Razi Dev Utilities
by razikallayi · remote · no sign-in to list tools · v1.0.0 · published by GitHub user razikallayi
Developer utilities over MCP: Base64 encode and decode, decode JWTs, format JSON, do percentages.
5 tools: 4 change things and 1 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things4Claude Code: ask: see these tools
- Only reads1Claude Code: allow: see these tools
No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http razi-dev https://www.razi.pro/api/mcp/devTools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
5 tools
Changes things 4Claude Code: ask
calculate_percentageRun one of four percentage calculations on two numbers.No findings
Why it is in this group
- The description's first verb is "run": a word for a change.
Description, as the server wrote it Run one of four percentage calculations on two numbers. Returns JSON { operation, result } (plus unit: 'percent' for the 'change' operation). The meaning of value1 and value2 depends on the operation, so read their descriptions before calling. Exact arithmetic, no model involved, no rounding applied. Ratios and general expressions are not supported.
decode_base64Decode a Base64 string back to UTF-8 text.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Decode a Base64 string back to UTF-8 text. Returns JSON { decoded }. Input is verified by re-encoding, so anything that is not genuine Base64 is rejected with an error instead of returning plausible garbage; binary payloads that are not valid UTF-8 will also fail. It handles Base64 and nothing else: a string of %20-style percent escapes is not Base64 and will be rejected rather than unescaped. For a JWT use decode_jwt, which splits the three segments and handles their base64url padding for you.
decode_jwtDecode a JWT's header and payload for inspection.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Decode a JWT's header and payload for inspection. Returns JSON { header, payload, signatureVerified, note, expiresAt, isExpired } — structured objects, not a rendered table. The signature is NEVER verified: that needs the issuer's key, which this service does not have, so signatureVerified is always false and the claims must be treated as untrusted, attacker-controllable input. Expiry is computed from the `exp` claim and is null when the token has none. Use decode_base64 for a bare Base64 string; this tool additionally splits the three segments and handles base64url padding.
encode_base64Encode UTF-8 text as standard Base64 (padded, A-Z a-z 0-9 + /), for embedding binary-unsafe content in JSON, data URIs, HTTP headers or Basic auth.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
Description, as the server wrote it Encode UTF-8 text as standard Base64 (padded, A-Z a-z 0-9 + /), for embedding binary-unsafe content in JSON, data URIs, HTTP headers or Basic auth. Returns JSON { encoded }. The output uses the standard alphabet, so it is NOT URL-safe: '+' and '/' must still be percent-escaped before they go in a query string or path segment, and this tool does not do that. It is an encoding, not encryption — anyone can reverse it with decode_base64. Runs locally, no size limit beyond the request body.
Only reads 1Claude Code: allow
format_jsonValidate and re-print a JSON string.No findings
Why it is in this group
- The description's first verb is "validate": a word for reading.
Description, as the server wrote it Validate and re-print a JSON string. Returns JSON { valid, formatted, minified } — the indented form and the whitespace-free form as plain strings, with no syntax highlighting or colour. Invalid JSON is rejected with the parser's own error message rather than returned as valid:false, so a successful call is proof the input parses. Round-tripping through the parser normalises the document: key order is kept but comments, trailing commas and duplicate keys are lost, and large integers lose precision.
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 1.0.0. Values in angle brackets are yours to fill in.
claude mcp add --transport http razi-dev https://www.razi.pro/api/mcp/devRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__razi-dev__format_json"
],
"ask": [
"mcp__razi-dev__encode_base64",
"mcp__razi-dev__decode_base64",
"mcp__razi-dev__decode_jwt",
"mcp__razi-dev__calculate_percentage"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as razi-dev. Review it before you use it.
