# freethetools

Free the Tools on your own computer: an MCP server and command line for AI assistants to compress, merge and split PDFs and do other file jobs without installing software. Your files stay on your computer.

- **Type:** MCP server
- **Trust:** 60/100 (B), scored on the package rubric
- **Verification:** community-indexed — nobody has claimed this listing
- **Version:** 0.1.2
- **Author:** Sapience Design
- **License:** AGPL-3.0-only
- **npm:** freethetools
- **Source:** https://github.com/sapience-design/freethetools
- **Compatible clients:** claude-code, cursor, copilot, gemini (basis: transport)

## Trust

60/100 (B), scored on the package rubric
- Publisher verified: no
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-10-15T21:24:25.296Z
- **Version scanned:** 0.1.2
- **CVEs:** none found by OSV at scan time

## Tools

17 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `base64_encode` — Encode text (as UTF-8) or a file as Base64, in standard or URL-safe form. Runs on this device; nothing is uploaded.
- `generate_hash` — Hash text (as UTF-8) or a file with SHA-256, SHA-512, SHA-384, SHA-1 or MD5, as lowercase hex. Use it to check a download against a published checksum. MD5 and 
- `decode_jwt` — Decode a JSON Web Token: header, payload, the standard claims in plain words (including whether it has expired), and, given the shared secret, whether an HS256/
- `generate_password` — Make random passwords or passphrases from a secure random source, with an honest strength estimate in bits. Note: a password made this way passes through the AI
- `test_regex` — Run a JavaScript regular expression over text and list every match with its position, numbered groups and named groups. Stops after a limit so a runaway pattern
- `url_encode` — Percent-encode text for use in a web address (encodeURIComponent or encodeURI). Runs on this device; nothing is uploaded.
- `url_decode` — Decode percent-encoded text (decodeURIComponent or decodeURI). A broken % sequence gives a plain error. Runs on this device; nothing is uploaded.
- `generate_uuids` — Make UUIDs (RFC 9562) from a secure random source: random v4, or time-ordered v7, which sorts by creation time and suits database keys. Runs on this device; not
- `convert_colour` — Read a colour written as HEX (#f80, #ff8800, #ff880080), rgb()/rgba(), hsl()/hsla() or a CSS colour name, and return it as HEX, RGB and HSL with the nearest CSS
- `convert_time_zone` — Convert a local date and time in one time zone to other time zones, with daylight saving applied exactly from the time zone database, and flag times outside wor
- `convert_units`
- `convert_unix_timestamp` — Convert a Unix timestamp to a date, or a date to a Unix timestamp. A number is read as a timestamp (seconds, milliseconds or microseconds, guessed from its leng
- `list_pdf_form_fields` — List the fillable fields in a PDF form: name, type (text, checkbox, dropdown, radio, list), current value, choices and whether it is read-only. Call this before
- `convert_case` — Change the case of text: upper, lower, sentence, title, camel (camelCase), pascal (PascalCase), snake (snake_case), kebab (kebab-case) or constant (CONSTANT_CAS
- `compare_texts` — Compare two texts and show what changed, line by line or word by word, with counts of added and removed lines or words. Runs on this device; nothing is uploaded
- `count_words` — Count words, characters (as people see them, emoji included), sentences and paragraphs, with reading and speaking time. Counts Chinese, Japanese and Thai words 
- `freethetools`

## Install

**Verdict: review** — Installable, but 1 thing to check first: No publisher has proved control of this listing; it is indexed, not vouched for.
**Cautions** (coverage gaps and advisories — never blocking)
- No publisher has proved control of this listing; it is indexed, not vouched for.
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"freethetools\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"freethetools\"\n      ]\n    }\n  }\n}"
```

## Blast radius

Contained to moderate — no credential declaration found, from the publisher, the upstream registry, or the README. Known so far: runs on your machine; read-only tool surface.
- Floor 13, ceiling 31 (tier: unknown)
- `unknown` means the floor and ceiling land in different bands — not measured enough to name one. It does not mean low.
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/freethetools
- Install plan: https://forgeregistry.com/api/v1/packages/freethetools/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/freethetools
- HTML page: https://forgeregistry.com/registry/freethetools
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.