Developer Documentation
How to reach Dev Tools ! from outside the browser — a REST API and an MCP server for AI assistants, both live in preview, plus the CLI, editor extensions, and core SDK we are still building.
What ships today
This page documents two surfaces that exist and several that do not yet. So it is unambiguous which is which:
| Surface | Status | Notes |
|---|---|---|
| REST API | Preview | Running in the Cosyslabs shared backend. Access is granted per-request while we finish rollout. |
| MCP server | Preview | Remote Streamable HTTP endpoint, 9 tools, no key required. |
| npm CLI | In development | Source is written; nothing published to npm yet. |
| VS Code extension | In development | Not on the VS Code Marketplace or Open VSX yet. |
| Core SDK | In development | Package source exists in the monorepo; not published. |
The API host is not open to the public yet. Tell us what you want to build and we will confirm whether we can enable it for you today.
REST API
The REST API publishes a curated catalog of 57 tools and runs 13 of them server-side; the rest are browser-only by design and the catalog says which is which. All endpoints return JSON.
Base URL
https://api.devtoolzy.com/devtoolzy/apiEndpoints
/devtoolzy/api/toolsTool catalog — slug, name, category, description, and a serverSide flag for each of the 57 entries.
/devtoolzy/api/tools.jsonAlias of GET /tools, for clients that expect a .json suffix. Same response.
/devtoolzy/api/tools/:slug/runExecute one of the 13 server-side tools. Returns 501 for a browser-only tool and 404 for an unknown slug.
/devtoolzy/api/flagsFeature flags: backendEnabled, paidEnabled, aiEnabled.
/devtoolzy/api/healthLiveness probe for the devtoolzy backend slice — reports database and LLM provider status.
/devtoolzy/api/chat🔑 Key requiredAlex AI chat — sends a message list to the LLM provider chain and returns the reply in one response.
/devtoolzy/api/contact🔑 Key requiredContact form submission. Turnstile token required when the server has a secret configured.
/devtoolzy/api/subscribe🔑 Key requiredNewsletter subscribe (double opt-in). Takes email + app_id.
Example: Run a tool
curl -X POST https://api.devtoolzy.com/devtoolzy/api/tools/uuid-generator/run \
-H "Content-Type: application/json" \
-d '{"version": "v7", "count": 3}'{
"ok": true,
"slug": "uuid-generator",
"result": [
"0192f4d0-e2c1-7000-8f0a-3c9b2e4a6d1e",
"0192f4d0-e2c2-7000-9a1b-4d0c3f5b7e2f",
"0192f4d0-e2c3-7000-ab2c-5e1d4060bf30"
],
"type": "uuid-v7",
"count": 3
}Example: List tools
curl https://api.devtoolzy.com/devtoolzy/api/tools{
"tools": [
{
"slug": "uuid-generator",
"name": "UUID Generator",
"category": "generators",
"description": "Generate UUID v4 (random) or v7 (time-ordered) identifiers.",
"serverSide": true
}
// ... 56 more tools
],
"count": 57,
"categories": ["encoders", "formatters", "crypto", "generators", "network", "datetime", "text", "design"],
"mcp": "https://api.devtoolzy.com/devtoolzy/mcp",
"docs": "https://devtoolzy.com/mcp"
}Authentication
The catalog, tool-run, flags, and health endpoints are open — no key. The three endpoints that reach a person or an LLM on our side (/chat, /contact, /subscribe) require an API key and reject a request without one with 401.
Passing the API Key
curl -X POST https://api.devtoolzy.com/devtoolzy/api/chat \
-H "X-Api-Key: YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"messages": [{"role": "user", "content": "What is a UUID v7?"}]}'Keys are issued case by case while the API is in preview. Contact us with your use case and expected request volume.
MCP Server
The Model Context Protocol (MCP) server exposes nine Dev Tools ! functions as typed tool calls to any MCP-compatible AI client: Claude Desktop, Cursor, Cline, Zed, and more. It is a remote server over Streamable HTTP — there is no package to install and no key to pass.
Connection
// Claude Desktop — ~/Library/Application\ Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"devtoolzy": {
"url": "https://api.devtoolzy.com/devtoolzy/mcp",
"transport": "streamable-http"
}
}
}Available MCP tools
| Tool name | Input | Description |
|---|---|---|
base64_transform | text, mode, url_safe? | Encode or decode Base64 — standard or URL-safe alphabet |
format_data | text, from_format, to_format?, action?, indent? | Pretty-print, minify, or convert between JSON, YAML, and XML |
hash_text | text, algorithm, key?, encoding? | MD5/SHA-1/SHA-256/SHA-384/SHA-512 digest, or HMAC when a key is given |
decode_jwt | token | Decode JWT header and payload with expiry status (no verification) |
generate_id | id_type, count? | Generate UUID v4/v7, ULID, or NanoID — up to 100 at once |
regex_test | pattern, text, flags?, replacement? | Match positions and named groups, with optional substitution |
unix_timestamp | value? | Convert epoch (s or ms, auto-detected) to/from ISO 8601 UTC |
cron_explain | expression | Explain a 5-field cron in plain English plus the next three runs (UTC) |
cidr_info | cidr | Network address, broadcast, masks, and host range for an IPv4 CIDR block |
npm CLI
The CLI is written and lives in the Dev Tools ! monorepo, but it is not on npm yet, so the commands below do not resolve today. When it ships the package name will be @cosyslabs/devtoolzy, providing a devtoolzy binary.
Planned usage
Commands are positional — devtoolzy <command> [subcommand] [input] [flags] — and every text command also reads stdin.
devtoolzy base64 encode "Hello, World!"
devtoolzy base64 decode SGVsbG8sIFdvcmxkIQ==
devtoolzy hash sha256 "hello"
devtoolzy hmac sha256 my-secret "hello"
devtoolzy jwt decode eyJhbGciOiJSUzI1NiJ9...
devtoolzy uuid v4
devtoolzy uuid v7 --count 5
devtoolzy ulid --count 3
devtoolzy format json --indent 2 < data.json
devtoolzy regex test --pattern "\d+" --text "abc 123"
devtoolzy timestamp now
devtoolzy timestamp to-date 1751400060
devtoolzy case kebab "Hello World"
cat file.txt | devtoolzy base64 encodePlanned install
# Once published:
npm install -g @cosyslabs/devtoolzy
devtoolzy --help
# Or without installing:
npx @cosyslabs/devtoolzy uuid v7 --count 5Want to know the moment it lands? Subscribe with the newsletter form in the footer, or ask us and we will follow up directly.
VS Code Extension
The extension is not on the VS Code Marketplace or Open VSX yet, so there is nothing to install today. Its identifier when published will be cosyslabs.devtoolzy-vscode.
The plan is to bring the tool palette into the editor: run tools from the command palette (Ctrl/Cmd + Shift + P), from a sidebar panel, or from the context menu on a selection.
Planned features
- Tools accessible from the command palette
- Right-click selection → encode/decode/hash/format
- Sidebar panel with categories and search
- Output sent to a new editor tab or replaced inline
- Settings: preferred hash algorithm, UUID version, output format
Subscribe with the newsletter form in the footer to hear when it ships, or tell us what you need from it while it is still being designed.
SDK & Integrations
@cosyslabs/devtoolzy-core holds the shared tool functions used by the web app, CLI, and extensions. The source lives in the monorepo; the package is not on npm yet, so npm install will not find it today. There is no Python package, planned or otherwise.
JavaScript / TypeScript — planned API
Every function takes an input object and resolves to { result, error? }, so the same call shape works for a CLI argument, an HTTP body, or an MCP tool call.
import { base64, hash, jwtDecode, generateUuid } from '@cosyslabs/devtoolzy-core';
// Base64
const { result: encoded } = await base64({ text: 'Hello, World!', mode: 'encode' });
const { result: decoded } = await base64({ text: encoded, mode: 'decode' });
// Hashing
const { result: digest } = await hash({ text: 'Hello, World!', algorithm: 'SHA-256' });
// UUID
const { result: id } = await generateUuid({ version: 'v7', count: 1 });
// JWT — decode only, no signature verification
const { result: claims } = await jwtDecode({ token });Rate Limits
Every endpoint that costs us something — tool runs, chat, contact, subscribe — is rate-limited per client IP. Exceed a limit and the API returns 429 Too Many Requests with a plain-language message in the detail field.
We are not publishing per-endpoint numbers while the API is in preview: the limits are deployment configuration and would go stale here the first time we tune them. Assume a modest per-minute allowance, back off on a 429, and talk to us before building anything that needs sustained throughput.
Published tiers, per-day quotas, and X-RateLimit-* response headers are on the roadmap for general availability. None of them exist today — do not write a client that depends on reading those headers.
Errors
Errors come back with the HTTP status below and a detail string explaining what went wrong:
{
"detail": "'color-picker' runs entirely in the browser. Use https://devtoolzy.com/tools/design/color-picker instead."
}| HTTP status | Meaning | When |
|---|---|---|
401 | Unauthorized | API key missing or invalid on /chat, /contact, or /subscribe |
404 | Not found | Unknown tool slug |
422 | Unprocessable | Input rejected by the tool — bad JSON, unsupported algorithm, malformed JWT |
429 | Rate limited | Too many requests from this IP |
501 | Not implemented | Tool runs only in the browser — the response names the web URL to use instead |
500 | Internal error | Unexpected server error — safe to retry |