# io.github.matetools/mcp-server (npm · @mate-tools/mcp-server)

35 utility tools for AI agents — mate.tools API. Hash, regex, SEO, random, DNS, SSL, JWT.

- Trust score: 66/100 (medium)
- Change this week: −11
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@mate-tools/mcp-server`: 66/100 (this document), [markdown](https://verifymcp.io/servers/matetools-mcp-server/mate-tools-mcp-server.md), [page](https://verifymcp.io/servers/matetools-mcp-server/mate-tools-mcp-server)

## Channel facts

- Registry: `npm`
- Package: `@mate-tools/mcp-server`
- Version: `1.5.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - No production dependencies, so there is no dependency health to assess.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 77 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 75/100
  - AI-judged instruction clarity (good).
  - Tool/resource definitions use about 3255 tokens (~93/item across 35 items; 35 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 75/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 25% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add matetools-mcp-server -- npx -y @mate-tools/mcp-server
```

### Codex

```bash
codex mcp add matetools-mcp-server -- npx -y @mate-tools/mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "matetools-mcp-server": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@mate-tools/mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add matetools-mcp-server --command npx --arg -y --arg @mate-tools/mcp-server
```

### Hermes

```yaml
mcp_servers:
  matetools-mcp-server:
    command: "npx"
    args: ["-y", "@mate-tools/mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "matetools-mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@mate-tools/mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +18)

- [security improvement] Malware scan: unverified → pass
- [functional improvement] Stability: unverified → 0.20

### 2026-07-31 (score 48, −11)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 59, −18)

- [security regression] Malware scan: pass → unverified

### 2026-07-27 (score 77, +30)

- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 25
- [functional] First check of Schema quality: pass
- [functional] First check of Schema quality: good

### 2026-07-26 (score 47)

First indexed and scored.

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

## MCP tools (35)

### `count_lines` (~72 tokens)

Count lines, words, sentences, paragraphs and characters in a chunk of text. Returns sixteen text metrics including duplicate-line detection, longest word, reading and speaking time estimates, and the dominant line-ending style (LF, CRLF or CR).

Input parameters:

- `text` (string, required): UTF-8 text. Max 1 MB.

### `base64_encode` (~62 tokens)

Base64-encode a string. Optional URL-safe variant (RFC 4648 §5: `-`/`_` instead of `+`/`/`, no padding).

Input parameters:

- `text` (string, required)
- `url_safe` (boolean)

### `base64_decode` (~50 tokens)

Base64-decode a string. Accepts both standard and URL-safe Base64; missing padding is auto-fixed. Returns text when valid UTF-8, otherwise hex.

Input parameters:

- `encoded` (string, required)

### `url_encode` (~60 tokens)

Percent-encode a string for URL use. mode=component (RFC 3986 strict, default), form (application/x-www-form-urlencoded), or path (keeps slashes intact).

Input parameters:

- `mode` (string)
- `text` (string, required)

### `url_decode` (~50 tokens)

Decode a percent-encoded URL string. mode=component (rawurldecode, default) or form (interprets + as space).

Input parameters:

- `encoded` (string, required)
- `mode` (string)

### `hash` (~67 tokens)

Compute one or more cryptographic hashes of a text input. Defaults to MD5, SHA-1, SHA-256, SHA-384, SHA-512, CRC32, SHA3-256, SHA3-512.

Input parameters:

- `algorithms` (array)
- `text` (string, required)

### `password` (~83 tokens)

Generate cryptographically random passwords using a CSPRNG. Configurable length, count, character classes and ambiguous-character exclusion.

Input parameters:

- `count` (integer)
- `digits` (boolean)
- `exclude_ambiguous` (boolean)
- `length` (integer)
- `lowercase` (boolean)
- `symbols` (boolean)
- `uppercase` (boolean)

### `password_strength` (~53 tokens)

Score a password (0-4 zxcvbn-style), compute entropy bits, identify common-password fingerprints and keyboard sequences, and estimate offline-GPU crack time. Password is never logged.

Input parameters:

- `password` (string, required)

### `json_format` (~57 tokens)

Validate, pretty-print, minify or analyse a JSON document. Returns a structural summary (node counts, max depth, top distinct keys).

Input parameters:

- `indent` (integer)
- `json` (string, required)
- `mode` (string)

### `json_to_csv` (~94 tokens)

Convert a JSON array of objects to CSV. Configurable delimiter, columns, optional flattening of nested objects with dot-keys (e.g. `meta.city`). Max 50,000 rows per request.

Input parameters:

- `columns` (array)
- `delimiter` (string)
- `flatten` (boolean)
- `include_headers` (boolean)
- `json` (string, required)
- `newline` (string)

### `case_convert` (~61 tokens)

Convert text into multiple case styles in one call: upper, lower, title, sentence, snake, kebab, camel, pascal, constant. Pass `cases` to limit the response.

Input parameters:

- `cases` (array)
- `text` (string, required)

### `slugify` (~86 tokens)

Convert any text to a URL-safe slug. Unicode-aware: by default transliterates non-Latin characters to ASCII (set `transliterate=false` to keep them). Configurable separator and length.

Input parameters:

- `lowercase` (boolean)
- `max_length` (integer)
- `separator` (string)
- `text` (string, required)
- `transliterate` (boolean)

### `sort_lines` (~107 tokens)

Sort lines of text. Supports asc/desc, case-insensitive, locale-aware collation, natural-sort (line2 before line10), dedupe, line-trim and empty-line drop.

Input parameters:

- `case_sensitive` (boolean)
- `dedupe` (boolean)
- `drop_empty` (boolean)
- `locale` (string)
- `natural` (boolean)
- `order` (string)
- `text` (string, required)
- `trim_lines` (boolean)

### `lorem_ipsum` (~56 tokens)

Generate placeholder text — N paragraphs, sentences or words of lorem ipsum. Suitable for mocks, fixtures and test data.

Input parameters:

- `count` (integer)
- `kind` (string)
- `start_with_lorem` (boolean)

### `timestamp` (~103 tokens)

Convert any moment in time between formats. Bidirectional Unix epoch ↔ ISO 8601 ↔ RFC 3339 ↔ human-readable. Auto-detects epoch resolution. Accepts strtotime-style natural language ("next monday", "+2 weeks"). Optional timezone for local components.

Input parameters:

- `input` (string): Date/time string or Unix epoch as a string. Omit for current time.
- `timezone` (string): IANA timezone name e.g. 'Europe/Madrid'

### `date_math` (~124 tokens)

Date arithmetic. Two modes: provide `start` + `add` (e.g. "+90 days", "-2 weeks") to compute the resulting date, OR provide `start` + `end` to compute the diff. Diff mode optionally counts business days only.

Input parameters:

- `add` (string): Relative duration like "+90 days", "-2 weeks", "next friday".
- `business_days` (boolean)
- `end` (string): Optional end date — when present, returns a diff instead.
- `start` (string, required): ISO 8601 / human-readable date.

### `regex_test` (~96 tokens)

Match, replace or split text with a PCRE regular expression. Returns offsets and capture groups. ReDoS-protected: catastrophic patterns return an error rather than hanging.

Input parameters:

- `flags` (string): any of i, m, s, u, x
- `operation` (string)
- `pattern` (string, required)
- `replacement` (string)
- `split_limit` (integer)
- `text` (string, required)

### `sitemap_extract` (~126 tokens)

Fetch and parse an XML sitemap or sitemap index from a public HTTPS URL (or paste raw XML). SSRF-protected: refuses private/loopback/link-local/cloud-metadata addresses, re-validates redirects. Optional recursive expansion of sub-sitemaps. Returns lastmod, changefreq, priority when present.

Input parameters:

- `include_metadata` (boolean)
- `max_sub_sitemaps` (integer)
- `max_urls` (integer)
- `recursive` (boolean)
- `url` (string)
- `xml` (string): Paste raw XML instead of fetching by URL.

### `credit_card_validate` (~92 tokens)

Validate a card number using the Luhn algorithm and detect the brand (Visa, MasterCard, Amex, Discover, JCB, Diners, UnionPay, Maestro, RuPay). The card number is never logged — only its length, IIN prefix, last 4, masked form, and Luhn outcome leave the server.

Input parameters:

- `number` (string, required): Card number (spaces and dashes OK).

### `xml_validate` (~60 tokens)

Validate XML well-formedness; with optional XSD schema. Reports errors with line/column. Network and DTD fetches are disabled (no XXE risk).

Input parameters:

- `schema` (string): Optional XSD source.
- `xml` (string, required)

### `text_diff` (~84 tokens)

Diff two strings by line, word or character. Returns structured changes (+/-/=), git-style unified diff, and a Jaccard similarity score. Use line mode for code/config; word mode for prose; char mode for short strings.

Input parameters:

- `a` (string, required)
- `b` (string, required)
- `context` (integer)
- `mode` (string)

### `stats` (~66 tokens)

Descriptive statistics for a list of numbers: count, sum, mean, median, mode, min/max/range, variance, stddev (population AND sample), MAD, quartiles, IQR, percentiles (1-99), geometric mean, harmonic mean.

Input parameters:

- `numbers` (required)

### `number_base` (~103 tokens)

Convert integers between any base 2..36 plus Roman numerals. Big-int safe when GMP is available. Use from_base="roman" to parse a Roman numeral input, or include "roman" in to_bases to convert to Roman.

Input parameters:

- `from_base`: Integer 2..36 or "roman".
- `to_bases` (array): Bases to convert to. Each is an integer 2..36 or "roman".
- `value` (string, required)

### `finance_calc` (~85 tokens)

Multi-mode financial calculations. `mode` selects: loan (principal+rate+term [+extra]), compound_interest (principal+rate+years [+contribution]), simple_interest, discount, tip, sales_tax, roi (gain+cost), percentage (sub_mode: of / is_what_percent / change / increase), markup (cost + percent).

Input parameters:

- `mode` (string, required)

### `color_convert` (~98 tokens)

Convert any color (hex, rgb, rgba, hsl, hsla, named) into all standard color spaces. Returns hex, rgb, rgba, hsl, hsv, cmyk, closest CSS named color, WCAG luminance and contrast ratios vs. white and black (with AA/AAA flags).

Input parameters:

- `color` (string, required): #ff5733, rgb(255,87,51), hsl(...), tomato, ...

### `age_calc` (~94 tokens)

Compute age in years/months/days from a date of birth. Returns next birthday, days until, Western zodiac sign, generation (Gen Z / Millennial / Gen X / Boomer / Silent / Greatest / Gen Alpha), birth weekday, and leap-year info.

Input parameters:

- `date_of_birth` (string, required)
- `reference` (string): Date to compute age against. Default: now.
- `timezone` (string)

### `aspect_ratio` (~87 tokens)

Compute the reduced aspect ratio (16:9, 4:3, 21:9, ...) from a width and height; OR scale a given width OR height to a target ratio.

Input parameters:

- `height` (number)
- `ratio` (string): e.g. "16:9", "4:3", "1.85:1".
- `width` (number)

### `url_metadata` (~141 tokens)

Fetch a public HTTPS URL and extract structured page metadata: title, description, keywords, canonical, language, charset, full OpenGraph dictionary, Twitter Card, favicon (absolute URL), hreflang map, JSON-LD blocks, response headers and counts (h1/h2/images/links/scripts). SSRF-protected: refuses private/loopback/link-local/cloud-metadata addresses and re-validates every redirect. 2 MB body cap.

Input parameters:

- `follow_redirects` (boolean)
- `timeout` (integer)
- `url` (string, required): http:// or https:// URL to fetch.
- `user_agent` (string): Override the User-Agent header.

### `meta_tags_generate` (~165 tokens)

Generate a complete HTML head block — standard <meta>, OpenGraph, Twitter Card and Schema.org JSON-LD — from a small set of inputs (title, description, url, image, author, keywords, type). Returns ready-to-paste HTML plus an SEO score 0-100 with concrete warnings (title length, description length, missing OG image, etc.).

Input parameters:

- `author` (string)
- `description` (string, required)
- `image` (string)
- `keywords` (array)
- `locale` (string)
- `site_name` (string)
- `title` (string, required)
- `twitter_card` (string)
- `twitter_site` (string): @handle
- `type` (string)
- `url` (string)

### `text_cleanup` (~105 tokens)

Apply chained text cleanup operations in sequence. Operations: trim, collapse_spaces, normalize_whitespace, remove_line_breaks, normalize_line_breaks, dedupe_lines, reverse_lines, strip_html, strip_emoji, strip_urls, strip_emails, normalize_quotes (curly → straight), normalize_dashes (em/en → hyphen), lowercase, uppercase. Returns cleaned text plus per-operation chars/lines removed.

Input parameters:

- `operations` (array, required)
- `text` (string, required)

### `random_gen` (~109 tokens)

Cryptographically random generator backed by random_int / random_bytes. mode=number (min/max), string (length + charset: alpha/alphanumeric/numeric/lower/upper/hex/hex_upper/base58/base64url), word (English word list), picker (pick N from a list, with/without replacement), team (balanced round-robin team allocation), dice (NdM notation), coin, country (ISO list), uuid (v4 or v7).

Input parameters:

- `mode` (string, required)

### `hashtag_tools` (~134 tokens)

Hashtag operations on text. mode=extract (pull #hashtags out of text with offsets), remove (strip them out + tidy whitespace), generate (suggest #hashtags from text content via stop-word-filtered word frequency), format (normalize an array of hashtag strings to camel/snake/lower/preserve style). Unicode-aware (#日本語 works).

Input parameters:

- `hashtags` (array): For format.
- `max` (integer): For generate.
- `min_length` (integer): For generate.
- `mode` (string, required)
- `style` (string): For format.
- `text` (string): For extract / remove / generate.

### `dns_lookup` (~117 tokens)

Resolve DNS records for a domain via the system resolver. Default lookup covers A, AAAA, MX, TXT, NS, CNAME, SOA, CAA. Also resolves reverse PTR records for A results. Use this to debug mail config (MX), domain ownership signals (TXT), name-server delegation (NS), CAA policy, and IP resolution. No SSRF risk — DNS only, no outbound connections.

Input parameters:

- `domain` (string, required): Hostname (not URL). e.g. example.com
- `types` (array)

### `ssl_check` (~126 tokens)

Connect to {domain}:{port} over TLS and return the leaf certificate + full chain: subject, issuer, validity dates, days remaining, fingerprint (SHA-256), subject alternative names, signature algorithm, negotiated protocol and cipher. Useful for verifying a domain has HTTPS, the cert is not expired, and the chain is properly configured. SSRF-protected: refuses private/loopback/link-local/cloud-metadata IPs. 5s connect timeout.

Input parameters:

- `domain` (string, required): Hostname only (no scheme/path). e.g. example.com
- `port` (integer)

### `jwt_decode` (~182 tokens)

Decode a JSON Web Token (JWT) and analyse its claims. Always returns header, payload, signature info, and expiry status (active/expired/not_yet_valid) computed from exp/nbf/iat. When `secret` is provided, verifies HS256/HS384/HS512 via HMAC. When `public_key` is provided in PEM format, verifies RS256/RS384/RS512 via openssl_verify. ES* and EdDSA are decoded but not verified. The token is never logged.

Input parameters:

- `public_key` (string): PEM-format RSA public key for RS256/384/512 verification. Optional.
- `secret` (string): Shared secret for HS256/384/512 verification. Optional.
- `token` (string, required): Full JWT (three base64url segments joined with dots). "Bearer " prefix is stripped automatically.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/matetools-mcp-server/mate-tools-mcp-server#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 48
- 2026-07-31: 48
- 2026-07-30: 59
- 2026-07-29: 77
- 2026-07-28: 77
- 2026-07-27: 77
- 2026-07-26: 47

## Links

- npm package: https://www.npmjs.com/package/@mate-tools/mcp-server
- Socket report: https://socket.dev/npm/package/@mate-tools/mcp-server
- Repository: https://github.com/matetools/mcp-server
- Website: https://mate.tools/api/mcp
- Changelog RSS feed: https://verifymcp.io/servers/matetools-mcp-server/mate-tools-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/matetools-mcp-server/mate-tools-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/matetools-mcp-server/mate-tools-mcp-server