strict, default), form (application/x-www-form-urlencoded), or path (keeps slashes intact).
| Name | Type | Req | Description |
|---|---|---|---|
| mode | string | – | – |
| text | string | yes | – |
No output schema declared.
No examples provided.
url_metadata ~141
Fetch a public HTTPS URL and extract structured page metadata: title, description, keywords, canonical, language, charset, full OpenGraph dictionary, Twitter Card, favicon (absolute URL), hreflang map, JSON-LD blocks, response headers and counts (h1/h2/images/links/scripts). SSRF-protected: refuses private/loopback/link-local/cloud-metadata addresses and re-validates every redirect. 2 MB body cap.
| Name | Type | Req | Description |
|---|---|---|---|
| follow_redirects | boolean | – | – |
| timeout | integer | – | – |
| url | string | yes | http:// or https:// URL to fetch. |
| user_agent | string | – | Override the User-Agent header. |
No output schema declared.
No examples provided.
xml_validate ~60
Validate XML well-formedness; with optional XSD schema. Reports errors with line/column. Network and DTD fetches are disabled (no XXE risk).
| Name | Type | Req | Description |
|---|---|---|---|
| schema | string | – | Optional XSD source. |
| xml | string | yes | – |
No output schema declared.
No examples provided.
What is the io.github.matetools/mcp-server server?
io.github.matetools/mcp-server is listed in the public MCP registry as io.github.matetools/mcp-server. 35 utility tools for AI agents, mate.tools API. Hash, regex, SEO, random, DNS, SSL, JWT. This page covers its npm package (@mate-tools/mcp-server).
Is the io.github.matetools/mcp-server server safe to use?
io.github.matetools/mcp-server scores 77 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 25 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.matetools/mcp-server server expose?
io.github.matetools/mcp-server exposes 35 tools: count_lines, base64_encode, base64_decode, url_encode, url_decode, and 30 more. Their descriptions and schemas cost roughly 3,255 tokens of context every time the server is loaded.
Is the io.github.matetools/mcp-server server still maintained?
io.github.matetools/mcp-server is still listed as active in the MCP registry. We last reached this channel on 25 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.matetools/mcp-server server under?
io.github.matetools/mcp-server declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.