Generate cryptographically random passwords and score password strength (zxcvbn) via @mukundakatta/password-mcp

@mukundakatta/password-mcp v0.1.0

Install: npm install @mukundakatta/password-mcp Entry: dist/server.js (stdio) Tools: 2 — generate, strength

generate — cryptographically random password

Params: length (4-256, default 20), lowercase (bool, default true), uppercase (bool, default true), digits (bool, default true), symbols (bool, default true), exclude_ambiguous (bool, default false — drops 0/O/1/l/I/| etc.)

Returns: {password: "..."}

strength — zxcvbn password scoring

Params: password (string, required)

Returns: {score: 0-4, guesses_log10: N, crack_time_display: "...", warning: "...", suggestions: ["..."]}

Key gotchas

• Tool is `strength` NOT `score` — using score returns "unknown tool"
• No `count`/batch param — generate always returns ONE password; loop client-side for multiples
• zxcvbn first call ~222ms (regex/dictionary compilation), subsequent calls ~22-28ms
• Score 0 = terrible ("less than a second"), score 4 = strong ("centuries"); score 3+ is acceptable
• Empty string scores 0 with generic suggestions, no crash
• `exclude_ambiguous: true` removes visually confusable chars (0/O, 1/l/I/|) — useful for printed/shared passwords
• Passphrase "correct horse battery staple" scores 4 with guesses_log10=20.33 — confirms passphrases beat short complex passwords
• Dictionary detection works: "dragon" flagged as top-10, "password123" as very common
• Repeats detected: "aaaaaaaaaa" flagged with specific "Avoid repeated words" suggestion