Toolkit MCP Server - install, status & alternatives [2026]

01 · Install Toolkit MCP Server

before you install - you'll need

Set MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL, TOOLKIT_ENABLE_NET_DIAGNOSTICS, TOOLKIT_ENABLE_SYSTEM_INFO before connecting.

Claude Code

claude mcp add cyanheads-toolkit-mcp-server --transport http https://toolkit.caseyjhand.com/mcp

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "cyanheads-toolkit-mcp-server": {
      "url": "https://toolkit.caseyjhand.com/mcp"
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

https://toolkit.caseyjhand.com/mcp

transport: streamable-http

endpoint alive - responded to MCP initialize · probed 2026-08-25

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions · remote - your agent's requests go to toolkit.caseyjhand.com

endpoint auth accepted our unauthenticated MCP initialize - no credentials needed to connect

license Apache-2.0 - declared in the repository

npm package @cyanheads/toolkit-mcp-server - published under the repo owner's npm scope (@cyanheads)

registry namespace io.github.cyanheads is GitHub-verified and matches the repo owner

03 · What Toolkit MCP Server can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can generate a cryptographic digest (sha256/sha512/sha1/md5), or constant-time-compare a value against an expected digest, resolve a public IP or hostname to geographic and network metadata - country, city, coordinates, ASN, timezone, and generate (lowercase-hex digest) or compare (timing-safe check via timingSafeEqual).

Capability map

Tools grouped from the project's README - what Toolkit MCP Server lets an agent do.

Toolkit

7 tools - e.g. Generate a cryptographic digest (sha256/sha512/sha1/md5), or constant-time-compare a value against an expected digest.; Mint cryptographically-random identifiers - UUIDv4, UUIDv7, or ULID - singly or in…

toolkit_hash_value · toolkit_generate_id · toolkit_generate_qr · toolkit_encode_value · toolkit_geolocate_ip · toolkit_check_network…

Operation

1 tool - e.g. generate (lowercase-hex digest) or compare (timing-safe check via timingSafeEqual)

operation

Algorithms

1 tool - e.g. sha256 (default) and sha512 for security; sha1 and md5 are exposed for checksum and file-integrity compatibility only - never for passwords or signatures

Algorithms

Type

1 tool - e.g. uuid_v4 (random, default), uuid_v7 (time-ordered, sortable by creation), or ulid (26-char Crockford base32, lexicographically sortable)

type

read & search

1 tool - e.g. minting changes nothing - but never idempotent, so a client won't cache or deduplicate a batch

Read-only

Format

1 tool - e.g. svg (inline markup), png_base64 (raster bytes with mimeType and byteLength), or terminal (Unicode block string)

format

Encoding

1 tool - e.g. base64, base64url (URL-safe alphabet), hex, or url (percent-encoding)

encoding

Ssrf

1 tool - e.g. the server calls the provider, never the target; the resolved IP is re-checked against private ranges, and private/reserved addresses are rejected (they have no

SSRF-free

Latest releases

v2.2.2 · 2026-08-22

Docker cross-compile fix · Dockerfile build stage runs on $BUILDPLATFORM instead of emulating, fixing the multi-arch GHCR publish that aborted under QEMU on 2.2.1 (no image reached GHCR) · Published image contents are…

v2.2.1 · 2026-08-22

mcp-ts-core 0.12.3 adoption and log-sink hardening · @cyanheads/mcp-ts-core ^0.11.5 → ^0.12.3, replacing the transitive @modelcontextprotocol/sdk ^1.30.0 with @modelcontextprotocol/server/client ^2.0.0. Ships…

v2.2.0 · 2026-08-18

Network diagnostics fixes and tool-definition hardening · Windows ping/traceroute now spawn correct binaries and flags, fixing a false unreachable report on a live host (#17) · check_network's public_ip mode no longer…

04 · Who maintains Toolkit MCP Server

toolkit-mcp-server is maintained by cyanheads. We track 125 MCP servers from cyanheads - 124 actively maintained, 1,730 combined GitHub stars, oldest repo from Dec 2024. Full record: all servers from cyanheads.

05 · Facts

repository: github.com/cyanheads/toolkit-mcp-server
category: finance - ranked #34 of 283 actively-maintained finance servers as of 2026-08-25.
release cadence: 6 releases in the last 90 days (latest 2026-08-22)
registry: io.github.cyanheads/toolkit-mcp-server (active, first published 2026-06-28 · 6 versions)
packages: npm:@cyanheads/toolkit-mcp-server · npm:@cyanheads/toolkit-mcp-server

06 · Toolkit MCP Server FAQ

Is Toolkit MCP Server still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-22 and it shipped 6 releases in the last 90 days. We re-verify nightly.

What can Toolkit MCP Server do?

With this server connected, an agent can generate a cryptographic digest (sha256/sha512/sha1/md5), or constant-time-compare a value against an expected digest, resolve a public IP or hostname to geographic and network metadata - country, city, coordinates, ASN, timezone, and generate (lowercase-hex digest) or compare (timing-safe check via timingSafeEqual).

How do I install Toolkit MCP Server?

Run `npx -y @cyanheads/toolkit-mcp-server`. The README documents 4 environment variables (MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL, TOOLKIT_ENABLE_NET_DIAGNOSTICS…) to set first. Set MCP_TRANSPORT_TYPE, MCP_LOG_LEVEL, TOOLKIT_ENABLE_NET_DIAGNOSTICS, TOOLKIT_ENABLE_SYSTEM_INFO before connecting. You can also paste the ready-made client config above.

Does Toolkit MCP Server require authentication?

No - the endpoint accepted our unauthenticated MCP initialize when probed on 2026-08-25; you can connect without credentials.

07 · Alternatives to Toolkit MCP Server

Alternatives to Toolkit MCP Server

Maintained finance servers if Toolkit MCP Server isn't the fit.

Pairs well with

Servers that cover what Toolkit MCP Server doesn't - only shown when the pairing reason fits the companion.

More finance MCP servers · Equibles · Yahoo Finance (danishashko) · Debridge MCP · Lucairn MCP Server · Fiscal Brasil (dehor-labs)

More TypeScript MCP servers · Treasury Fiscaldata MCP Server · Un Comtrade MCP Server · Usaspending MCP Server · Who Gho MCP Server · Wikidata MCP Server · see all