MCP.Market

Toolars MCP server

by aixtral·io.github.aixtral/toolars·v0.1.1
No reviews yet

Local-first dev utilities: hash, base64, JWT, UUID, cron, URL codec. No network or telemetry.

A89/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A89/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Toolars yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Toolars tools (11)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • toolars_base64_decode

    Decode Base64 text (standard or URL-safe alphabet) as UTF-8, identical to the Toolars base64-encoder-decoder web tool. …

  • toolars_base64_encode

    Encode UTF-8 text as Base64 (standard or URL-safe alphabet), identical to the Toolars base64-encoder-decoder web tool. …

  • toolars_cron_explain

    Explain a 5-field cron expression and list the next scheduled runs, identical to the Toolars cron-builder-explainer web tool. …

  • toolars_hash

    Compute the hex digest of UTF-8 text with any algorithm the Toolars hash-checker tools ship (md5, sha1, sha224, sha256, sha384, sha512). Defaults to sha256. Identical to the corresponding Toolars *-hash-checker web tools. MD5 and SHA-1 are integrity-only legacy digests, never signatures. …

  • toolars_hash_sha256

    Compute a SHA-256 hex digest. Compatibility alias for toolars_hash with algorithm sha256. …

  • toolars_jwt_decode

    Parse a JWT (header, payload, time-claim report) WITHOUT verifying the signature. Never trust the claims; verification is intentionally not offered. …

  • toolars_timestamp_convert

    Convert a Unix timestamp (seconds/milliseconds), ISO 8601, RFC 2822, or wall time into all common representations, identical to the Toolars timestamp-time-zone-converter web tool. …

  • toolars_ulid_generate

    Generate ULIDs (timestamp-ordered identifiers), identical to the Toolars uuid-ulid-generator web tool. …

  • toolars_url_decode

    Decode percent-encoded text (decodeURIComponent or decodeURI semantics), identical to the Toolars url-encoder-decoder web tool. …

  • toolars_url_encode

    Percent-encode text (encodeURIComponent or encodeURI semantics), identical to the Toolars url-encoder-decoder web tool. …

  • toolars_uuid_generate

    Generate random RFC 9562 UUIDs (version 4 or 7), identical to the Toolars uuid-ulid-generator web tool. …

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan3 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 0 days ago15/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 89/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Toolars compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
89/100
higher than 80% of 48,255 servers
Tools
11
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break

What its tools let an agent do: 11 read

Install Toolars in Claude Code, Cursor or VS Code

Runs npx -y @toolars/cli on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add toolars -- npx -y @toolars/cli
Add to Cursor

What the publisher says

From the Toolars repository's README, as published. We do not edit it. Read it on GitHub

Toolars open-source distribution

This directory is the source of truth for the code Toolars publishes publicly. It is assembled into a distributable tree by scripts/export-open-source.mjs in the private repository; nothing here is built or bundled into the website.

Continuous verification

Every push and every day at 03:17 UTC, the Privacy proof workflow rebuilds both packages from this tree alone, re-runs their test vectors, and re-captures the privacy-proof receipt against the live site. The badge is green only when the latest receipt's outcome is verified.

A failed run is not automatically a privacy finding. The harness distinguishes two outcomes: violation means a measured request crossed the local-processing boundary (the workflow fails on the first attempt, without retrying); inconclusive means the run could not be completed — usually a network problem between the runner and the site — and says nothing about the site in either direction. Inconclusive runs are retried; a persistent one fails the job with an explicit notice. Read the run log before reading anything into a red badge.

What is published

All of it is MIT-licensed (see LICENSE). THIRD-PARTY.md states the exact scope and lists third-party components.

What is deliberately not published

This is an open-core distribution, not the whole product. Not included:

13 localized content sets);

  • the website application (routing, SEO layer, catalog, editorial content, the

form — with one deliberate exception: packages//vendor/ carries the site runner cores these two packages import (15 files for the CLI, 2 for local-tools), because without them the packages could not be rebuilt or re-tested here. The packages/cli bundle also inlines compiled copies of the same cores, since it is the artifact prepared for a future @toolars/cli npm release. Both are covered by this repository's MIT license;

  • the tool implementations and Web Workers that the website ships, **in source
  • runtime assets (WASM engines, OCR language packs, fonts, PDF.js);
  • internal engineering, product, and audit documentation;
  • any deployment configuration, credentials, or analytics configuration.

That boundary is the point: the harness verifies the deployed site, so independent verification does not require the site's source. See evidence-harness/README.md for exactly what the harness does and does not prove.

Verifying the local-processing claim yourself

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Toolars: common questions

Is Toolars MCP server safe?
Yes, by our scan: it is graded A (89/100). Read the Toolars safety report
How do I install Toolars?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Toolars need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Toolars maintained?
The last commit was 39 days ago (2026-09-26). The latest release is v0.1.1.
What can I use instead of Toolars?
Servers from other publishers that do the same job: Claude Flow MCP server.
How does Toolars compare with other MCP servers?
safety score 89/100 (higher than 80% of 48,255 servers); tools 11 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Toolars

Same job from other publishers: the closest match first, then the best rated.

  • Claude Flow
    AI orchestration with hive-mind swarms, neural networks, and 87 MCP tools for enterprise dev.
    B