Calc MCP

Appearance

Changelog ​

All notable changes to Calc MCP are documented here.

v2.1.0 (2026-08-18) ​

Features ​

  • ip — range now reports totalAddresses, the count of every address in the block, alongside hostCount, which excludes the network and broadcast addresses. info accepts an IPv4 prefix in either ip or cidr and reports the network it describes; previously it rejected CIDR notation outright and pointed at nothing (#191)

Bug Fixes ​

  • datetime — fromTimezone was declared in the schema and documented as the source timezone, but nothing read it. convert parsed an offset-less datetime as host-local time, so the source zone was whichever machine the server ran on: on a JST host, New York 14:30 converted to 05:30Z instead of 19:30Z, and a UTC-to-UTC conversion moved the clock nine hours. A bare wall-clock string is now read in fromTimezone, defaulting to UTC rather than the host zone, and the offset is resolved at the instant in question, so a November date gets EST and a June date gets EDT. convert, format and timestamp all share this. A string carrying a UTC designator or a numeric offset is absolute as before (#191)
  • semver — satisfies reported that 2.0.0-rc.1 satisfies >=1.4.0 <2.0.0. A version carrying a pre-release tag now satisfies a comparator set only if some comparator in that set pins the same [major, minor, patch] and carries a pre-release tag of its own, matching node-semver (#191)
  • url_parse — a repeated query key kept only its last value, so ?q=first&page=3&q=second reported q: "second" and dropped the first with no indication. A key that appears once still maps to a string; a key that repeats maps to an array of every value, in order (#191)
  • ip — an IPv6 prefix passed to info failed as though the address itself were malformed. It now fails with a message naming the address to pass instead, since the network calculation is IPv4-only (#191)

Documentation ​

  • Document the parsing contract for datetime and fromTimezone, that convert reads timezone as the source zone when fromTimezone is absent, what totalAddresses counts, and how a repeated query key is represented (#191)
  • Correct two datetime examples: one documented the right answer for a New-York-to-Tokyo conversion the implementation did not produce, and a neighbouring one claimed a date-only input formats as 12:00 in Tokyo, which no source timezone produces (#191)
  • Correct three project rules in CLAUDE.md that no longer matched the repository: indentation is 2 spaces per biome.json rather than tabs, biome check . exits 0 on lint warnings so they are not treated as errors in CI, and the ci.yml row named a push trigger that does not exist while omitting both the develop branch and the audit job (#191)

Tests ​

  • 26 tests covering the four fixes. Every expected value comes from an independent reference implementation rather than from calc-mcp: the semver cases were checked against node-semver 7.8.5, which also disagreed with an existing hyphen-range test that had codified the old behaviour. The datetime tests were run under three host timezones to confirm the output no longer depends on the host (#191)

v2.0.6 (2026-08-18) ​

Maintenance ​

  • Update Node.js to 24.19.0 in CI and the published Docker image (#176, #173, #184)
  • Update devDependencies: @biomejs/biome 2.5.8 (#177, #181), vitepress 2.0.0-alpha.19 (#175), docker/login-action v4.6.0 (#172)
  • Lock file maintenance (#174, #178, #182)

v2.0.5 (2026-08-11) ​

Bug Fixes ​

  • Claude Code plugin: drop the --prefix argument from .mcp.json. It pointed at a .npx-prefix directory that nothing ever created, so npx exited with ENOENT and the plugin's MCP server failed to connect (#179)

Documentation ​

  • Drop --prefix /tmp from every npx example in the README and docs, along with the Windows notes it required (#179)
  • Correct the "calc-mcp: command not found" troubleshooting entry — the cause is running npx from an unbuilt clone of this repository, not the presence of node_modules (#179)

Chores ​

  • Update @modelcontextprotocol/sdk to 1.30.0 (#169)
  • Update @biomejs/biome to 2.5.7 (#170, #177)
  • Update Node.js to 24.19.0 (#173, #176)
  • Update vitepress to 2.0.0-alpha.19 (#175)
  • Update docker/login-action to 4.6.0 (#171, #172)
  • Lock file maintenance (#168, #174, #178)

v2.0.4 (2026-07-24) ​

Improvements ​

  • CI: mint a GitHub App installation token for the marketplace sync dispatch instead of the unconfigured MARKETPLACE_TOKEN secret (#154)
  • CI: update actions/setup-node to v7 (#145)

v2.0.3 (2026-07-24) ​

Features ​

  • Claude Code plugin support — add .claude-plugin/plugin.json and .mcp.json so installing from the coo-quack marketplace registers the MCP server (#151)

Bug Fixes ​

  • Remove stray package-lock.json and regenerate bun.lock so Docker builds with --frozen-lockfile succeed (#150)

Tests ​

  • Add tests/version-sync.test.ts enforcing that the pinned versions in the plugin manifest and docs match package.json (#151)

Documentation ​

  • Pin install commands to the released version and document the Claude Code plugin install path (#151)
  • Add Windows notes for the /tmp npx prefix and use npm view for version checks (#151)

v2.0.2 (2026-06-27) ​

Security ​

  • Harden tools against DoS and add stronger crypto/JWT warnings (#107)

Tests ​

  • Add comprehensive jwt_decode tests for timestamps, unsigned JWTs, and non-standard claims
  • Cover invalid CIDR and malformed IPv6 cases in ip tests

Improvements ​

  • CI: sync main to develop via pull request with auto-merge and a GitHub App token

v2.0.1 (2026-03-31) ​

Security ​

  • Add minimumReleaseAge to renovate.json to prevent supply chain attacks
    • Waits 7 days before auto-merging dependency updates
    • Reduces risk of package takeover attacks
    • Blocks immediate auto-merge of newly published packages

v2.0.0 (2026-03-15) ​

BREAKING CHANGES ​

  • format_validate — Renamed json_validate tool to format_validate to reflect multi-format support (JSON, CSV, XML, YAML) (#86)
  • convert — Changed nautical mile unit key from nm to nmi to avoid ambiguity with nanometer (#86)
  • hash — Now returns JSON {"hash": "..."} instead of plain hex string; weak algorithm warnings included as {"hash": "...", "warning": "..."} instead of console.warn (#87)

Bug Fixes ​

  • color — Fix named color typos: lima/limagreen → lime/limegreen (CSS Named Colors spec) (#86)
  • cron_parse — Fix DST-aware skip optimization with monotonic forward-only adjustments (#87)
  • cron_parse — Correct overshoot past midnight on spring-forward days (#87)
  • cron_parse — Handle ±30 min DST zones (e.g., Australia/Lord_Howe) (#87)

Improvements ​

  • cron_parse — Skip optimization: jump forward when month/day/hour don't match instead of minute-by-minute iteration; yearly cron 580ms → 7ms (#87)
  • diff — Replace O(m×n) LCS with Myers diff algorithm O(nd); 5000-line diff 178ms → 39ms (#87)
  • diff — Add edit distance cap (1000) with truncation fallback and notice (#87)
  • regex — Simplify flag logic; remove as string cast via variable narrowing (#86)
  • cron_parse — Unify arrayGet usage in describeCron for consistency (#86)
  • convert — Remove dead code entries from TIME table (#86)
  • color — Move RGB/HSL type definitions before first usage (#86)

Tests ​

  • cron_parse — Add 6 DST transition tests pinned to known boundary dates (#87)
  • diff — Add truncation fallback test case (#87)
  • color — Add lime/limegreen named color tests (#86)
  • hash — Update all tests for JSON output format (#87)

Documentation ​

  • docs — Add logo to hero section on home page (#87)
  • docs — Unify documentation site structure (#85)
  • diff — Document edit distance limit in tool description (#87)

v1.9.3 (2026-03-12) ​

Security ​

  • Add explicit permissions to all workflow jobs
  • Use exact field assertions in url_parse e2e tests to resolve CodeQL alerts

v1.9.2 (2026-03-12) ​

Fixes ​

  • Scope CI badge to main branch

v1.9.1 (2026-03-11) ​

Chores ​

  • Update Renovate configuration with automerge on CI success

v1.9.0 (2026-02-27) ​

Features ​

  • Add Docker image support with multi-stage builds (#67)
  • Publish Docker images to GitHub Container Registry (ghcr.io)
  • Add automated Docker build & test workflow

Security ​

  • Run Docker container as non-root user (node)

Improvements ​

  • Add .dockerignore for optimized Docker builds
  • Add GitHub Actions cache for Docker builds

v1.8.6 (2026-02-24) ​

Documentation ​

  • Switch README image hosting to imgur for better reliability (#64)

v1.8.5 (2026-02-23) ​

Improvements ​

  • Rename publish.yml to release.yml to align with sensitive-canary workflow naming (#60)
  • Add dual version check (git tag + npm) for more robust release gating (#60)
  • Add ci script to package.json for unified CI execution (#60)
  • Add backport workflow to auto-sync main to develop (#56)

v1.8.4 (2026-02-20) ​

Documentation ​

  • Add mcpName to package.json for MCP Registry listing (io.github.coo-quack/calc-mcp)

v1.8.3 (2026-02-20) ​

Documentation ​

  • Use generic MCP client examples in SECURITY.md and README.md — replaced tool-specific CLI invocations with client-agnostic Tool: / Input: format (#50)
  • Clarify security model: calc-mcp itself is local-only; inputs are sent to the LLM provider (Anthropic, OpenAI, etc.) when used via a cloud LLM (#50)
  • Remove misleading guidance suggesting environment variables prevent LLM provider exposure (#50)
  • Fix factually inaccurate claims: "Zero config", "Works offline", "no external dependencies" (#50)
  • Replace subjective/unverifiable phrasing ("incredible", "terrible", "automatically picks the right tool") with factual descriptions (#50)
  • Remove outdated test count from documentation (#50)
  • Fix UI-specific description in install guide ("bottom-right corner") with version-independent wording (#50)

v1.8.2 (2026-02-19) ​

Documentation ​

  • Add missing changelog entry for v1.8.1 (#48)
  • Update CLAUDE.md to document release note format, correct CHANGELOG.md location, and reflect current noUncheckedIndexedAccess coding conventions (#48)

v1.8.1 (2026-02-19) ​

Security ​

  • Add SECURITY.md with vulnerability reporting policy, sensitive data handling guidelines, and LLM integration considerations (#46)
  • Add error sanitization to prevent accidental leakage of sensitive input values (tokens, keys, passwords) in error messages for jwt_decode, hash, base64, and encode tools (#46)

Improvements ​

  • color — Replace non-null assertions with type-safe alternatives (objGet, Array.from, destructuring) (#46)
  • diff — Rewrite LCS and Levenshtein DP tables as flat 1D arrays for better cache efficiency and type safety (#46)
  • ip — Fix double-parsing of IPv4 address in ipInfo() (#46)
  • jwt_decode — Use destructuring with defaults to safely access JWT parts without type assertions (#46)
  • cron_parse — Use local variable narrowing to eliminate redundant nullish coalescing (#46)
  • random — Restore idiomatic Fisher-Yates destructuring swap (#46)

Tests ​

  • Add tests/sanitization.test.ts covering sanitizeErrorMessage for all sensitive tools (#46)
  • Add tests/security.test.ts verifying that sensitive input values are not leaked in error messages (#46)

v1.8.0 (2026-02-14) ​

Features ​

  • math — Add sandbox to block dangerous functions (e.g. import, eval, require) (#32)
  • regex — Strengthen ReDoS protection with enhanced pattern analysis (#33)
  • hash — Add HMAC support (action: "hmac" with key parameter) and weak algorithm warnings for MD5/SHA-1 (#34)
  • semver — Support OR (||), AND (space-separated), and hyphen range patterns (#35)
  • color — Support 8-digit HEX with alpha channel (e.g. #FF573380) and rgba()/hsla() formats (#36)
  • cron_parse — Support weekday names (MON, MON-FRI) and month names (JAN, JAN-MAR) with ranges (#38)
  • json_validate — Use yaml package for proper YAML validation (#39)

Improvements ​

  • Enable minification and source maps for production builds (#40)
  • TypeScript strict mode (noUncheckedIndexedAccess) with full type safety (#41)
  • Exclude unused mathjs functions and dev files from npm package for reduced bundle size (#41)
  • Exclude source maps from npm package (#41)

Documentation ​

  • Add CLAUDE.md with project rules and release workflow (#42)
  • Update tool reference, examples, and README for v1.8.0 features (#37)

Tests ​

  • E2E: expanded to cover HMAC, alpha colors, semver OR/AND/hyphen ranges, cron weekday/month names
  • Unit: additional tests for strict mode type assertions

v1.7.2 (2026-02-13) ​

Bug Fixes ​

  • cron_parse — Now respects the timezone parameter (was previously ignored; all calculations used local time)
  • count — Improve Shift_JIS byte calculation accuracy (handle ¥, ‾, and supplementary plane characters correctly)

v1.7.1 (2026-02-12) ​

Bug Fixes ​

  • regex — Auto-add g flag for matchAll action, consistent with match and replace (#25)

v1.7.0 (2026-02-12) ​

Features ​

  • math — BigNumber mode (64-digit precision) eliminates floating-point drift (0.1 + 0.2 = 0.3, mean([0.1,0.2,0.3]) = 0.2)
  • url_parse — Auto-add https:// for URLs without protocol
  • color — Support CSS named colors (red, blue, green, etc.)
  • regex — Global match/replace (auto-add g flag) for all occurrences
  • cron_parse — Support @daily, @hourly, @weekly, @monthly, @yearly aliases
  • semver — Add parse action to extract version components

Tests ​

  • E2E: 137 tests covering all 21 tools' every action/option
  • Unit: 222 tests across all tools
  • Total: 359 tests passing

v1.6.2 (2026-02-12) ​

Fixes ​

  • ci — Publish workflow now skips tag/release creation if already exists (idempotent) (#20)
  • npm — Trim package size by excluding docs, images from npm tarball (#20)

v1.6.1 (2026-02-12) ​

Bug Fixes ​

  • hash — Replace Bun.CryptoHasher with node:crypto for Node.js compatibility (#18)

v1.6.0 (2026-02-12) ​

Features ​

  • Documentation site — Full VitePress-powered docs at coo-quack.github.io/calc-mcp with tool reference, examples, install guides, and changelog (#13)

Documentation ​

  • Added documentation site link to README
  • Added release checklist to CONTRIBUTING.md (#15)
  • Updated npx examples with --prefix /tmp for better node_modules compatibility
  • Added common ignore patterns to .gitignore

v1.5.0 (2026-02-11) ​

Features ​

  • Password generation — Fine-grained options: uppercase, numbers, symbols (on/off), readable mode (excludes ambiguous chars like l/1/I/O/0/o), excludeChars for custom exclusions
  • Shuffle — Fisher-Yates algorithm with crypto.getRandomValues for unbiased list shuffling

Documentation ​

  • README title: @coo-quack/calc-mcp → Calc MCP
  • Added "Why?" section with AI-alone vs calc-mcp comparison
  • Quick Start moved to top
  • Install guides consolidated (Claude Desktop/Cursor/Windsurf share same JSON format)

Tests ​

  • Random tool tests: 12 → 27 (+15)
  • Total: 194 tests, 280 assertions

v1.4.0 (2026-02-11) ​

Features ​

  • Time conversion — ms, s, min, h, d, wk, mo, yr (now 8 categories, 72 units)
  • --version flag — npx @coo-quack/calc-mcp --version

Improvements ​

  • serverInfo.version synced with package.json (was hardcoded "0.1.0")
  • Error messages now list all supported units on unknown unit
  • Semver test coverage: 9 → 23 tests
  • CI git config for tag authoring
  • README badges (npm, CI, license)
  • CONTRIBUTING.md added
  • GitHub topics set
  • README examples: Japanese text replaced with English alternatives

v1.3.0 (2026-02-11) ​

Documentation ​

  • Overhaul README with natural language examples (22 verified examples)
  • Add install guides for Claude Code, Claude Desktop, VS Code, Cursor, Windsurf
  • Add unit conversion coverage details (7 categories, 58 units)
  • Add encode/decode examples (Base64, URL, HTML)

v1.1.0 (2026-02-11) ​

Features ​

  • random: Add UUID v7 support (uuidVersion: "v7") — Time-ordered UUIDs, ideal for database primary keys

v1.0.0 (2026-02-11) ​

Features ​

Initial release with 21 MCP tools for calculations and operations AI models struggle with:

  • random — UUID (v4), ULID, secure password, random number
  • hash — SHA-1, SHA-256, SHA-512, MD5
  • base64 — Encode/decode Base64
  • encode — URL encode/decode, HTML entity encode/decode
  • datetime — Current time, convert, format, Unix timestamp
  • count — Character, word, line, byte counting (grapheme-aware)
  • math — Precise math evaluation via mathjs
  • date — Date arithmetic (add/subtract/diff)
  • regex — Test, match, replace with regex
  • base — Number base conversion (bin/oct/dec/hex/custom)
  • diff — Text diff between two strings
  • json_validate — JSON schema validation
  • cron_parse — Cron expression to human-readable description
  • luhn — Luhn algorithm validation (credit cards, etc.)
  • ip — IPv4/IPv6 parsing, CIDR subnet info
  • color — Color format conversion (hex/rgb/hsl/hwb)
  • convert — Unit conversion (length, weight, temp, data, time)
  • char_info — Unicode character info (codepoint, name, category)
  • jwt_decode — Decode JWT tokens (header + payload)
  • url_parse — URL parsing into components
  • semver — Semantic versioning operations (compare, satisfy, sort)

CI/CD ​

  • GitHub Actions: test + lint on push/PR
  • Publish workflow: test + lint gate before npm publish on tag

Infrastructure ​

  • Biome for linting and formatting
  • Renovate with OSV vulnerability alerts
  • 160 tests, 92%+ line coverage

For the latest changes, see GitHub Releases.

Released under the MIT License.

Copyright © 2026 coo-quack