secretgeneratorCAUTION
Auditable CSPRNG-backed credential generator for AI agents and machine-readable pipelines. Stable JSON schema, NIST entropy floors, SLSA 3 + cosign signed releases. CLI, Go/Python/Rust libs, MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Auditable random credential generator for AI agents and machine-readable pipelines. Replaces ad-hoc password generation with a verifiable contract backed by the OS CSPRNG.
[](https://github.com/rafaelperoco/secretgenerator/releases) [](https://github.com/rafaelperoco/secretgenerator/actions/workflows/ci.yml) [](https://slsa.dev) [](https://docs.sigstore.dev/cosign/overview/) [](https://www.npmjs.com/package/@secretgenerator/cli) [](https://www.npmjs.com/package/@secretgenerator/mcp)
TL;DR
# zero-install (no clone, no compile) npx -y @secretgenerator/cli password --json --show-crack-time # permanent install brew install rafaelperoco/tap/secretgenerator # Model Context Protocol server (Claude / Cursor / Cline) npx -y @secretgenerator/mcp
Output is stable JSON (schema v1):
{
"schema_version": 1,
"password": "VoJgEDVnCoTVMx8cLnMwmHnz",
"entropy_bits": 142.9,
"charset_id": "alphanum-v1",
"algorithm": "crypto/rand+rejection-sampling",
"subcommand": "password",
"version": "2.0.0",
"request_id": "f4c54f9c-0f57-4d58-83be-7937cbe077f7",
"timestamp_utc": "2026-04-29T22:35:11.077695Z",
"crack_time_estimates": [
{
"profile_id": "nation-state-v1",
"human_readable": "1.2e+10 times the age of the universe"
}
]
}Pin the schema with --require-schema-version=1.
Why not let an LLM generate the password directly? Recent research ([Irregular Security, 2025](https://www.csoonline.com/article/4155166/l
4da421a67d58OBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add secretgenerator-web --env GITHUB_TOKEN=${GITHUB_TOKEN} --env SECRETGENERATOR_SKIP_DOWNLOAD=${SECRETGENERATOR_SKIP_DOWNLOAD} --env SECRETGENERATOR_VERSION=${SECRETGENERATOR_VERSION} -- npx -y [email protected]{
"mcpServers": {
"secretgenerator-web": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"SECRETGENERATOR_SKIP_DOWNLOAD": "${SECRETGENERATOR_SKIP_DOWNLOAD}",
"SECRETGENERATOR_VERSION": "${SECRETGENERATOR_VERSION}"
}
}
}
}Exposed tools (8)
7 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
assess_entropy | read | Estimate the entropy of an EXISTING password. Returns the Shannon entropy in bits |
estimate_crack_time | read | Compute time-to-break estimates for a given entropy in bits across all attacker |
generate_api_key | read | Generate a token in the |
generate_passphrase | read | Generate a diceware-style passphrase using the EFF Large Wordlist (7776 words, |
generate_password | write | Generate a high-entropy random password from a named character set. |
generate_pin | read | Generate a numeric PIN with weak-pattern rejection. PINs are intrinsically low |
generate_secret | read | Generate a high-entropy machine-readable secret from raw CSPRNG bytes. |
list_attacker_profiles | read | Return the named attacker profiles used to estimate time-to-break for a given |
Trust audit
CAUTIONgrade C · trust 79/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (3 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (14)
34654 jailbreak
console.log(out.password, "—", out.entropy_bits, "bits");`;
.golangci.yml
.goreleaser.yaml
.release-please-manifest.json
console.log(`password: ${result.password}`);print(f"password: {result['password']}")"v2.0.0/../../evil",
["docs/../../etc/passwd", "unsafe path"],
["secretgenerator/../../../tmp/x", "unsafe path"],
@types/node, typescript
@modelcontextprotocol/sdk, @types/node, typescript
@astrojs/react, @astrojs/sitemap, @resvg/resvg-js, @tailwindcss/vite, @types/react, @types/react-dom, astro, react
Read the password from one of:
Gates applied: instruction_override, no_behavioural_pass.
4da421a67d58full audit observations/trust-audit/mcp-server/rafaelperoco__secretgenerator.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 4da421a67d58 | CAUTION | C | 79 | first audit |
Questions
What is the secretgenerator MCP server?
Auditable CSPRNG-backed credential generator for AI agents and machine-readable pipelines. Stable JSON schema, NIST entropy floors, SLSA 3 + cosign signed releases. CLI, Go/Python/Rust libs, MCP server.
What tools does secretgenerator expose?
8 in total: 7 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is secretgenerator safe to connect to an agent?
With care. The audit graded it C (79/100) and found 14 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does secretgenerator need?
It reads GITHUB_TOKEN, SECRETGENERATOR_SKIP_DOWNLOAD and SECRETGENERATOR_VERSION from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does secretgenerator run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as secretgenerator-web at 0.0.1.
How current is this page?
The grade is for one exact copy of the source (4da421a67d58), read on 2026-10-14. The repository is watched and re-audited when it changes.