Toolkit MCP Server

Name: Toolkit MCP Server
Author: cyanheads

by cyanheadsversion 2.4.0i★ –iComputer or cloud

Registry nameio.github.cyanheads/toolkit-mcp-server

Install

Overview

Description from the maker (original English)

Generate IDs, QR codes, and hashes, encode values, geolocate IPs, plus gated host diagnostics.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi3 of 3 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Computer or cloud
Transport: stdio, Streamable HTTP
Category: Other
You need to fill in: TOOLKIT_GEO_API_KEY

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 3 of 3 passed
Runs on the maker’s server: what you ask it goes through their server.
Can do 5 things (tools) toolkit_hash_value, toolkit_generate_id, toolkit_generate_qr, toolkit_encode_value …
You fill in yourself: MCP_LOG_LEVEL, TOOLKIT_ENABLE_NET_DIAGNOSTICS, TOOLKIT_ENABLE_SYSTEM_INFO, TOOLKIT_ALLOW_PRIVATE_NETWORK, TOOLKIT_GEO_API_KEY, TOOLKIT_GEO_BASE_URL, TOOLKIT_GEO_CACHE_TTL_SECONDS, TOOLKIT_GEO_RATE_LIMIT_PER_MIN, TOOLKIT_GEO_BATCH_RATE_LIMIT_PER_MIN

Values marked secret are keys to your account. Never share them or paste them into a chat.

You need

Runs in the cloudNothing to install; it connects over the internet
npmNode.js installed (for the npx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://toolkit.caseyjhand.com/mcp

Or run it on your computer

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "toolkit": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/toolkit-mcp-server"
      ],
      "env": {
        "MCP_LOG_LEVEL": "your-value",
        "TOOLKIT_ENABLE_NET_DIAGNOSTICS": "your-value",
        "TOOLKIT_ENABLE_SYSTEM_INFO": "your-value",
        "TOOLKIT_ALLOW_PRIVATE_NETWORK": "your-value",
        "TOOLKIT_GEO_API_KEY": "your-value",
        "TOOLKIT_GEO_BASE_URL": "your-value",
        "TOOLKIT_GEO_CACHE_TTL_SECONDS": "your-value",
        "TOOLKIT_GEO_RATE_LIMIT_PER_MIN": "your-value",
        "TOOLKIT_GEO_BATCH_RATE_LIMIT_PER_MIN": "your-value"
      }
    }
  }
}

Run this in your terminal

claude mcp add --transport http toolkit https://toolkit.caseyjhand.com/mcp

Or run it on your computer

claude mcp add toolkit --env MCP_LOG_LEVEL=your-value --env TOOLKIT_ENABLE_NET_DIAGNOSTICS=your-value --env TOOLKIT_ENABLE_SYSTEM_INFO=your-value --env TOOLKIT_ALLOW_PRIVATE_NETWORK=your-value --env TOOLKIT_GEO_API_KEY=your-value --env TOOLKIT_GEO_BASE_URL=your-value --env TOOLKIT_GEO_CACHE_TTL_SECONDS=your-value --env TOOLKIT_GEO_RATE_LIMIT_PER_MIN=your-value --env TOOLKIT_GEO_BATCH_RATE_LIMIT_PER_MIN=your-value -- npx -y @cyanheads/toolkit-mcp-server

Fill in the empty values before running it.

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "toolkit": {
      "url": "https://toolkit.caseyjhand.com/mcp"
    }
  }
}

Or run it on your computer

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "toolkit": {
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/toolkit-mcp-server"
      ],
      "env": {
        "MCP_LOG_LEVEL": "your-value",
        "TOOLKIT_ENABLE_NET_DIAGNOSTICS": "your-value",
        "TOOLKIT_ENABLE_SYSTEM_INFO": "your-value",
        "TOOLKIT_ALLOW_PRIVATE_NETWORK": "your-value",
        "TOOLKIT_GEO_API_KEY": "your-value",
        "TOOLKIT_GEO_BASE_URL": "your-value",
        "TOOLKIT_GEO_CACHE_TTL_SECONDS": "your-value",
        "TOOLKIT_GEO_RATE_LIMIT_PER_MIN": "your-value",
        "TOOLKIT_GEO_BATCH_RATE_LIMIT_PER_MIN": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "toolkit": {
      "type": "http",
      "url": "https://toolkit.caseyjhand.com/mcp"
    }
  }
}

Or run it on your computer

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "toolkit": {
      "type": "stdio",
      "command": "npx",
      "args": [
        "-y",
        "@cyanheads/toolkit-mcp-server"
      ],
      "env": {
        "MCP_LOG_LEVEL": "your-value",
        "TOOLKIT_ENABLE_NET_DIAGNOSTICS": "your-value",
        "TOOLKIT_ENABLE_SYSTEM_INFO": "your-value",
        "TOOLKIT_ALLOW_PRIVATE_NETWORK": "your-value",
        "TOOLKIT_GEO_API_KEY": "your-value",
        "TOOLKIT_GEO_BASE_URL": "your-value",
        "TOOLKIT_GEO_CACHE_TTL_SECONDS": "your-value",
        "TOOLKIT_GEO_RATE_LIMIT_PER_MIN": "your-value",
        "TOOLKIT_GEO_BATCH_RATE_LIMIT_PER_MIN": "your-value"
      }
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://toolkit.caseyjhand.com/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

Values you fill in

MCP_LOG_LEVEL env
Sets the minimum log level for output (e.g., 'debug', 'info', 'warn').
TOOLKIT_ENABLE_NET_DIAGNOSTICS env
Register the gated toolkit_check_network tool. Off by default — leave off for hosted/shared deployments.
TOOLKIT_ENABLE_SYSTEM_INFO env
Register the gated toolkit_check_system tool. Off by default — only meaningful on a local deployment.
TOOLKIT_ALLOW_PRIVATE_NETWORK env
With network diagnostics enabled, permit private/reserved/loopback targets. The second explicit gate; off by default.
TOOLKIT_GEO_API_KEY secret env
API key for the geolocation endpoint, if it requires one. The default ip-api tier is keyless.
TOOLKIT_GEO_BASE_URL env
Base URL for an ip-api-compatible geolocation endpoint. Default is the keyless ip-api endpoint, which is plaintext HTTP.
TOOLKIT_GEO_CACHE_TTL_SECONDS env
Geolocation cache TTL in seconds. Geolocation is stable, so repeats are cached.
TOOLKIT_GEO_RATE_LIMIT_PER_MIN env
Max geolocation requests per minute; excess requests are rejected with a retryable rate-limit error. Default 45 matches the ip-api free tier.
TOOLKIT_GEO_BATCH_RATE_LIMIT_PER_MIN env
Independent batch geolocation requests per minute; excess requests fail immediately with wait and recovery guidance.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Tool names and descriptions exactly as the server reported them on Nov 6, 2026. The maker wrote them, not us; we show them as plain text.

toolkit_hash_value
Generate a cryptographic digest or HMAC of a value, or verify a value against an expected digest. Set operation to "generate" for a digest, or "compare" to constant-time-check value against the expected digest — compare is timing-safe and avoids manual string equality checks. Omi
toolkit_generate_id
Mint cryptographically-random identifiers using the platform CSPRNG — the correct source for IDs that must be unpredictable, unlike model-generated values. type selects the format: uuid_v4 (random, the default), uuid_v7 (time-ordered, sortable by creation), or ulid (26-char Crock
toolkit_generate_qr
Encode text or a URL into a QR code. data is the content to encode (a link, a generated identifier such as toolkit_generate_id's ids[0], or any string). format selects the output: svg returns inline SVG markup sized in pixels, png_base64 returns base64-encoded PNG bytes (with mim
toolkit_encode_value
Encode or decode a value across base64, base64url, hex, or URL (percent) encoding, in either direction. Set operation to "encode" to transform raw UTF-8 text into the chosen encoding, or "decode" to recover the original bytes from an encoded value. Decoded bytes come back as UTF-
toolkit_geolocate_ip
Resolve a public IP or dotted hostname to country, region, city, coordinates, ASN, AS holder and name, organization, ISP, timezone, and proxy/hosting/mobile flags. Supply target for one lookup or targets for an ordered batch, never both; blank target and empty targets are unset.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account cyanheads, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
✓ Pass
Endpoint responds
Responded in 168 ms (HTTP 200)
– Not applicable
Sign-in with OAuth
No sign-in needed
✓ Pass
No hidden instructions in tool descriptions
Read 5 tool descriptions and found no hidden instructions to the AI

Compared with others in Otheri

More stars than 0% of the other 32742 servers in this category
Published to the registry more recently than 91% of the other 32742 servers in this category
Basic checks equal to or better than 100% of the other 32742 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Toolkit MCP Server safe?

It passed 3 of 3 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

You need to fill in: TOOLKIT_GEO_API_KEY

Does it run on my computer or in the cloud?

Either way works: install it on your computer or connect to the cloud version.

Is it still maintained?

The GitHub repo last changed –, and the latest version (2.4.0) reached the registry 3 days ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Spec Driven Development, Remote Desktop Commander, Asset Notation

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Spec Driven Development

by formulahendry

MCP Server that facilitates spec-driven development workflows, not just Vibe Coding.

Runs on your computer★ 440MITUpdated 14 months ago

Install

Remote Desktop Commander

by desktop-commander

Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.

Runs in the cloud★ 211Updated 2 days ago

Install

Asset Notation

by assetnotation

Read and maintain an Asset Notation file on disk: net worth, holdings, valuations, CSV import.

Runs on your computerUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

@cyanheads/toolkit-mcp-server Generate random IDs, QR codes, and hashes, encode and decode values, and geolocate IPs, plus gated network and system diagnostics, via MCP. STDIO or Streamable HTTP. 7 Tools • 1 Skill

Public Hosted Server: https://toolkit.caseyjhand.com/mcp

Overview

Everyday developer utilities: generate IDs, QR codes, and hashes, encode and decode values, and geolocate a public IP or hostname. Only the geolocation lookup and the gated network diagnostics (off by default) make network calls; everything else runs locally.

Tools

Tool	Description
`toolkit_hash_value`	Generate a digest or HMAC (sha256/sha384/sha512/sha1/md5) as hex, base64, base64url, or SRI, or constant-time-compare a value against an expected digest or signature
`toolkit_generate_id`	Mint cryptographically random UUIDv4, UUIDv7, or ULID identifiers, up to 1000 per call
`toolkit_generate_qr`	Encode text or a URL as a QR code in SVG, base64 PNG, or terminal half-blocks
`toolkit_encode_value`	Encode or decode base64, base64url, hex, or URL percent-encoding
`toolkit_geolocate_ip`	Resolve a public IP or hostname to country, city, coordinates, ASN, and timezone
`toolkit_check_network`	Gated, off by default. Ping, traceroute, TCP connectivity, or IPv4 egress-IP check from the server host
`toolkit_check_system`	Gated, off by default. OS, CPU, memory, load average, or network interfaces of the server host

Skill

Skill	Description
`toolkit-guide`	Gates the tool descriptions don't carry: reading a digest or signature mismatch, webhook and JWT signing inputs, moving digest bytes between hex, base64, and base64url, who runs an IP's network, and host diagnostics

MCP clients that support the Skills extension read it as skill://toolkit-guide/SKILL.md. Plugin installs load it from skills/, which also ships in the npm package, the Docker image, and the .mcpb bundle.

Capability reference

`toolkit_hash_value` tool

value read per inputEncoding (utf8 default, hex, base64); algorithm is sha256 (default), sha384, or sha512, with sha1 and md5 for checksum compatibility and verifying existing HMAC-SHA1 signatures only; operation is generate or compare, and when omitted it compares if expected is sent
A non-empty secret makes the digest an HMAC keyed by it, for webhook signatures (GitHub's X-Hub-Signature-256 pastes into expected as-is) and HS256 JWT signatures; secretEncoding is utf8 (default), hex, base64, or base64url (a JWK k). The result then carries hmac: true, and the secret is never echoed in the result or an error; a secret invalid for its encoding fails as invalid_secret_encoding
generate returns digest in digestEncoding (hex default, base64, unpadded base64url, or sri for plain SHA-2 digests, where an HMAC fails as sri_with_secret) plus lengthInBytes; compare returns matches against expected, pasted as published: hex, base64, or base64url, bare or prefixed (sha256: , sha256= ); SRI, including a multi-entry npm integrity value; or one checksum-file line as sha256sum, shasum, md5, or openssl dgst prints it
A bad expected fails as expected_malformed (including a whole multi-line checksum file, with a hint to pass the file's own line), expected_length_mismatch (the hint names the algorithm that length fits), or expected_algorithm_mismatch (a tag, prefix, or SRI entry naming another algorithm)

`toolkit_generate_id` tool

type is uuid_v4 (default), uuid_v7, or ulid; count is 1–1000 (default 1)
ids always holds exactly count values; uuid_v7 and ulid batches are strictly increasing even within one millisecond, with random gaps so no id is derivable from another

`toolkit_generate_qr` tool

data up to 2953 UTF-8 bytes at errorCorrection L, less at M (default), Q, and H; format is svg (default), png_base64, or terminal; margin 0–20 modules (default 4), scale 1–32 px per module (default 4)
Returns content, the symbol version (1–40), mimeType for image formats, and byteLength for PNG; png_base64 also arrives as an MCP image block, and terminal is plain Unicode half-blocks drawn for a dark background
Over-capacity input fails as data_too_large with its byte count; a PNG over 2048 px per side fails as raster_too_large with a scale that fits, while svg and terminal have no pixel cap

`toolkit_encode_value` tool

operation (encode or decode) and encoding (base64, base64url, hex, url) are required; whitespace in hex, base64, and base64url input is ignored, so wrapped MIME and PEM bodies decode as-is
Decode returns result as utf8 text unless outputEncoding asks for hex, base64, or unpadded base64url, which returns the bytes losslessly and transcodes between encodings; malformed input fails as decode_failed, and binary bytes as decode_not_utf8 rather than with replacement characters

`toolkit_geolocate_ip` tool

target is an IPv4/IPv6 address or a dotted hostname, DNS-resolved first; private or reserved addresses, and public-format ones the provider reports as unlocatable, fail as private_target, unresolvable hostnames as unresolvable_host
Or send targets (up to 1000) instead, never both: the first 100 return ordered results with per-target errors, failedCount counts failures, and unprocessedTargets lists the rest to resubmit
Returns country, countryCode, region, city, latitude/longitude, asn, asHolder, asName, org, isp, and timezone with resolvedIp and source; a true in proxy, hosting, or mobile means the location describes infrastructure, not a person
org can name a customer or sub-allocation (APNIC and Cloudflare DNS Resolver project for 1.1.1.1); isp, asHolder, and asName (CLOUDFLARENET) name the network operator. With no org from the provider, org carries asHolder, then isp
Uses the keyless ip-api free tier over plaintext HTTP by default (TOOLKIT_GEO_BASE_URL, TOOLKIT_GEO_API_KEY); results are cached per resolved IP
Single and batch lookups have separate rate limits (TOOLKIT_GEO_RATE_LIMIT_PER_MIN=45, TOOLKIT_GEO_BATCH_RATE_LIMIT_PER_MIN=15); refusals report rate_limited with seconds to wait, and cache hits stay free

`toolkit_check_network` tool

mode is ping, traceroute, connectivity, or public_ip (the host's IPv4 egress address; it can't show whether IPv6 egress works); target is required except for public_ip, and port (1–65535) for connectivity; count 1–10 pings (default 3), timeoutMs 100–30000 (default 3000, one budget across every address for connectivity); family 4 or 6 probes one address family
A hostname resolves once to all its addresses, tried in turn and alternating IPv4 and IPv6 until one gives a result; resolvedIp names the address whose result is reported
A silent host is reachable: false, not an error; ping adds rttMs, sent, received, and packetLossPercent, connectivity adds outcome (open, refused, timeout, unreachable), and traceroute returns hops; a hostname that won't resolve fails as unreachable in every mode, as does ping or traceroute when its binary gives no result for any address tried (missing, stopped at its time limit, or exited with an error), and a family the target has no address in fails as family_mismatch
Registered only when TOOLKIT_ENABLE_NET_DIAGNOSTICS=true; unless TOOLKIT_ALLOW_PRIVATE_NETWORK=true, a hostname's private and reserved addresses are skipped, a target with nothing else fails as private_target_blocked, and error messages count those addresses instead of naming them

`toolkit_check_system` tool

what is os, cpu, memory, load, or interfaces; exactly one matching facet object is populated
os names the runtime (runtime is bun or node, runtimeVersion its version) beside nodeVersion, the Node.js version the process reports
memory.availableBytes is the allocation headroom, the same figure under Bun and Node, and limitBytes appears under a container memory limit; totalBytes, freeBytes, and usedBytes are raw OS figures, and on macOS freeBytes is free pages alone, so usedBytes counts reclaimable cache as used there
Under Bun on macOS the headroom is read from the host's page statistics; when they can't be read the call fails as memory_stats_unavailable instead of reporting free pages
Registered only when TOOLKIT_ENABLE_SYSTEM_INFO=true, since os and interfaces disclose host topology and version details

Features

Built on @cyanheads/mcp-ts-core: stdio and Streamable HTTP transports, pluggable auth (none / jwt / oauth), swappable storage (in-memory, filesystem, Supabase, Cloudflare KV/R2/D1), structured logging with optional OpenTelemetry tracing.

Toolkit-specific:

Hashing, ID minting, QR encoding, and encode/decode run in-process on node:crypto, Buffer, and the qrcode library, with no upstream calls
Geolocation calls the provider, never the target, and checks the DNS-resolved IP against private ranges, so a hostname can't reach an internal address
Fail-closed gating: toolkit_check_network and toolkit_check_system are absent from tools/list unless enabled. Both report on the server's host, not the caller's, so they belong on local or self-hosted deployments
Two-tier network gate: with diagnostics on, private, loopback, link-local, and reserved targets (the cloud-metadata endpoint included) stay blocked unti

Only the beginning is shown; read the rest in the repo

Toolkit MCP Server

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

Or run it on your computer

Or run it on your computer

Or run it on your computer

Or run it on your computer

Values you fill in

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Otheri

Common questions

Alternatives

Spec Driven Development

Remote Desktop Commander

Asset Notation

README from the maker

Overview

Tools

Skill

Capability reference

toolkit_hash_value tool

toolkit_generate_id tool

toolkit_generate_qr tool

toolkit_encode_value tool

toolkit_geolocate_ip tool

toolkit_check_network tool

toolkit_check_system tool

Features

`toolkit_hash_value` tool

`toolkit_generate_id` tool

`toolkit_generate_qr` tool

`toolkit_encode_value` tool

`toolkit_geolocate_ip` tool

`toolkit_check_network` tool

`toolkit_check_system` tool