Stop Pasting Secrets to Websites: How mcp-devutils Secures Your API Debugging

The Setup: 2 Minutes to Local Tool Access

MCP (Model Context Protocol) is the open standard that lets Claude Code call tools on your machine. The mcp-devutils package provides 44 common developer utilities—JWT decoding, timestamp conversion, HMAC generation, JSON diffing—that run locally via npx. Your data never leaves your machine.

To install with Claude Code, add this to your MCP configuration:

{
  "mcpServers": {
    "devutils": {
      "command": "npx",
      "args": ["-y", "mcp-devutils"]
    }
  }
}

Restart Claude Code. The tools are now available in your chat interface.

The Workflow: Debug a Webhook Without Leaving Your Editor

Step 1: Decode JWTs Securely

Instead of pasting sensitive tokens into jwt.io, paste directly into Claude Code:

Decode this JWT: eyJhbGciOiJIUzI1NiIs...

The jwt_decode tool shows header and payload instantly. No browser tab, no third-party exposure.

Step 2: Convert Timestamps in Context

When a JWT has "exp": 1711382400, ask:

Convert this timestamp: 1711382400

The timestamp tool returns 2024-03-25T16:00:00Z and tells you it's expired. Immediate context without switching apps.

Step 3: Verify HMAC Signatures Locally

Compute signatures without online tools:

Generate HMAC-SHA256 of this payload with key 'webhook_secret_123': {"event":"payment.completed"...}

The hmac tool runs locally. Compare with the X-Signature header directly in chat.

Step 4: Diff JSON Without Eyeballing

When payloads don't match documentation:

Diff these two JSON objects: [expected] vs [actual]

The json_diff tool (Pro feature) shows exact changes—field renames, nested additions—in seconds.

Step 5: Format SQL from Logs

Clean up messy one-liner queries:

Format this SQL: SELECT p.id, p.amount, u.email FROM payments p JOIN users u ON p.user_id = u.id WHERE p.webhook_id = 'wh_abc123' AND p.status = 'completed'

sql_format returns properly indented SQL ready for your database client.

The Full Toolkit: 44 Utilities at Your Fingertips

Always Free (15 tools):

• jwt_decode — Decode JWT tokens
• hash — MD5/SHA1/SHA256 hashing
• hmac — HMAC signature generation
• timestamp — Unix/ISO timestamp conversion
• base64 — Encode/decode
• json_format — Pretty-print or minify
• uuid — Generate UUIDs
• url_encode — URL encode/decode
• regex_test — Test patterns with match details
• cron_explain — Understand cron schedules

Pro ($5 one-time unlock, 29 tools):

• json_diff — Compare JSON objects
• jwt_create — Create test JWTs
• sql_format — Format SQL queries
• csv_json — Convert between CSV and JSON
• string_escape — Escape for JSON/SQL/shell

Try it: npx mcp-devutils gives you 15 free tools forever, plus 3 free trials of each Pro tool.

Why This Changes Claude Code Workflows

Security First: Every JWT, API key, or secret hash stays on your machine. No more "hoping I wasn't leaking secrets to a third party" when using online tools.

Flow Preservation: Instead of context-switching to browser tabs, you describe the problem in plain English. Claude Code orchestrates the tools based on your request.

Integration Depth: This follows Claude Code's March 2024 dashboard reveal showing 14.8M+ commits tracked—developers are adopting agentic workflows at scale. MCP integration is how Claude Code moves beyond simple code generation to becoming a true engineering assistant.

Try It Today

1. Install: Add the config above to your Claude Code MCP settings
2. Restart: Reload Claude Code
3. Test: Ask "What tools do you have available?" to see the full list
4. Debug: Next time you're working with APIs, try the workflow above

The setup takes 2 minutes. The security and workflow benefits are immediate.