Free the Tools on your own computer: an MCP server and command line for AI assistants to compress, merge and split PDFs and do other file jobs without installing software. Your files stay on your computer.
Inferred from the transports this listing declares (stdio). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
base64_encodeEncode text (as UTF-8) or a file as Base64, in standard or URL-safe form. Runs on this device; nothing is uploaded.Encode text (as UTF-8) or a file as Base64, in standard or URL-safe form. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
generate_hashHash text (as UTF-8) or a file with SHA-256, SHA-512, SHA-384, SHA-1 or MD5, as lowercase hex. Use it to check a download against a published checksum. MD5 and SHA-1 are not safe for passwords or signatures. Runs on this device; nothing is uploaded.Hash text (as UTF-8) or a file with SHA-256, SHA-512, SHA-384, SHA-1 or MD5, as lowercase hex. Use it to check a download against a published checksum. MD5 and SHA-1 are not safe for passwords or signatures. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
decode_jwtDecode a JSON Web Token: header, payload, the standard claims in plain words (including whether it has expired), and, given the shared secret, whether an HS256/384/512 signature is valid. Runs on this device; nothing is uploaded.Decode a JSON Web Token: header, payload, the standard claims in plain words (including whether it has expired), and, given the shared secret, whether an HS256/384/512 signature is valid. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
generate_passwordMake random passwords or passphrases from a secure random source, with an honest strength estimate in bits. Note: a password made this way passes through the AI conversation; for a secret only the user should see, send them to https://freethetools.com/developer/password-generator/ instead. Runs on…Make random passwords or passphrases from a secure random source, with an honest strength estimate in bits. Note: a password made this way passes through the AI conversation; for a secret only the user should see, send them to https://freethetools.com/developer/password-generator/ instead. Runs on…
No input schema was published for this tool.
test_regexRun a JavaScript regular expression over text and list every match with its position, numbered groups and named groups. Stops after a limit so a runaway pattern can't flood the answer. Runs on this device; nothing is uploaded.Run a JavaScript regular expression over text and list every match with its position, numbered groups and named groups. Stops after a limit so a runaway pattern can't flood the answer. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
url_encodePercent-encode text for use in a web address (encodeURIComponent or encodeURI). Runs on this device; nothing is uploaded.Percent-encode text for use in a web address (encodeURIComponent or encodeURI). Runs on this device; nothing is uploaded.
No input schema was published for this tool.
url_decodeDecode percent-encoded text (decodeURIComponent or decodeURI). A broken % sequence gives a plain error. Runs on this device; nothing is uploaded.Decode percent-encoded text (decodeURIComponent or decodeURI). A broken % sequence gives a plain error. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
generate_uuidsMake UUIDs (RFC 9562) from a secure random source: random v4, or time-ordered v7, which sorts by creation time and suits database keys. Runs on this device; nothing is uploaded.Make UUIDs (RFC 9562) from a secure random source: random v4, or time-ordered v7, which sorts by creation time and suits database keys. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
convert_colourRead a colour written as HEX (#f80, #ff8800, #ff880080), rgb()/rgba(), hsl()/hsla() or a CSS colour name, and return it as HEX, RGB and HSL with the nearest CSS colour name and the WCAG contrast ratio against white and black (pass or fail for normal and large text). Runs on this device; nothing is…Read a colour written as HEX (#f80, #ff8800, #ff880080), rgb()/rgba(), hsl()/hsla() or a CSS colour name, and return it as HEX, RGB and HSL with the nearest CSS colour name and the WCAG contrast ratio against white and black (pass or fail for normal and large text). Runs on this device; nothing is…
No input schema was published for this tool.
convert_time_zoneConvert a local date and time in one time zone to other time zones, with daylight saving applied exactly from the time zone database, and flag times outside working hours (08-18). Runs on this device; nothing is uploaded.Convert a local date and time in one time zone to other time zones, with daylight saving applied exactly from the time zone database, and flag times outside working hours (08-18). Runs on this device; nothing is uploaded.
No input schema was published for this tool.
convert_unitsNo description publishedThis tool published no description. Forge does not invent one.
convert_unix_timestampConvert a Unix timestamp to a date, or a date to a Unix timestamp. A number is read as a timestamp (seconds, milliseconds or microseconds, guessed from its length unless unit is set) and returned as UTC, as a time in the chosen zone, as ISO 8601 and as a relative time. A date such as 2023-11-14T22:…Convert a Unix timestamp to a date, or a date to a Unix timestamp. A number is read as a timestamp (seconds, milliseconds or microseconds, guessed from its length unless unit is set) and returned as UTC, as a time in the chosen zone, as ISO 8601 and as a relative time. A date such as 2023-11-14T22:…
No input schema was published for this tool.
list_pdf_form_fieldsList the fillable fields in a PDF form: name, type (text, checkbox, dropdown, radio, list), current value, choices and whether it is read-only. Call this before fill_pdf_form. Runs on this device; nothing is uploaded.List the fillable fields in a PDF form: name, type (text, checkbox, dropdown, radio, list), current value, choices and whether it is read-only. Call this before fill_pdf_form. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
convert_caseChange the case of text: upper, lower, sentence, title, camel (camelCase), pascal (PascalCase), snake (snake_case), kebab (kebab-case) or constant (CONSTANT_CASE). Runs on this device; nothing is uploaded.Change the case of text: upper, lower, sentence, title, camel (camelCase), pascal (PascalCase), snake (snake_case), kebab (kebab-case) or constant (CONSTANT_CASE). Runs on this device; nothing is uploaded.
No input schema was published for this tool.
compare_textsCompare two texts and show what changed, line by line or word by word, with counts of added and removed lines or words. Runs on this device; nothing is uploaded.Compare two texts and show what changed, line by line or word by word, with counts of added and removed lines or words. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
count_wordsCount words, characters (as people see them, emoji included), sentences and paragraphs, with reading and speaking time. Counts Chinese, Japanese and Thai words correctly. Runs on this device; nothing is uploaded.Count words, characters (as people see them, emoji included), sentences and paragraphs, with reading and speaking time. Counts Chinese, Japanese and Thai words correctly. Runs on this device; nothing is uploaded.
No input schema was published for this tool.
freethetoolsNo description publishedThis tool published no description. Forge does not invent one.
15 of 17 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Free the Tools on your own computer: an MCP server and command line for AI assistants to compress, merge and split PDFs and do other file jobs without installing software. Your files stay on your computer.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
The crawl stopped at the depth-4 limit. Anything below that level was never resolved.
The crawl stopped at the 60-package limit. The rest of the tree was never resolved.
36 more resolved packages are not drawn here (display cap: 24). Every dependency carrying an advisory is drawn regardless of the cap. Full inventory (CycloneDX SBOM)
54 declared dependencies never landed in the tree. They are missing from Forge's resolution, not from the package.
+42 more not listed. The counts by reason above cover all of them.
Not followed: peerDependencies. This tree covers runtime dependencies only, so anything those pull in was never resolved.