Skip to content

Razi Dev Utilities

by razikallayi · remote · no sign-in to list tools · v1.0.0 · published by GitHub user razikallayi

Developer utilities over MCP: Base64 encode and decode, decode JWTs, format JSON, do percentages.

Changes · 4

5 tools: 4 change things and 1 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http razi-dev https://www.razi.pro/api/mcp/dev

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

5 tools

Changes things 4Claude Code: ask
  • calculate_percentageRun one of four percentage calculations on two numbers.No findings

    Why it is in this group

    • The description's first verb is "run": a word for a change.
    Description, as the server wrote it
    Run one of four percentage calculations on two numbers. Returns JSON { operation, result } (plus unit: 'percent' for the 'change' operation). The meaning of value1 and value2 depends on the operation, so read their descriptions before calling. Exact arithmetic, no model involved, no rounding applied. Ratios and general expressions are not supported.
  • decode_base64Decode a Base64 string back to UTF-8 text.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Decode a Base64 string back to UTF-8 text. Returns JSON { decoded }. Input is verified by re-encoding, so anything that is not genuine Base64 is rejected with an error instead of returning plausible garbage; binary payloads that are not valid UTF-8 will also fail. It handles Base64 and nothing else: a string of %20-style percent escapes is not Base64 and will be rejected rather than unescaped. For a JWT use decode_jwt, which splits the three segments and handles their base64url padding for you.
  • decode_jwtDecode a JWT's header and payload for inspection.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Decode a JWT's header and payload for inspection. Returns JSON { header, payload, signatureVerified, note, expiresAt, isExpired } — structured objects, not a rendered table. The signature is NEVER verified: that needs the issuer's key, which this service does not have, so signatureVerified is always false and the claims must be treated as untrusted, attacker-controllable input. Expiry is computed from the `exp` claim and is null when the token has none. Use decode_base64 for a bare Base64 string; this tool additionally splits the three segments and handles base64url padding.
  • encode_base64Encode UTF-8 text as standard Base64 (padded, A-Z a-z 0-9 + /), for embedding binary-unsafe content in JSON, data URIs, HTTP headers or Basic auth.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Encode UTF-8 text as standard Base64 (padded, A-Z a-z 0-9 + /), for embedding binary-unsafe content in JSON, data URIs, HTTP headers or Basic auth. Returns JSON { encoded }. The output uses the standard alphabet, so it is NOT URL-safe: '+' and '/' must still be percent-escaped before they go in a query string or path segment, and this tool does not do that. It is an encoding, not encryption — anyone can reverse it with decode_base64. Runs locally, no size limit beyond the request body.
Only reads 1Claude Code: allow
  • format_jsonValidate and re-print a JSON string.No findings

    Why it is in this group

    • The description's first verb is "validate": a word for reading.
    Description, as the server wrote it
    Validate and re-print a JSON string. Returns JSON { valid, formatted, minified } — the indented form and the whitespace-free form as plain strings, with no syntax highlighting or colour. Invalid JSON is rejected with the parser's own error message rather than returned as valid:false, so a successful call is proof the input parses. Round-tripping through the parser normalises the document: key order is kept but comments, trailing commas and duplicate keys are lost, and large integers lose precision.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http razi-dev https://www.razi.pro/api/mcp/dev

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__razi-dev__format_json"
    ],
    "ask": [
      "mcp__razi-dev__encode_base64",
      "mcp__razi-dev__decode_base64",
      "mcp__razi-dev__decode_jwt",
      "mcp__razi-dev__calculate_percentage"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as razi-dev. Review it before you use it.