Skip to content

Utility Matrix

by helphub369 · remote · no sign-in to list tools · v1.0.0 · published by GitHub user helphub369

Free browser-based calculators and analyzers for cloud cost, DevOps, security, and data governance.

Final · 1Changes · 29

31 tools: 1 do something that can't be undone, 29 change things and 1 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http utility-matrix https://utility-matrix.com/mcp

Findings

Matches of fixed checks, with the text they matched.

2 warn1 info
  • The server marks "on-call-burden-calculator" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "on-call-burden-calculator" says "call": a word for a change.

    What this check looks for
  • The server marks "software-purchase-risk-calculator" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "software-purchase-risk-calculator" says "purchase": a word that usually means money moves, which cannot be taken back.

    What this check looks for
  • The input schema at properties.text.description mentions "credential".

    Matched text

    inputSchema.properties.text.description: "...ive production secrets; rotate any real credential that appears here."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

31 tools

Can't be undone 1Claude Code: ask
  • software-purchase-risk-calculatorUse when a user asks about risk of a software purchase or SaaS commitment.1 finding

    Why it is in this group

    • The name "software-purchase-risk-calculator" says "purchase": a word that usually means money moves, which cannot be taken back.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "software-purchase-risk-calculator" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "software-purchase-risk-calculator" says "purchase": a word that usually means money moves, which cannot be taken back.

      What this check looks for
    Description, as the server wrote it
    Use when a user asks about risk of a software purchase or SaaS commitment.

    Annotations the server declares

    • title: Software Purchase Risk Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Changes things 29Claude Code: ask
  • alert-fatigue-calculatorUse when a user asks about alert noise, alert fatigue, or on-call burden from non-actionable alerts.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about alert noise, alert fatigue, or on-call burden from non-actionable alerts. Given weekly alert volume, actionable %, engineer count, and avg resolution time, returns noise rate, wasted hours, and fatigue tier.

    Annotations the server declares

    • title: Alert Fatigue Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • apdex-score-calculatorUse this when a user asks about their Apdex score or wants to measure user satisfaction with response times.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks about their Apdex score or wants to measure user satisfaction with response times. Takes satisfied, tolerating, and total request counts; satisfied plus tolerating may not exceed total. Returns the Apdex score (0–1) and its rating on the published five-band scale: excellent, good, fair, poor or unacceptable.

    Annotations the server declares

    • title: Apdex Score Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • availability-sla-calculatorUse this when a user asks what a specific availability percentage (like 99.9% or 99.99%) means in downtime minutes per month or year.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks what a specific availability percentage (like 99.9% or 99.99%) means in downtime minutes per month or year. Converts availability SLA percentage to exact downtime budgets: annual, monthly, weekly, and daily.

    Annotations the server declares

    • title: Availability SLA Downtime Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • canonical-url-auditorAudit a page URL against its canonical tag.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Audit a page URL against its canonical tag. Detects missing canonical, self-referencing canonical, and relative URL issues.

    Annotations the server declares

    • title: Canonical URL Auditor
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • certificate-expiry-checkerAssess certificate expiry risk given a domain and days remaining.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Assess certificate expiry risk given a domain and days remaining. Returns risk level (OK, WARNING at <30 days, CRITICAL at <7 days, EXPIRED at <0).

    Annotations the server declares

    • title: Certificate Expiry Checker
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • change-failure-rate-calculatorUse when a user asks about change failure rate or DORA CFR.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about change failure rate or DORA CFR. Given total and failed deployments, returns failure rate percentage and DORA tier.

    Annotations the server declares

    • title: Change Failure Rate Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • cloud-waste-calculatorUse when a user asks about cloud waste, idle resources, or unattached storage.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about cloud waste, idle resources, or unattached storage. Given monthly cloud bill and idle/oversized percentages, returns waste estimate and tier.

    Annotations the server declares

    • title: Cloud Waste Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • cluster-capacity-calculatorUse this when a user asks for Kubernetes cluster capacity.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks for Kubernetes cluster capacity. Uses the same node vCPU, node memory, node count, system reserve, and target utilization model as the browser calculator.

    Annotations the server declares

    • title: Kubernetes Cluster Capacity Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • connection-pool-calculatorUse this when a user asks how many database connections to configure.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks how many database connections to configure. Uses the same max_connections, app server count, database cores, average query duration, and peak RPS model as the browser calculator.

    Annotations the server declares

    • title: Database Connection Pool Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • deployment-frequency-calculatorUse when a user asks about deployment frequency or DORA deploy cadence.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about deployment frequency or DORA deploy cadence.

    Annotations the server declares

    • title: Deployment Frequency Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • detect-secrets-scannerScan text (config, code, env files) for leaked API keys, tokens, passwords, and private keys, plus static code-risk findings such as dynamic code execution, wildcard CORS, unsafe H…1 finding

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Info

      The input schema at properties.text.description mentions "credential".

      Matched text

      inputSchema.properties.text.description: "...ive production secrets; rotate any real credential that appears here."

      What this check looks for
    Description, as the server wrote it
    Scan text (config, code, env files) for leaked API keys, tokens, passwords, and private keys, plus static code-risk findings such as dynamic code execution, wildcard CORS, unsafe HTML sinks, process spawning and removed security guards. Returns findings with redacted matches and severity classification.

    Annotations the server declares

    • title: Secrets Scanner
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dockerfile-linterLint a Dockerfile against a rule-based subset of Hadolint checks: untagged or :latest base images, interactive or unpinned apt-get installs, apt list cleanup, apk cache, ADD for lo…No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Lint a Dockerfile against a rule-based subset of Hadolint checks: untagged or :latest base images, interactive or unpinned apt-get installs, apt list cleanup, apk cache, ADD for local files, shell-form CMD/ENTRYPOINT, running as root and a missing HEALTHCHECK. Lines joined with a trailing backslash count as one instruction, and each issue reports its line in the original file.

    Annotations the server declares

    • title: Dockerfile Linter
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • dora-metrics-calculatorUse this when a user wants to benchmark an engineering team against DORA metrics.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user wants to benchmark an engineering team against DORA metrics. Takes deploys per month, lead time in hours, change failure rate in percent and, optionally, time to restore in hours. Classifies each metric as elite, high, medium or low against fixed benchmark bands; an omitted restore time is reported as unknown and the overall profile is marked partial rather than assumed.

    Annotations the server declares

    • title: DORA Metrics Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • ec2-cost-calculatorUse when a user asks about EC2 cost.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about EC2 cost. Given instance type and hours, returns monthly cost and DO-equivalent savings estimate.

    Annotations the server declares

    • title: EC2 Cost Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • egress-cost-calculatorUse this when a user asks about monthly internet egress cost from daily request volume, average response size, provider, and CDN offload.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks about monthly internet egress cost from daily request volume, average response size, provider, and CDN offload. Uses the same model as the browser calculator.

    Annotations the server declares

    • title: Cloud Egress Cost Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • error-budget-calculatorUse this when a user asks about their SLO error budget, remaining error budget, or burn rate.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks about their SLO error budget, remaining error budget, or burn rate. Given SLO percentage and window, returns budget minutes remaining, burn rate multiplier, and status (Under budget / Elevated / ALERTING).

    Annotations the server declares

    • title: SLO Error Budget Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • incident-cost-calculatorUse this when a user asks what an outage or incident cost, or wants to calculate the financial impact of downtime.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks what an outage or incident cost, or wants to calculate the financial impact of downtime. Takes hourly revenue, downtime duration, and affected percentage. Returns revenue impact, engineering cost, and total incident cost in dollars.

    Annotations the server declares

    • title: Incident Cost Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • known-vulnerability-checkerHistorical curated package-name advisory reference only.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Historical curated package-name advisory reference only. Matches older CVE examples for common packages; does not query live feeds or evaluate installed version ranges, so it never proves a package is currently vulnerable or safe.

    Annotations the server declares

    • title: Known Vulnerability Checker
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • kubernetes-manifest-linterLint a Kubernetes manifest (YAML) for common issues: missing resource limits, missing health checks, :latest tag usage, privileged containers.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Lint a Kubernetes manifest (YAML) for common issues: missing resource limits, missing health checks, :latest tag usage, privileged containers. Returns issue list and severity.

    Annotations the server declares

    • title: Kubernetes Manifest Linter
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • mttr-calculatorUse when a user asks about MTTR or DORA recovery time.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about MTTR or DORA recovery time. Takes incident timestamps (string lines "start,detected,resolved" or array of {start,detected,resolved}).

    Annotations the server declares

    • title: MTTR Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • on-call-burden-calculatorUse when a user asks about on-call load or burnout risk.1 finding

    Why it is in this group

    • The name "on-call-burden-calculator" says "call": a word for a change.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "on-call-burden-calculator" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The name "on-call-burden-calculator" says "call": a word for a change.

      What this check looks for
    Description, as the server wrote it
    Use when a user asks about on-call load or burnout risk. Uses team size, rotation length, and hourly rate exactly as the browser calculator does.

    Annotations the server declares

    • title: On-Call Burden Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • pipeline-cost-calculatorUse this when a user asks how much their GitHub Actions CI/CD pipeline costs per month.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks how much their GitHub Actions CI/CD pipeline costs per month. Takes average job duration in minutes, jobs per run, runs per month and the runner label (ubuntu-latest, windows-latest, macos-latest or self-hosted; matched case-insensitively). Uses GitHub list prices for standard hosted runners effective 1 Jan 2026 and GitHub Free's 2,000 included minutes for private repositories, drawn at list price. Self-hosted minutes carry no GitHub charge.

    Annotations the server declares

    • title: CI/CD Pipeline Cost Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • precision-recall-f1-calculatorUse this when a user asks about their ML model precision, recall, F1 score, or F-beta score.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks about their ML model precision, recall, F1 score, or F-beta score. Takes precision and recall as fractions from 0 to 1 and an optional beta weight. Returns F1, F-beta, and interpretation of the precision-recall tradeoff.

    Annotations the server declares

    • title: Precision, Recall and F1 Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rate-limit-utilization-calculatorCalculate API rate limit utilization given current request count and limit.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Calculate API rate limit utilization given current request count and limit. Returns utilization percentage, buffer, safety status, and risk level (OK at <80%, WARNING at 80-95%, CRITICAL at >95%).

    Annotations the server declares

    • title: API Rate Limit Utilization Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • reserved-instance-breakevenUse this when a user asks whether to buy Reserved Instances or stay on On-Demand, or how long an RI takes to pay for itself.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks whether to buy Reserved Instances or stay on On-Demand, or how long an RI takes to pay for itself. Takes On-Demand and RI monthly costs plus optional upfront fees (0 when omitted). Judges the 1-year and 3-year terms separately and returns each break-even month and net saving. It recommends a term only when that term saves money over its own length, and prefers 3 years only when it beats three 1-year terms over 36 months at current prices.

    Annotations the server declares

    • title: Reserved Instance Breakeven Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • rightsizing-calculatorUse when a user asks about instance rightsizing or overprovisioned compute.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about instance rightsizing or overprovisioned compute.

    Annotations the server declares

    • title: Compute Rightsizing Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • slo-burn-rate-calculatorUse this when a user asks how fast they are burning their error budget, or whether their current error rate will exhaust their SLO window.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use this when a user asks how fast they are burning their error budget, or whether their current error rate will exhaust their SLO window. Takes error count, total requests, SLO target, and observation window. Returns burn rate and budget consumption per hour.

    Annotations the server declares

    • title: SLO Burn Rate Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • terraform-plan-cost-estimatorUse when a user asks to estimate monthly cost of a Terraform plan.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks to estimate monthly cost of a Terraform plan.

    Annotations the server declares

    • title: Terraform Plan Cost Estimator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • total-cost-of-ownership-calculatorUse when a user asks about TCO or multi-year SaaS cost.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Use when a user asks about TCO or multi-year SaaS cost.

    Annotations the server declares

    • title: Total Cost of Ownership Calculator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
Only reads 1Claude Code: allow
  • query-cost-estimatorEstimate PostgreSQL sequential-scan and index-scan cost from table rows, table pages, selectivity, and storage type.No findings

    Why it is in this group

    • The name "query-cost-estimator" says "query": a word for reading.
    Description, as the server wrote it
    Estimate PostgreSQL sequential-scan and index-scan cost from table rows, table pages, selectivity, and storage type. Uses the same four-input model as the browser calculator.

    Annotations the server declares

    • title: PostgreSQL Query Cost Estimator
    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http utility-matrix https://utility-matrix.com/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__utility-matrix__query-cost-estimator"
    ],
    "ask": [
      "mcp__utility-matrix__error-budget-calculator",
      "mcp__utility-matrix__slo-burn-rate-calculator",
      "mcp__utility-matrix__incident-cost-calculator",
      "mcp__utility-matrix__reserved-instance-breakeven",
      "mcp__utility-matrix__availability-sla-calculator",
      "mcp__utility-matrix__apdex-score-calculator",
      "mcp__utility-matrix__dora-metrics-calculator",
      "mcp__utility-matrix__pipeline-cost-calculator",
      "mcp__utility-matrix__connection-pool-calculator",
      "mcp__utility-matrix__cluster-capacity-calculator",
      "mcp__utility-matrix__precision-recall-f1-calculator",
      "mcp__utility-matrix__egress-cost-calculator",
      "mcp__utility-matrix__detect-secrets-scanner",
      "mcp__utility-matrix__known-vulnerability-checker",
      "mcp__utility-matrix__certificate-expiry-checker",
      "mcp__utility-matrix__kubernetes-manifest-linter",
      "mcp__utility-matrix__dockerfile-linter",
      "mcp__utility-matrix__canonical-url-auditor",
      "mcp__utility-matrix__rate-limit-utilization-calculator",
      "mcp__utility-matrix__alert-fatigue-calculator",
      "mcp__utility-matrix__change-failure-rate-calculator",
      "mcp__utility-matrix__cloud-waste-calculator",
      "mcp__utility-matrix__deployment-frequency-calculator",
      "mcp__utility-matrix__ec2-cost-calculator",
      "mcp__utility-matrix__mttr-calculator",
      "mcp__utility-matrix__on-call-burden-calculator",
      "mcp__utility-matrix__rightsizing-calculator",
      "mcp__utility-matrix__software-purchase-risk-calculator",
      "mcp__utility-matrix__terraform-plan-cost-estimator",
      "mcp__utility-matrix__total-cost-of-ownership-calculator"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as utility-matrix. Review it before you use it.