cron-schedule-audit-mcp

An MCP server that validates cron expressions and computes DST-correct next-fire times using the real IANA timezone database — no moment-timezone or luxon dependency, just a hand-rolled fake-UTC-offset technique against the platform's own tz data.

The bug this catches

A cron job scheduled at 30 2 * * * (2:30am daily) in America/New_York silently never fires on the spring-forward date, because 2:00-2:59am doesn't exist that day. A job at 30 1 * * * (1:30am) fires twice on the fall-back date, because that hour is repeated. Neither failure throws an error or shows up in logs — it just looks like a flaky cron that "sometimes doesn't run." Verified against real 2026/2027 transition dates during testing (spring-forward 2027-03-14, fall-back 2026-11-01).

Also flags the day-of-month/day-of-week footgun almost everyone hits once: POSIX cron treats both fields as OR, not AND, when both are restricted.

Tools

validate_cron_expression

Syntax + semantic validation: OR-not-AND warning, every-minute footgun, day-of-month values some months don't have (31, 30, 29), a nudge to check DST risk for anything in the 1-3am window. Returns a plain-English explanation of what the expression means.

get_next_fire_times

Next N fire times, DST-aware. If a scheduled local time falls in a spring-forward gap it's flagged as skipped; if it falls in a fall-back overlap, both real firings are returned as ambiguous.

detect_dst_risk

Scans a full year ahead and reports every date where the schedule collides with a DST transition — run this once on any job scheduled in the 1-4am local window before you ship it.

Use it

Hosted (recommended): MCPize — free tier, $7/mo Pro.

Self-host:

npm install
node server.js

Part of a small suite

mcp-schema-audit-mcp, regex-safety-audit-mcp, claude-cost-audit-mcp.

License

MIT