Matetools MCP

@mate-tools/mcp-server

Model Context Protocol server for mate.tools. 35 utility tools for AI agents — text analysis, encoding, hashing, password generation, JSON/CSV/XML/sitemap parsing, regex, color, date, finance, URL metadata extraction, SEO meta-tag generation, text cleanup, CSPRNG random generators, hashtag tools, DNS lookup, SSL/TLS certificate inspection, JWT decoding and more. Wraps the public mate.tools JSON API so Claude Desktop, Claude Code, Cursor, Windsurf, and any other MCP-compatible client can call them directly.

Zero dependencies · Free · No API key · CORS open · Node 18+

Quick install

Add this to your Claude Desktop / Claude Code / Cursor / Windsurf config:

{

"mcpServers": { "mate-tools": { "command": "npx", "args": ["-y", "@mate-tools/mcp-server"] } } }

Restart your client and all 35 tools appear in the picker. That's it.

All 35 tools, by category

Text (8)

Encoding (4)

Crypto & auth (5)

Data & structure (13)

Date & time (3)

Generators & social (2)

The catalog grows over time. npx -y always fetches the latest published version — your client just needs a restart to pick up new tools.

Install snippets for every major client

Claude Desktop

Open the Claude Desktop config:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Windows: %APPDATA%\Claude\claude_desktop_config.json
• Linux: ~/.config/Claude/claude_desktop_config.json

Add the mcpServers entry from the Quick install above and restart.

Claude Code

claude mcp add mate-tools npx -- -y @mate-tools/mcp-server

Cursor

Add to ~/.cursor/mcp.json:

{

"mcpServers": { "mate-tools": { "command": "npx", "args": ["-y", "@mate-tools/mcp-server"] } } }

Windsurf and other MCP clients

The server speaks MCP over stdio with the standard JSON-RPC 2.0 framing. Any MCP-compatible client can launch it as a subprocess with the same configuration shape.

Manual install (no npx)

npm install -g @mate-tools/mcp-server

mate-tools-mcp # speaks JSON-RPC over stdio; plug into a client

How to verify it's working

Once installed, ask your AI agent any of these to confirm the tools are wired:

"Use mate-tools to count the lines and reading time of this paragraph."

"Hash the string secret with SHA-256."

"Generate 10 strong passwords, 20 chars, no ambiguous characters."

"Score this password: correct horse battery staple."

"Convert #ff5733 to all color spaces and tell me the WCAG contrast vs white."

"What's the aspect ratio of 3840 × 2160?"

"Diff these two paragraphs for me."

"What's the monthly payment on a $300k loan at 6.5% APR over 30 years?"

"How old is someone born on 1990-04-15? What's their zodiac sign?"

"Extract all URLs from https://example.com/sitemap.xml recursively."

"Fetch the metadata and OpenGraph tags from https://example.com for me."

"Generate SEO meta tags for an article titled … and score the result."

"Roll 4d6 drop lowest, six times, for me."

"Suggest hashtags for this caption."

"Look up the MX and TXT records for example.com."

"Is the SSL certificate on github.com valid? When does it expire?"

"Decode this JWT and tell me if it's expired."

The agent will pick the right tool automatically.

How it works

The server is a single ~600-line zero-dependency Node script. Every tool call:

1. Receives a JSON-RPC tools/call request from the MCP client.
2. Forwards the arguments to the public mate.tools API at https://mate.tools/api/v1/{tool}.php.
3. Returns a human-readable summary plus the full JSON response back to the client.

Nothing runs locally besides the JSON-RPC plumbing. Computation runs on mate.tools' servers behind Cloudflare. Every endpoint is rate-limited at 60 req/min and 600 req/hour per IP.

Configuration

Override the API endpoint (e.g. for testing against a staging deployment):

MATE_TOOLS_API_BASE=https://staging.mate.tools/api/v1 npx -y @mate-tools/mcp-server

Privacy

Each tool call:

• ✅ Sends only the arguments you provide to the MCP tool.
• ✅ Hits HTTPS in transit.
• ✅ Is processed in memory and not logged with content.
• ❌ Does not collect telemetry.
• ❌ Does not require an account, API key or sign-in.

The mate.tools server logs only request method, hashed-IP (rotating daily salt), endpoint name and duration — never request content.

credit_card_validate and password_strength are explicitly engineered so the sensitive input never leaves request-handler memory. Only the validation outcome and metrics are returned.

sitemap_extract, url_metadata, and ssl_check refuse to fetch / connect to any host whose name resolves to a private (RFC 1918), loopback, link-local, or cloud-metadata IP. For HTTP-based tools, each redirect destination is re-validated, so SSRF tricks via 302 don't work. url_metadata additionally caps the response body at 2 MB. ssl_check uses a 5-second connect timeout.

jwt_decode never logs the token. Decoding runs entirely in request-handler memory; only the algorithm name, signature verification outcome, and request duration are written to the per-day access log. Use it confidently with production tokens.

regex_test enforces a hard PCRE backtrack ceiling (100,000 steps) per request — catastrophic regex patterns return a clean 422 rather than hanging the server.

random_gen is backed by PHP's random_int / random_bytes (CSPRNG) — never the Mersenne Twister. UUIDs are RFC 4122 v4 with proper version/variant bits, or v7 with millisecond-precision timestamp.

Source and documentation

• npm: https://www.npmjs.com/package/@mate-tools/mcp-server
• Source code (single file): https://mate.tools/api/mcp/server.js
• Install guide with screenshots: https://mate.tools/api/mcp
• JSON API reference: https://mate.tools/api
• OpenAPI 3.1 spec: https://mate.tools/api/openapi.json
• llms.txt: https://mate.tools/llms.txt

Issues / feedback

Open an issue at the mate.tools contact form — please mention "@mate-tools/mcp-server" in the subject line. New tools land roughly every 1–2 weeks; if there's a specific utility you want exposed, just ask.

Li