
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
yaktool-mcp
Advanced tools
73 precision tools for product data and business documents, as a local MCP server. GTIN/EAN/UPC, Google Shopping feeds, Shopify CSV, safe CSV⇄XLSX conversion, Digital Link QR, GS1, ISBN, VIN, IMEI, IBAN, Peppol, XRechnung and more. Deterministic, rule-doc
73 precision tools for product data and business documents, as a local MCP server.
Agents keep rewriting the same ad-hoc validators — a quick GTIN check here, a feed sanity script there. Each one covers the common case and misses the edge cases. This server is the honed version: the same rule engine that powers yaktool.com, with every check numbered, severity-graded and backed by an official source (GS1, Google, Shopify, EU/Peppol…).
{ findings[{ruleId, severity, message, fix?, sourceUrl?}], … }, not prosevalues[] (up to 1000) to audit a whole column in one callImage processing (local PNG/JPEG compression with WebP/AVIF output) lives in the sibling package yaktool-image-mcp — the packages are split by domain so this suite stays a fast, codec-free install.
Claude Code
claude mcp add yaktool -- npx -y yaktool-mcp
Claude Desktop — add to claude_desktop_config.json:
{
"mcpServers": {
"yaktool": { "command": "npx", "args": ["-y", "yaktool-mcp"] }
}
}
Cursor / other MCP clients — any stdio-capable client works with command npx -y yaktool-mcp.
Requires Node.js ≥ 20.
Product identifiers — validate_gtin, calculate_check_digit, convert_gtin, convert_upc_e, interpret_eight_digit_barcode, validate_isbn, validate_vin, validate_imei, validate_container_number, validate_awb, validate_gs1_key, validate_media_codes, validate_regulated_codes, parse_gs1_element_string, check_gs1_digital_link, build_gs1_digital_link, generate_digital_link_qr (Sunrise-2027-ready QR, validated before it is drawn), generate_barcode_modules
Feeds & catalogs — validate_google_feed, validate_shopify_csv, validate_marketplace_feed, convert_feed, repair_feed, diff_product_feeds, audit_column, detect_csv_dialect, diagnose_excel_damage, convert_csv_to_xlsx, convert_xlsx_to_csv (identifier-protecting spreadsheet conversion — leading zeros and long codes survive, nothing is reinterpreted silently)
Listing content — lint_listing_title, lint_bullet_points, analyze_amazon_search_terms, check_description_html, generate_slug, check_product_jsonld, build_product_jsonld, check_open_graph, detect_invisible_characters, detect_mixed_script, fix_mojibake
Media & imagery — check_main_image, check_image_metadata, audit_media_specs, check_colour_space
Formats & locale — check_number_format, check_date_format, check_country_code, check_postcode, check_hreflang, convert_units, check_utm, build_utm_url, convert_shoe_size, explain_apparel_sizing, check_textile_label
Logistics & compliance — identify_tracking_carrier, calculate_dim_weight, check_lithium_battery, lookup_un_number, check_incoterm, check_hs_code, check_origin_declaration, check_supplier_declaration, check_compliance_statement, check_email_template
E-invoicing & finance — check_peppol_invoice, check_xrechnung, identify_einvoice, validate_iban, validate_tax_ids, check_invoice_sequence, check_creditor_reference, check_lei
Tools that need a heavy engine — or that belong to a domain of their own — ship as separate packages, so this one stays a zero-dependency, instant-start install:
yaktool-image-mcp — compress_image
(smart or true-lossless PNG/JPEG, WebP/AVIF output)yaktool-pdf-mcp — merge, split, compress,
unlock and reorganise PDFs, structure diagnosis firstyaktool-labels-mcp — FNSKU and logistic
labels, ZPL renderingyaktool-store-mcp — WooCommerce import
forecast, Shopify → WooCommerce migrationyaktool-compliance-mcp — GPSR
listings, EUDR plot geolocation, FDA nutrition rounding, EU fragrance allergen thresholdsyaktool-gs1-mcp — GS1 element strings,
GS1 DataMatrix, the eight GS1 keys beyond GTINyaktool-invoice-mcp — EN 16931
mandatory fields and the four invoice code listsFull catalog with rule lists: yaktool.com/mcp
Tools return machine-readable results (structuredContent plus a JSON text block for older clients). valid means no error-level findings — warnings (e.g. in-store barcode ranges, placeholder values) are reported but do not fail the check. Pass raw values as found in the source data; input cleaning is part of what gets validated.
MIT © yaktool.com
FAQs
73 precision tools for product data and business documents, as a local MCP server. GTIN/EAN/UPC, Google Shopping feeds, Shopify CSV, safe CSV⇄XLSX conversion, Digital Link QR, GS1, ISBN, VIN, IMEI, IBAN, Peppol, XRechnung and more. Deterministic, rule-doc
The npm package yaktool-mcp receives a total of 79 weekly downloads. As such, yaktool-mcp popularity was classified as not popular.
We found that yaktool-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.