// SCAN REPORT

Devutils

36 tools. 11 can modify or destroy data without limits.

11 write tools that can modify data. Rate limits recommended.

Last updated: 30 Jun 2026

11 can modify or destroy data

25 read-only

36 tools total

Community server · catalogue entry verified 30/06/2026

How to control Devutils ↓

TOOL MAP

What Devutils exposes to your agents

Read (25) Write / Execute (11) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Devutils tools

Write · Low generate_password This tool generates and returns a new password string, which is a write operation (data creation). Write · Low hash_bcrypt The tool produces a hashed output without modifying any persistent state or stored data directly. Write · Low html_encode HTML encoding transforms data reversibly without destructive side effects or external operations. Write · Low json_format The tool creates or modifies data (JSON formatting/minification) in a reversible manner.

11 of Devutils's 36 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Devutils

PolicyLayer is an MCP gateway — it sits between your AI agents and Devutils, and nothing reaches the server without passing your rules. These are the rules we recommend:

Rate limit write operations

{
  "generate_password": {
    "limits": [
      {
        "counter": "generate_password_per_hour",
        "window": "hour",
        "max": 30,
        "scope": "grant"
      }
    ]
  }
}

Prevents bulk unintended modifications from agents caught in loops.

Cap read operations

{
  "base64_decode": {
    "limits": [
      {
        "counter": "base64_decode_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Devutils — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON DEVUTILS →

Instant setup, no code required.

FULL CATALOGUE

All 36 Devutils tools

WRITE 11 tools

Write generate_password Generate a secure random password with configurable options. Write generate_random_hex Generate a random hexadecimal string of the specified byte length. Write hash_bcrypt Generate a bcrypt hash of the given input string. Useful for password hashing. Write hash_md5 Generate an MD5 hash of the given input string. Write hash_sha1 Generate a SHA-1 hash of the given input string. Write hash_sha256 Generate a SHA-256 hash of the given input string. Write hash_sha512 Generate a SHA-512 hash of the given input string. Write html_encode Encode special characters in a string to HTML entities. Write json_format Format (pretty-print) a JSON string with configurable indentation. Can also minify JSON. Write lorem_ipsum Generate Lorem Ipsum placeholder text. Write url_encode URL-encode a string (percent-encoding).

READ 25 tools

Read base64_decode Decode a Base64 string back to plain text. Read base64_encode Encode a string to Base64. Read byte_convert Convert between byte units (B, KB, MB, GB, TB, PB). Supports both binary (1024) and SI (1000) standards. Read case_convert Convert a string between different casing styles: camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE Read cidr_calculate Calculate network details from a CIDR notation (e.g., Read color_convert Convert colors between HEX, RGB, and HSL formats. Read date_to_timestamp Convert a date string to a Unix timestamp. Accepts ISO 8601 and common date formats. Read generate_nanoid Generate a NanoID — a compact, URL-friendly unique ID. Read generate_uuid Generate a cryptographically secure UUID v4. Read hash_bcrypt_verify Verify a string against a bcrypt hash. Returns true if matches. Read hex_decode Decode a hexadecimal string back to plain text. Read hex_encode Encode a string to its hexadecimal representation. Read html_decode Decode HTML entities in a string back to their original characters. Read ip_validate Validate and classify an IPv4 or IPv6 address. Returns type, class, scope, and whether it Read json_path_query Extract a value from a JSON object using a dot-notation path (e.g., Read json_validate Validate a JSON string and report any parsing errors with their approximate location. Read jwt_decode Decode a JWT (JSON Web Token) and display its header and payload without verifying the signature. Useful for d Read jwt_validate Validate the structure of a JWT. Checks format, Base64URL encoding, JSON validity, and expiration status. Does Read number_base_convert Convert a number between different bases (binary, octal, decimal, hexadecimal, or any base 2-36). Read regex_test Test a regular expression pattern against an input string. Returns all matches with groups and indices. Read slugify Convert a string to a URL-friendly slug. Removes special characters, replaces spaces with hyphens, and lowerca Read text_diff Compare two strings and show a simple line-by-line diff. Lines prefixed with Read text_stats Analyze text and return detailed statistics: character count, word count, line count, sentence count, paragrap Read timestamp_to_date Convert a Unix timestamp (seconds or milliseconds) to a human-readable ISO 8601 date string. Read url_decode Decode a URL-encoded string.

FAQ

Questions about Devutils

How do I prevent bulk modifications through Devutils? +

The Devutils server has 11 write tools including generate_password, generate_random_hex, hash_bcrypt. Set a rate limit in your policy -- for example, 10 calls per hour prevents an agent from making more than 10 modifications per hour. PolicyLayer enforces this at the gateway, before calls reach Devutils.

How many tools does the Devutils MCP server expose? +

36 tools across 2 categories: Read, Write. 25 are read-only. 11 can modify, create, or delete data.

How do I enforce a policy on Devutils? +

Register the Devutils MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Devutils tool call.

Deterministic rules across all 36 Devutils tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON DEVUTILS →

Instant setup, no code required.

36 Devutils tools catalogued and risk-classified — across an index of 43,000+ MCP servers.