@secretgenerator/mcp 2.0.0

package/README.md

@@ -0,0 +1,87 @@
+# @secretgenerator/mcp
+
+MCP server exposing [secretgenerator](https://secretgenerator.org) credential
+generation primitives to Claude, Cursor, Cline, Zed, Continue.dev, and any
+other [Model Context Protocol](https://modelcontextprotocol.io/) client.
+
+## Why
+
+LLMs cannot uniformly sample randomness. Asked to generate a strong API key,
+they tend to produce strings with ~20 bits of effective entropy and substantial
+collision rates ([Irregular Security, 2025](https://www.csoonline.com/article/4155166/llm-generated-passwords-are-indefensible-your-codebase-may-already-prove-it.html)).
+This package gives the agent a tool that delegates the sampling to a CSPRNG
+and returns a versioned, auditable JSON record describing the credential.
+
+The same Go code that backs the [secretgenerator CLI](https://github.com/rafaelperoco/secretgenerator)
+is compiled to WebAssembly and run inside Node. There is no network call,
+no shelled-out binary; the secret is generated locally inside the MCP server
+process and streamed to the agent.
+
+## Install
+
+### Claude Code / Claude Desktop
+
+```sh
+claude mcp add secretgenerator -- npx -y @secretgenerator/mcp@latest
+```
+
+### Cursor / Cline / Zed / Continue.dev / etc.
+
+Add to your client's MCP config (commonly `~/.config/<client>/mcp.json`):
+
+```json
+{
+  "mcpServers": {
+    "secretgenerator": {
+      "command": "npx",
+      "args": ["-y", "@secretgenerator/mcp@latest"]
+    }
+  }
+}
+```
+
+The first invocation downloads the package (~600 KB including the WASM
+bundle); subsequent invocations are cached.
+
+## Tools exposed
+
+| tool                     | when to use                                              |
+| ------------------------ | -------------------------------------------------------- |
+| `generate_password`      | general-purpose passwords, named charsets                |
+| `generate_passphrase`    | human-memorable secrets, EFF Large Wordlist (8 words ≈ 103 bits) |
+| `generate_secret`        | API tokens, OAuth secrets, JWT keys (recommended for agents) |
+| `generate_api_key`       | `prefix_base62` Stripe-style tokens                      |
+| `generate_pin`           | numeric PINs with weak-pattern rejection                 |
+| `assess_entropy`         | estimate strength of an existing password                |
+| `list_attacker_profiles` | enumerate the 5 named cracking-rate scenarios            |
+| `estimate_crack_time`    | time-to-break under each attacker profile                |
+
+Each `generate_*` tool returns a [schema-v1 JSON record](https://secretgenerator.org/schemas/output-v1.json):
+
+```json
+{
+  "schema_version": 1,
+  "password": "Ay7-Kx9mQ-...",
+  "length": 24,
+  "charset_id": "alphanum-symbols-v1",
+  "entropy_bits": 156.9,
+  "algorithm": "crypto/rand+rejection-sampling",
+  "subcommand": "password",
+  "request_id": "f4c54f9c-0f57-4d58-...",
+  "timestamp_utc": "2026-05-02T21:53:34.746Z"
+}
+```
+
+## Auditability
+
+The WASM module shipped with this package is built from the
+[secretgenerator source](https://github.com/rafaelperoco/secretgenerator/tree/main/web/wasm)
+under `web/wasm/`. Every release of this package matches a tagged release
+of the CLI; the WASM bundle is reproducible from the source via TinyGo.
+
+For the full verification chain (cosign signatures, SLSA provenance, SBOM),
+see [docs/AUDIT.md](https://github.com/rafaelperoco/secretgenerator/blob/main/docs/AUDIT.md).
+
+## License
+
+MIT. Source: [github.com/rafaelperoco/secretgenerator](https://github.com/rafaelperoco/secretgenerator).

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,342 @@
+#!/usr/bin/env node
+// secretgenerator MCP server. Exposes the same generation primitives as
+// the secretgenerator CLI (and as the secretgenerator.org web generator)
+// via the Model Context Protocol so any MCP-aware client (Claude Desktop,
+// Claude Code, Cursor, Cline, Zed, Continue.dev, ...) can call them.
+//
+// Why this matters: LLMs cannot uniformly sample randomness. When asked to
+// "generate an API key", they tend to produce strings with ~20 bits of
+// effective entropy and substantial collision rates (Irregular Security,
+// 2025). Exposing this tool via MCP means the agent can delegate the
+// sampling to a CSPRNG-backed primitive and audit the result via a
+// versioned JSON schema.
+//
+// Install:
+//   claude mcp add secretgenerator -- npx -y @secretgenerator/mcp@latest
+//
+// All generation is local. No network calls. The Go code that backs the
+// CLI is compiled to WASM and run in a Node sandbox.
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { loadBindings, unwrap } from "./wasm.js";
+const server = new Server({
+    name: "secretgenerator",
+    version: "2.0.0",
+}, {
+    capabilities: {
+        tools: {},
+    },
+});
+// ─── Tool catalog ──────────────────────────────────────────────────────────
+//
+// Tool names use snake_case (MCP convention). Descriptions intentionally
+// long: agents read these to decide when to use a tool, so being explicit
+// about *when* to pick each subcommand prevents the model from picking
+// `generate_password` when `generate_secret` is the right call for an API
+// token, or vice versa.
+const TOOLS = [
+    {
+        name: "generate_password",
+        description: "Generate a high-entropy random password from a named character set. " +
+            "Use this for general-purpose passwords (user accounts, encrypted vaults, " +
+            "manual logins). For machine-to-machine tokens prefer `generate_secret`. " +
+            "For human-memorable secrets prefer `generate_passphrase`. " +
+            "Default: 20 characters from `alphanum-v1` (~119 bits of entropy). " +
+            "Returns a schema-v1 JSON record describing the credential and its provenance.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                length: {
+                    type: "integer",
+                    minimum: 1,
+                    description: "Length of the password in characters. Default 20.",
+                },
+                charsetId: {
+                    type: "string",
+                    description: "Named, versioned character set. Common choices: `alphanum-v1` (a-z A-Z 0-9), " +
+                        "`alphanum-symbols-v1` (adds !@#$...), `lower-v1`, `upper-v1`, " +
+                        "`digit-v1`, `hex-v1`, `base62-v1`, `numeric-v1`. Default `alphanum-v1`.",
+                },
+                exclude: {
+                    type: "string",
+                    description: "Characters to remove from the charset BEFORE generation. The output " +
+                        "length is still honored; the charset just shrinks. Useful for excluding " +
+                        "look-alikes like `0Ol1iI` when humans will type the password.",
+                },
+                requiredClasses: {
+                    type: "string",
+                    description: "Comma-separated classes the output is guaranteed to contain. " +
+                        "Valid values: `lower`, `upper`, `digit`, `symbol`. " +
+                        "Example: `lower,upper,digit,symbol`. Generation uses rejection sampling " +
+                        "until all required classes are present.",
+                },
+                minEntropyBits: {
+                    type: "number",
+                    description: "Minimum acceptable Shannon entropy in bits. Default 80. Set to 0 to disable. " +
+                        "If the requested length × log2(charset size) is below this floor and " +
+                        "`allowWeak` is false, the call fails with a clear error.",
+                },
+                allowWeak: {
+                    type: "boolean",
+                    description: "If true, permit generation below the entropy floor. The result will " +
+                        "include a `warnings` array documenting that the floor was bypassed. " +
+                        "Default false.",
+                },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "generate_passphrase",
+        description: "Generate a diceware-style passphrase using the EFF Large Wordlist (7776 words, " +
+            "~12.92 bits per word). Use this for human-memorable secrets like master " +
+            "passwords, encryption recovery phrases, or anything a human will type. " +
+            "Default: 8 words (~103 bits) joined by hyphens — Reinhold's `secure-through-2050` " +
+            "threshold. Returns a schema-v1 JSON record.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                words: {
+                    type: "integer",
+                    minimum: 1,
+                    description: "Number of words. 6 = EFF minimum (~78 bits). 8 = secure-through-2050 (~103 bits). " +
+                        "10 = wallet-grade (~129 bits). Default 8.",
+                },
+                separator: {
+                    type: "string",
+                    description: "String joining consecutive words. Default `-`. Hyphen is shell/URL/env-file safe. " +
+                        "Empty string is rejected (would let adjacent words fuse and lose entropy).",
+                },
+                capitalize: {
+                    type: "boolean",
+                    description: "Compatibility flag for sites mandating uppercase. Capitalizes the first letter " +
+                        "of each word. The result includes a warning that this adds ~0 bits against real " +
+                        "attackers (Title-Case is in every Hashcat ruleset). Prefer adding a word instead. " +
+                        "Default false.",
+                },
+                digitSuffix: {
+                    type: "boolean",
+                    description: "Compatibility flag for sites mandating a digit. Appends a single random digit " +
+                        "(adds log2(10) ≈ 3.32 bits). The result includes a warning. " +
+                        "Default false.",
+                },
+                minEntropyBits: {
+                    type: "number",
+                    description: "Default 80. See `generate_password`.",
+                },
+                allowWeak: {
+                    type: "boolean",
+                    description: "See `generate_password`. Default false.",
+                },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "generate_secret",
+        description: "Generate a high-entropy machine-readable secret from raw CSPRNG bytes. " +
+            "**Recommended for API tokens, OAuth client secrets, JWT signing keys, and any " +
+            "machine-to-machine credential** — humans never see this string, so we don't waste " +
+            "entropy on memorable charsets. Default: 32 bytes (256 bits) encoded as URL-safe " +
+            "base64 without padding (43 characters). Returns a schema-v1 JSON record.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                bytes: {
+                    type: "integer",
+                    minimum: 1,
+                    description: "Number of random bytes (8 bits each). 16 = 128 bits, 32 = 256 bits, " +
+                        "64 = 512 bits. Default 32.",
+                },
+                encoding: {
+                    type: "string",
+                    enum: ["base64url", "base64", "base32", "hex"],
+                    description: "Output encoding. `base64url` is URL/header/env-file safe (default). " +
+                        "`base64` includes / and + (safe in JSON, not URLs). `base32` is shorter " +
+                        "alphabet for case-insensitive systems. `hex` for systems that need only " +
+                        "ASCII letters and digits.",
+                },
+                prefix: {
+                    type: "string",
+                    description: "Static prefix prepended to the encoded body. Does not contribute to entropy. " +
+                        "Useful for namespacing (e.g. `sk_live_`, `prod_`).",
+                },
+                minEntropyBits: {
+                    type: "number",
+                    description: "Default 128 — the NIST SP 800-131A 2030 target for symmetric-key strength. " +
+                        "Set to 0 to disable.",
+                },
+                allowWeak: {
+                    type: "boolean",
+                    description: "See `generate_password`. Default false.",
+                },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "generate_api_key",
+        description: "Generate a token in the `<prefix><separator><base62>` form used by Stripe " +
+            "(`sk_live_...`), GitHub (`ghp_...`), Slack (`xoxb-...`), Anthropic (`sk-ant-...`), " +
+            "and most modern SaaS APIs. Default: `sk_<32 base62 chars>` (~190 bits). " +
+            "The base62 body is drawn uniformly from a CSPRNG; the prefix is a static identifier " +
+            "and contributes zero entropy. Returns a schema-v1 JSON record.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                prefix: {
+                    type: "string",
+                    description: "Static identifier (e.g. `sk`, `ghp`, `xoxb`, `sk-ant`). Whitespace is rejected.",
+                },
+                separator: {
+                    type: "string",
+                    description: "Between prefix and body. Default `_`.",
+                },
+                length: {
+                    type: "integer",
+                    minimum: 1,
+                    description: "Length of the base62 body in characters. Default 32 (~190 bits).",
+                },
+                minEntropyBits: {
+                    type: "number",
+                    description: "Default 128. See `generate_secret`.",
+                },
+                allowWeak: {
+                    type: "boolean",
+                    description: "See `generate_password`. Default false.",
+                },
+            },
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "generate_pin",
+        description: "Generate a numeric PIN with weak-pattern rejection. PINs are intrinsically low " +
+            "entropy (a 6-digit PIN is ~19.9 bits) and **safe only when the verifier enforces " +
+            "rate limiting** (banking apps, hardware tokens). Never use a PIN as a standalone " +
+            "authenticator. The tool requires `acknowledgeLowEntropy: true` to even generate one. " +
+            "Rejects all-same-digit, strict ascending/descending sequences, short repetitions, " +
+            "the top-20 DataGenetics 2012 most-common PINs, and calendar-year patterns.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                digits: {
+                    type: "integer",
+                    minimum: 4,
+                    description: "Number of digits. Must be >= 4. Default 6.",
+                },
+                acknowledgeLowEntropy: {
+                    type: "boolean",
+                    description: "**Required.** The caller must explicitly acknowledge that PINs are " +
+                        "low-entropy and only safe with verifier-side rate limiting.",
+                },
+                allowWeakPattern: {
+                    type: "boolean",
+                    description: "If true, permit PINs matching weak patterns (NOT RECOMMENDED). Default false.",
+                },
+            },
+            required: ["acknowledgeLowEntropy"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "assess_entropy",
+        description: "Estimate the entropy of an EXISTING password. Returns the Shannon entropy in bits " +
+            "assuming each character was drawn uniformly from the observed character classes — " +
+            "an UPPER BOUND. Real entropy is lower if the password follows a memorable pattern " +
+            "(dictionary word, year, name). Use this when validating user-supplied passwords " +
+            "or auditing legacy credentials. Output never echoes the password in plaintext, only " +
+            "its length, observed classes, and computed entropy.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                password: {
+                    type: "string",
+                    description: "The password to assess. Not echoed in the response.",
+                },
+            },
+            required: ["password"],
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "list_attacker_profiles",
+        description: "Return the named attacker profiles used to estimate time-to-break for a given " +
+            "entropy. Profiles span 13 orders of magnitude: `online-throttled-v1` " +
+            "(rate-limited login API, ~100 g/s), `slow-kdf-v1` (Argon2id at OWASP defaults, " +
+            "~1k g/s), `bcrypt-cost12-v1` (single RTX 4090, ~50k g/s), `fast-hash-single-gpu-v1` " +
+            "(~1e11 g/s), `nation-state-v1` (10k GPUs against fast hash, ~1e15 g/s). " +
+            "Profile IDs are versioned; updating a rate is a breaking change.",
+        inputSchema: {
+            type: "object",
+            properties: {},
+            additionalProperties: false,
+        },
+    },
+    {
+        name: "estimate_crack_time",
+        description: "Compute time-to-break estimates for a given entropy in bits across all attacker " +
+            "profiles. Returns an array of {profile_id, description, seconds, human_readable}. " +
+            "Use after `generate_*` or `assess_entropy` to surface a human-readable strength " +
+            "summary like '7.2e+08 times the age of the universe'.",
+        inputSchema: {
+            type: "object",
+            properties: {
+                entropyBits: {
+                    type: "number",
+                    minimum: 0,
+                    description: "The credential's entropy in bits.",
+                },
+            },
+            required: ["entropyBits"],
+            additionalProperties: false,
+        },
+    },
+];
+server.setRequestHandler(ListToolsRequestSchema, async () => ({ tools: TOOLS }));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+    const sgen = await loadBindings();
+    const args = (req.params.arguments ?? {});
+    const handlers = {
+        generate_password: () => unwrap(sgen.password(args)),
+        generate_passphrase: () => unwrap(sgen.passphrase(args)),
+        generate_secret: () => unwrap(sgen.secret(args)),
+        generate_api_key: () => unwrap(sgen.apiKey(args)),
+        generate_pin: () => unwrap(sgen.pin(args)),
+        assess_entropy: () => unwrap(sgen.entropy(args)),
+        list_attacker_profiles: () => sgen.attackerProfiles(),
+        estimate_crack_time: () => sgen.crackTimes(Number(args.entropyBits)),
+    };
+    const handler = handlers[req.params.name];
+    if (!handler) {
+        throw new Error(`unknown tool: ${req.params.name}`);
+    }
+    try {
+        const result = handler();
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify(result, null, 2),
+                },
+            ],
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: JSON.stringify({ error: msg }, null, 2),
+                },
+            ],
+            isError: true,
+        };
+    }
+});
+const transport = new StdioServerTransport();
+await server.connect(transport);
+// Keep the process alive; the SDK manages the stdio loop.
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,mEAAmE;AACnE,yBAAyB;AACzB,EAAE;AACF,WAAW;AACX,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,qDAAqD;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAe,MAAM,WAAW,CAAC;AAE9D,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB;IACE,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,OAAO;CACjB,EACD;IACE,YAAY,EAAE;QACZ,KAAK,EAAE,EAAE;KACV;CACF,CACF,CAAC;AAEF,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,0EAA0E;AAC1E,wBAAwB;AAExB,MAAM,KAAK,GAAG;IACZ;QACE,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,sEAAsE;YACtE,2EAA2E;YAC3E,0EAA0E;YAC1E,4DAA4D;YAC5D,oEAAoE;YACpE,+EAA+E;QACjF,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,CAAC;oBACV,WAAW,EAAE,mDAAmD;iBACjE;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+EAA+E;wBAC/E,gEAAgE;wBAChE,yEAAyE;iBAC5E;gBACD,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,sEAAsE;wBACtE,0EAA0E;wBAC1E,+DAA+D;iBAClE;gBACD,eAAe,EAAE;oBACf,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+DAA+D;wBAC/D,qDAAqD;wBACrD,0EAA0E;wBAC1E,yCAAyC;iBAC5C;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+EAA+E;wBAC/E,uEAAuE;wBACvE,0DAA0D;iBAC7D;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS;oBACf,WAAW,EACT,sEAAsE;wBACtE,sEAAsE;wBACtE,gBAAgB;iBACnB;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,iFAAiF;YACjF,0EAA0E;YAC1E,yEAAyE;YACzE,oFAAoF;YACpF,6CAA6C;QAC/C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,CAAC;oBACV,WAAW,EACT,oFAAoF;wBACpF,2CAA2C;iBAC9C;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,oFAAoF;wBACpF,4EAA4E;iBAC/E;gBACD,UAAU,EAAE;oBACV,IAAI,EAAE,SAAS;oBACf,WAAW,EACT,iFAAiF;wBACjF,kFAAkF;wBAClF,oFAAoF;wBACpF,gBAAgB;iBACnB;gBACD,WAAW,EAAE;oBACX,IAAI,EAAE,SAAS;oBACf,WAAW,EACT,gFAAgF;wBAChF,8DAA8D;wBAC9D,gBAAgB;iBACnB;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,sCAAsC;iBACpD;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,yCAAyC;iBACvD;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,yEAAyE;YACzE,gFAAgF;YAChF,oFAAoF;YACpF,kFAAkF;YAClF,0EAA0E;QAC5E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,CAAC;oBACV,WAAW,EACT,sEAAsE;wBACtE,4BAA4B;iBAC/B;gBACD,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;oBAC9C,WAAW,EACT,sEAAsE;wBACtE,0EAA0E;wBAC1E,0EAA0E;wBAC1E,2BAA2B;iBAC9B;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,+EAA+E;wBAC/E,oDAAoD;iBACvD;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,6EAA6E;wBAC7E,sBAAsB;iBACzB;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,yCAAyC;iBACvD;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,4EAA4E;YAC5E,qFAAqF;YACrF,0EAA0E;YAC1E,sFAAsF;YACtF,gEAAgE;QAClE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,iFAAiF;iBACpF;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,uCAAuC;iBACrD;gBACD,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,CAAC;oBACV,WAAW,EAAE,kEAAkE;iBAChF;gBACD,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qCAAqC;iBACnD;gBACD,SAAS,EAAE;oBACT,IAAI,EAAE,SAAS;oBACf,WAAW,EAAE,yCAAyC;iBACvD;aACF;YACD,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,iFAAiF;YACjF,mFAAmF;YACnF,mFAAmF;YACnF,uFAAuF;YACvF,oFAAoF;YACpF,4EAA4E;QAC9E,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,CAAC;oBACV,WAAW,EAAE,4CAA4C;iBAC1D;gBACD,qBAAqB,EAAE;oBACrB,IAAI,EAAE,SAAS;oBACf,WAAW,EACT,qEAAqE;wBACrE,6DAA6D;iBAChE;gBACD,gBAAgB,EAAE;oBAChB,IAAI,EAAE,SAAS;oBACf,WAAW,EACT,+EAA+E;iBAClF;aACF;YACD,QAAQ,EAAE,CAAC,uBAAuB,CAAC;YACnC,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,oFAAoF;YACpF,oFAAoF;YACpF,oFAAoF;YACpF,kFAAkF;YAClF,sFAAsF;YACtF,qDAAqD;QACvD,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,qDAAqD;iBACnE;aACF;YACD,QAAQ,EAAE,CAAC,UAAU,CAAC;YACtB,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,gFAAgF;YAChF,uEAAuE;YACvE,iFAAiF;YACjF,sFAAsF;YACtF,0EAA0E;YAC1E,kEAAkE;QACpE,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,EAAE;YACd,oBAAoB,EAAE,KAAK;SAC5B;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,kFAAkF;YAClF,oFAAoF;YACpF,kFAAkF;YAClF,uDAAuD;QACzD,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,WAAW,EAAE;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,CAAC;oBACV,WAAW,EAAE,mCAAmC;iBACjD;aACF;YACD,QAAQ,EAAE,CAAC,aAAa,CAAC;YACzB,oBAAoB,EAAE,KAAK;SAC5B;KACF;CACF,CAAC;AAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAEjF,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5D,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAA4B,CAAC;IAErE,MAAM,QAAQ,GAAkC;QAC9C,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5D,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChE,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxD,gBAAgB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzD,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,sBAAsB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE;QACrD,mBAAmB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;KACrE,CAAC;IAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;iBACtC;aACF;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;iBAC9C;aACF;YACD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;AAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAEhC,0DAA0D"}

package/dist/smoke.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/smoke.js

@@ -0,0 +1,48 @@
+// Smoke test: load the WASM, generate one credential of each kind, print to
+// stdout. Used by CI to verify the package bundle is functional without
+// pulling in the full MCP transport. Run with: `npm run smoke`.
+import { loadBindings, unwrap } from "./wasm.js";
+async function main() {
+    const sgen = await loadBindings();
+    console.log(`secretgen ${sgen.version} schema_version=${sgen.schemaVersion}`);
+    const checks = [
+        ["password", () => unwrap(sgen.password({}))],
+        ["passphrase", () => unwrap(sgen.passphrase({}))],
+        ["secret", () => unwrap(sgen.secret({}))],
+        [
+            "api-key",
+            () => unwrap(sgen.apiKey({ prefix: "sk", separator: "_", length: 32 })),
+        ],
+        [
+            "pin",
+            () => unwrap(sgen.pin({ digits: 6, acknowledgeLowEntropy: true })),
+        ],
+        [
+            "entropy",
+            () => unwrap(sgen.entropy({ password: "Tr0ub4dor&3" })),
+        ],
+    ];
+    for (const [name, fn] of checks) {
+        try {
+            const r = fn();
+            const preview = r.password
+                ? r.password.length > 24
+                    ? r.password.slice(0, 12) + "…" + r.password.slice(-8)
+                    : r.password
+                : "(no plaintext)";
+            console.log(`  ${name.padEnd(11)} ${preview.padEnd(24)} ${r.entropy_bits.toFixed(1)} bits`);
+        }
+        catch (err) {
+            console.error(`  ${name} FAILED: ${err instanceof Error ? err.message : err}`);
+            process.exitCode = 1;
+        }
+    }
+    const cracks = sgen.crackTimes(128);
+    console.log(`crackTimes(128) → ${cracks.length} profiles`);
+    process.exit(process.exitCode ?? 0);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=smoke.js.map

package/dist/smoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke.js","sourceRoot":"","sources":["../src/smoke.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,wEAAwE;AACxE,gEAAgE;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAe,MAAM,WAAW,CAAC;AAE9D,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,mBAAmB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAmC;QAC7C,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD;YACE,SAAS;YACT,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;SAChF;QACD;YACE,KAAK;YACL,GAAG,EAAE,CACH,MAAM,CAAS,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;SACvE;QACD;YACE,SAAS;YACT,GAAG,EAAE,CAAC,MAAM,CAAS,IAAI,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;SAChE;KACF,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAY,CAAC;YACzB,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ;gBACxB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE;oBACtB,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBACtD,CAAC,CAAC,CAAC,CAAC,QAAQ;gBACd,CAAC,CAAC,gBAAgB,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;IAC3D,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/wasm.d.ts

@@ -0,0 +1,57 @@
+export type CrackTimeEstimate = {
+    profile_id: string;
+    description: string;
+    seconds: number;
+    human_readable: string;
+};
+export type Result = {
+    schema_version: number;
+    password?: string;
+    length: number;
+    charset_id: string;
+    charset_size: number;
+    entropy_bits: number;
+    excluded_count?: number;
+    excluded_sha256?: string;
+    required_classes?: string;
+    algorithm: string;
+    subcommand: string;
+    version: string;
+    commit: string;
+    build_date: string;
+    request_id: string;
+    timestamp_utc: string;
+    warnings?: string[];
+    crack_time_estimates?: CrackTimeEstimate[];
+};
+type ResultOrError = Result | {
+    error: string;
+};
+export type AttackerProfile = {
+    id: string;
+    description: string;
+    guesses_per_second: number;
+};
+export type GoBindings = {
+    password: (opts: Record<string, unknown>) => ResultOrError;
+    secret: (opts: Record<string, unknown>) => ResultOrError;
+    passphrase: (opts: Record<string, unknown>) => ResultOrError;
+    apiKey: (opts: Record<string, unknown>) => ResultOrError;
+    pin: (opts: Record<string, unknown>) => ResultOrError;
+    entropy: (opts: Record<string, unknown>) => ResultOrError;
+    charsets: () => string[];
+    attackerProfiles: () => AttackerProfile[];
+    crackTimes: (bits: number) => CrackTimeEstimate[];
+    schemaVersion: number;
+    version: string;
+};
+/**
+ * Load and instantiate the WASM module. Idempotent: subsequent calls
+ * return the cached bindings without re-instantiating.
+ */
+export declare function loadBindings(): Promise<GoBindings>;
+/** Throw on the {error: ...} shape; return Result on success. */
+export declare function unwrap<T>(r: T | {
+    error: string;
+}): T;
+export {};

package/dist/wasm.js

@@ -0,0 +1,78 @@
+// Node-side loader for keygen.wasm. Mirrors web/src/lib/wasm.ts but reads
+// the binary from disk and uses globalThis instead of window.
+//
+// TinyGo emits a wasm_exec.js shim that, when evaluated, attaches a `Go`
+// constructor to the host global. We evaluate it in a fresh module scope
+// using the vm module so we don't pollute the user's globalThis.
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import vm from "node:vm";
+import { fileURLToPath } from "node:url";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// dist/ sits at mcp/dist/, wasm/ sits at mcp/wasm/.
+const wasmDir = path.resolve(__dirname, "..", "wasm");
+let bindings = null;
+let initPromise = null;
+/**
+ * Load and instantiate the WASM module. Idempotent: subsequent calls
+ * return the cached bindings without re-instantiating.
+ */
+export function loadBindings() {
+    if (bindings)
+        return Promise.resolve(bindings);
+    if (initPromise)
+        return initPromise;
+    initPromise = (async () => {
+        const execJs = readFileSync(path.join(wasmDir, "wasm_exec.js"), "utf8");
+        const sandbox = {
+            // Bridge whatever wasm_exec.js needs from the real globalThis without
+            // letting it overwrite ours.
+            Go: undefined,
+            globalThis: undefined,
+            console,
+            crypto: globalThis.crypto,
+            performance: globalThis.performance,
+            TextEncoder: globalThis.TextEncoder,
+            TextDecoder: globalThis.TextDecoder,
+            fetch: globalThis.fetch,
+            Date,
+            Math,
+            Promise,
+            // Some shims look for `window`; alias to the sandbox itself.
+            window: undefined,
+        };
+        sandbox.globalThis = sandbox;
+        sandbox.window = sandbox;
+        vm.createContext(sandbox);
+        vm.runInContext(execJs, sandbox, { filename: "wasm_exec.js" });
+        if (!sandbox.Go) {
+            throw new Error("wasm_exec.js loaded but Go constructor not exposed");
+        }
+        const go = new sandbox.Go();
+        // Compile and instantiate the WASM module.
+        const wasmBytes = readFileSync(path.join(wasmDir, "keygen.wasm"));
+        const mod = await WebAssembly.instantiate(wasmBytes, go.importObject);
+        // TinyGo's main blocks forever to keep the syscall/js callback table
+        // alive — do not await. The bindings we want are attached to the
+        // sandbox's `secretgen` global synchronously by the time main() runs
+        // its first lines.
+        void go.run(mod.instance);
+        // Yield once so main() registers the bindings before we read them.
+        await new Promise((r) => setImmediate(r));
+        const sgen = sandbox.secretgen;
+        if (!sgen) {
+            throw new Error("WASM ran but did not expose `secretgen` bindings");
+        }
+        bindings = sgen;
+        return bindings;
+    })();
+    return initPromise;
+}
+/** Throw on the {error: ...} shape; return Result on success. */
+export function unwrap(r) {
+    if (typeof r === "object" && r !== null && "error" in r) {
+        throw new Error(r.error);
+    }
+    return r;
+}
+//# sourceMappingURL=wasm.js.map

package/dist/wasm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wasm.js","sourceRoot":"","sources":["../src/wasm.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,yEAAyE;AACzE,iEAAiE;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,oDAAoD;AACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AAoDtD,IAAI,QAAQ,GAAsB,IAAI,CAAC;AACvC,IAAI,WAAW,GAA+B,IAAI,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,WAAW;QAAE,OAAO,WAAW,CAAC;IAEpC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;QACxB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QAgBxE,MAAM,OAAO,GAAkB;YAC7B,sEAAsE;YACtE,6BAA6B;YAC7B,EAAE,EAAE,SAAS;YACb,UAAU,EAAE,SAA+C;YAC3D,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI;YACJ,IAAI;YACJ,OAAO;YACP,6DAA6D;YAC7D,MAAM,EAAE,SAA+C;SACxD,CAAC;QACF,OAAO,CAAC,UAAU,GAAG,OAA6C,CAAC;QACnE,OAAO,CAAC,MAAM,GAAG,OAA6C,CAAC;QAE/D,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1B,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAE5B,2CAA2C;QAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC;QAEtE,qEAAqE;QACrE,iEAAiE;QACjE,qEAAqE;QACrE,mBAAmB;QACnB,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE1B,mEAAmE;QACnE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,IAAI,GAAI,OAAmC,CAAC,SAErC,CAAC;QACd,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,MAAM,CAAI,CAAwB;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAE,CAAuB,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@secretgenerator/mcp",
+  "version": "2.0.0",
+  "description": "MCP server exposing secretgenerator CSPRNG-backed credential generation tools to Claude, Cursor, Cline, Zed, and other MCP-aware clients.",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://secretgenerator.org",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rafaelperoco/secretgenerator.git",
+    "directory": "mcp"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "claude",
+    "ai-agent",
+    "secret-generation",
+    "password-generator",
+    "csprng",
+    "auditable"
+  ],
+  "bin": {
+    "secretgenerator-mcp": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "wasm",
+    "README.md"
+  ],
+  "scripts": {
+    "prebuild": "node scripts/copy-wasm.mjs",
+    "build": "tsc -p tsconfig.json",
+    "prepack": "npm run build",
+    "smoke": "node dist/smoke.js"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.6.0"
+  }
+}

package/wasm/wasm_exec.js

@@ -0,0 +1,559 @@
+// Copyright 2018 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+//
+// This file has been modified for use by the TinyGo compiler.
+
+(() => {
+	// Map multiple JavaScript environments to a single common API,
+	// preferring web standards over Node.js API.
+	//
+	// Environments considered:
+	// - Browsers
+	// - Node.js
+	// - Electron
+	// - Parcel
+
+	if (typeof global !== "undefined") {
+		// global already exists
+	} else if (typeof window !== "undefined") {
+		window.global = window;
+	} else if (typeof self !== "undefined") {
+		self.global = self;
+	} else {
+		throw new Error("cannot export Go (neither global, window nor self is defined)");
+	}
+
+	if (!global.require && typeof require !== "undefined") {
+		global.require = require;
+	}
+
+	if (!global.fs && global.require) {
+		global.fs = require("node:fs");
+	}
+
+	const enosys = () => {
+		const err = new Error("not implemented");
+		err.code = "ENOSYS";
+		return err;
+	};
+
+	if (!global.fs) {
+		let outputBuf = "";
+		global.fs = {
+			constants: { O_WRONLY: -1, O_RDWR: -1, O_CREAT: -1, O_TRUNC: -1, O_APPEND: -1, O_EXCL: -1 }, // unused
+			writeSync(fd, buf) {
+				outputBuf += decoder.decode(buf);
+				const nl = outputBuf.lastIndexOf("\n");
+				if (nl != -1) {
+					console.log(outputBuf.substr(0, nl));
+					outputBuf = outputBuf.substr(nl + 1);
+				}
+				return buf.length;
+			},
+			write(fd, buf, offset, length, position, callback) {
+				if (offset !== 0 || length !== buf.length || position !== null) {
+					callback(enosys());
+					return;
+				}
+				const n = this.writeSync(fd, buf);
+				callback(null, n);
+			},
+			chmod(path, mode, callback) { callback(enosys()); },
+			chown(path, uid, gid, callback) { callback(enosys()); },
+			close(fd, callback) { callback(enosys()); },
+			fchmod(fd, mode, callback) { callback(enosys()); },
+			fchown(fd, uid, gid, callback) { callback(enosys()); },
+			fstat(fd, callback) { callback(enosys()); },
+			fsync(fd, callback) { callback(null); },
+			ftruncate(fd, length, callback) { callback(enosys()); },
+			lchown(path, uid, gid, callback) { callback(enosys()); },
+			link(path, link, callback) { callback(enosys()); },
+			lstat(path, callback) { callback(enosys()); },
+			mkdir(path, perm, callback) { callback(enosys()); },
+			open(path, flags, mode, callback) { callback(enosys()); },
+			read(fd, buffer, offset, length, position, callback) { callback(enosys()); },
+			readdir(path, callback) { callback(enosys()); },
+			readlink(path, callback) { callback(enosys()); },
+			rename(from, to, callback) { callback(enosys()); },
+			rmdir(path, callback) { callback(enosys()); },
+			stat(path, callback) { callback(enosys()); },
+			symlink(path, link, callback) { callback(enosys()); },
+			truncate(path, length, callback) { callback(enosys()); },
+			unlink(path, callback) { callback(enosys()); },
+			utimes(path, atime, mtime, callback) { callback(enosys()); },
+		};
+	}
+
+	if (!global.process) {
+		global.process = {
+			getuid() { return -1; },
+			getgid() { return -1; },
+			geteuid() { return -1; },
+			getegid() { return -1; },
+			getgroups() { throw enosys(); },
+			pid: -1,
+			ppid: -1,
+			umask() { throw enosys(); },
+			cwd() { throw enosys(); },
+			chdir() { throw enosys(); },
+		}
+	}
+
+	if (!global.crypto) {
+		const nodeCrypto = require("node:crypto");
+		global.crypto = {
+			getRandomValues(b) {
+				nodeCrypto.randomFillSync(b);
+			},
+		};
+	}
+
+	if (!global.performance) {
+		global.performance = {
+			now() {
+				const [sec, nsec] = process.hrtime();
+				return sec * 1000 + nsec / 1000000;
+			},
+		};
+	}
+
+	if (!global.TextEncoder) {
+		global.TextEncoder = require("node:util").TextEncoder;
+	}
+
+	if (!global.TextDecoder) {
+		global.TextDecoder = require("node:util").TextDecoder;
+	}
+
+	// End of polyfills for common API.
+
+	const encoder = new TextEncoder("utf-8");
+	const decoder = new TextDecoder("utf-8");
+	let reinterpretBuf = new DataView(new ArrayBuffer(8));
+	var logLine = [];
+	const wasmExit = {}; // thrown to exit via proc_exit (not an error)
+
+	global.Go = class {
+		constructor() {
+			this._callbackTimeouts = new Map();
+			this._nextCallbackTimeoutID = 1;
+
+			const mem = () => {
+				// The buffer may change when requesting more memory.
+				return new DataView(this._inst.exports.memory.buffer);
+			}
+
+			const unboxValue = (v_ref) => {
+				reinterpretBuf.setBigInt64(0, v_ref, true);
+				const f = reinterpretBuf.getFloat64(0, true);
+				if (f === 0) {
+					return undefined;
+				}
+				if (!isNaN(f)) {
+					return f;
+				}
+
+				const id = v_ref & 0xffffffffn;
+				return this._values[id];
+			}
+
+
+			const loadValue = (addr) => {
+				let v_ref = mem().getBigUint64(addr, true);
+				return unboxValue(v_ref);
+			}
+
+			const boxValue = (v) => {
+				const nanHead = 0x7FF80000n;
+
+				if (typeof v === "number") {
+					if (isNaN(v)) {
+						return nanHead << 32n;
+					}
+					if (v === 0) {
+						return (nanHead << 32n) | 1n;
+					}
+					reinterpretBuf.setFloat64(0, v, true);
+					return reinterpretBuf.getBigInt64(0, true);
+				}
+
+				switch (v) {
+					case undefined:
+						return 0n;
+					case null:
+						return (nanHead << 32n) | 2n;
+					case true:
+						return (nanHead << 32n) | 3n;
+					case false:
+						return (nanHead << 32n) | 4n;
+				}
+
+				let id = this._ids.get(v);
+				if (id === undefined) {
+					id = this._idPool.pop();
+					if (id === undefined) {
+						id = BigInt(this._values.length);
+					}
+					this._values[id] = v;
+					this._goRefCounts[id] = 0;
+					this._ids.set(v, id);
+				}
+				this._goRefCounts[id]++;
+				let typeFlag = 1n;
+				switch (typeof v) {
+					case "string":
+						typeFlag = 2n;
+						break;
+					case "symbol":
+						typeFlag = 3n;
+						break;
+					case "function":
+						typeFlag = 4n;
+						break;
+				}
+				return id | ((nanHead | typeFlag) << 32n);
+			}
+
+			const storeValue = (addr, v) => {
+				let v_ref = boxValue(v);
+				mem().setBigUint64(addr, v_ref, true);
+			}
+
+			const loadSlice = (array, len, cap) => {
+				return new Uint8Array(this._inst.exports.memory.buffer, array, len);
+			}
+
+			const loadSliceOfValues = (array, len, cap) => {
+				const a = new Array(len);
+				for (let i = 0; i < len; i++) {
+					a[i] = loadValue(array + i * 8);
+				}
+				return a;
+			}
+
+			const loadString = (ptr, len) => {
+				return decoder.decode(new DataView(this._inst.exports.memory.buffer, ptr, len));
+			}
+
+			const timeOrigin = Date.now() - performance.now();
+			const wasi_EBADF = 8;
+			const wasi_ENOSYS = 52;
+			this.importObject = {
+				wasi_snapshot_preview1: {
+					// https://github.com/WebAssembly/WASI/blob/snapshot-01/phases/snapshot/docs.md
+					fd_write: function(fd, iovs_ptr, iovs_len, nwritten_ptr) {
+						let nwritten = 0;
+						if (fd == 1) {
+							for (let iovs_i=0; iovs_i<iovs_len;iovs_i++) {
+								let iov_ptr = iovs_ptr+iovs_i*8; // assuming wasm32
+								let ptr = mem().getUint32(iov_ptr + 0, true);
+								let len = mem().getUint32(iov_ptr + 4, true);
+								nwritten += len;
+								for (let i=0; i<len; i++) {
+									let c = mem().getUint8(ptr+i);
+									if (c == 13) { // CR
+										// ignore
+									} else if (c == 10) { // LF
+										// write line
+										let line = decoder.decode(new Uint8Array(logLine));
+										logLine = [];
+										console.log(line);
+									} else {
+										logLine.push(c);
+									}
+								}
+							}
+						} else {
+							console.error('invalid file descriptor:', fd);
+						}
+						mem().setUint32(nwritten_ptr, nwritten, true);
+						return 0;
+					},
+					fd_read: () => wasi_ENOSYS,
+					fd_close: () => wasi_ENOSYS,
+					fd_fdstat_get: () => wasi_ENOSYS,
+					fd_prestat_get: () => wasi_EBADF, // wasi-libc relies on this errno value
+					fd_prestat_dir_name: () => wasi_ENOSYS,
+					fd_seek: () => wasi_ENOSYS,
+					path_open: () => wasi_ENOSYS,
+					proc_exit: (code) => {
+						this.exited = true;
+						this.exitCode = code;
+						this._resolveExitPromise();
+						throw wasmExit;
+					},
+					random_get: (bufPtr, bufLen) => {
+						crypto.getRandomValues(loadSlice(bufPtr, bufLen));
+						return 0;
+					},
+				},
+				gojs: {
+					// func ticks() int64
+					"runtime.ticks": () => {
+						return BigInt((timeOrigin + performance.now()) * 1e6);
+					},
+
+					// func sleepTicks(timeout int64)
+					"runtime.sleepTicks": (timeout) => {
+						// Do not sleep, only reactivate scheduler after the given timeout.
+						setTimeout(() => {
+							if (this.exited) return;
+							try {
+								this._inst.exports.go_scheduler();
+							} catch (e) {
+								if (e !== wasmExit) throw e;
+							}
+						}, Number(timeout)/1e6);
+					},
+
+					// func finalizeRef(v ref)
+					"syscall/js.finalizeRef": (v_ref) => {
+						// Note: TinyGo does not support finalizers so this is only called
+						// for one specific case, by js.go:jsString. and can/might leak memory.
+						const id = v_ref & 0xffffffffn;
+						if (this._goRefCounts?.[id] !== undefined) {
+							this._goRefCounts[id]--;
+							if (this._goRefCounts[id] === 0) {
+								const v = this._values[id];
+								this._values[id] = null;
+								this._ids.delete(v);
+								this._idPool.push(id);
+							}
+						} else {
+							console.error("syscall/js.finalizeRef: unknown id", id);
+						}
+					},
+
+					// func stringVal(value string) ref
+					"syscall/js.stringVal": (value_ptr, value_len) => {
+						value_ptr >>>= 0;
+						const s = loadString(value_ptr, value_len);
+						return boxValue(s);
+					},
+
+					// func valueGet(v ref, p string) ref
+					"syscall/js.valueGet": (v_ref, p_ptr, p_len) => {
+						let prop = loadString(p_ptr, p_len);
+						let v = unboxValue(v_ref);
+						let result = Reflect.get(v, prop);
+						return boxValue(result);
+					},
+
+					// func valueSet(v ref, p string, x ref)
+					"syscall/js.valueSet": (v_ref, p_ptr, p_len, x_ref) => {
+						const v = unboxValue(v_ref);
+						const p = loadString(p_ptr, p_len);
+						const x = unboxValue(x_ref);
+						Reflect.set(v, p, x);
+					},
+
+					// func valueDelete(v ref, p string)
+					"syscall/js.valueDelete": (v_ref, p_ptr, p_len) => {
+						const v = unboxValue(v_ref);
+						const p = loadString(p_ptr, p_len);
+						Reflect.deleteProperty(v, p);
+					},
+
+					// func valueIndex(v ref, i int) ref
+					"syscall/js.valueIndex": (v_ref, i) => {
+						return boxValue(Reflect.get(unboxValue(v_ref), i));
+					},
+
+					// valueSetIndex(v ref, i int, x ref)
+					"syscall/js.valueSetIndex": (v_ref, i, x_ref) => {
+						Reflect.set(unboxValue(v_ref), i, unboxValue(x_ref));
+					},
+
+					// func valueCall(v ref, m string, args []ref) (ref, bool)
+					"syscall/js.valueCall": (ret_addr, v_ref, m_ptr, m_len, args_ptr, args_len, args_cap) => {
+						const v = unboxValue(v_ref);
+						const name = loadString(m_ptr, m_len);
+						const args = loadSliceOfValues(args_ptr, args_len, args_cap);
+						try {
+							const m = Reflect.get(v, name);
+							storeValue(ret_addr, Reflect.apply(m, v, args));
+							mem().setUint8(ret_addr + 8, 1);
+						} catch (err) {
+							storeValue(ret_addr, err);
+							mem().setUint8(ret_addr + 8, 0);
+						}
+					},
+
+					// func valueInvoke(v ref, args []ref) (ref, bool)
+					"syscall/js.valueInvoke": (ret_addr, v_ref, args_ptr, args_len, args_cap) => {
+						try {
+							const v = unboxValue(v_ref);
+							const args = loadSliceOfValues(args_ptr, args_len, args_cap);
+							storeValue(ret_addr, Reflect.apply(v, undefined, args));
+							mem().setUint8(ret_addr + 8, 1);
+						} catch (err) {
+							storeValue(ret_addr, err);
+							mem().setUint8(ret_addr + 8, 0);
+						}
+					},
+
+					// func valueNew(v ref, args []ref) (ref, bool)
+					"syscall/js.valueNew": (ret_addr, v_ref, args_ptr, args_len, args_cap) => {
+						const v = unboxValue(v_ref);
+						const args = loadSliceOfValues(args_ptr, args_len, args_cap);
+						try {
+							storeValue(ret_addr, Reflect.construct(v, args));
+							mem().setUint8(ret_addr + 8, 1);
+						} catch (err) {
+							storeValue(ret_addr, err);
+							mem().setUint8(ret_addr+ 8, 0);
+						}
+					},
+
+					// func valueLength(v ref) int
+					"syscall/js.valueLength": (v_ref) => {
+						return unboxValue(v_ref).length;
+					},
+
+					// valuePrepareString(v ref) (ref, int)
+					"syscall/js.valuePrepareString": (ret_addr, v_ref) => {
+						const s = String(unboxValue(v_ref));
+						const str = encoder.encode(s);
+						storeValue(ret_addr, str);
+						mem().setInt32(ret_addr + 8, str.length, true);
+					},
+
+					// valueLoadString(v ref, b []byte)
+					"syscall/js.valueLoadString": (v_ref, slice_ptr, slice_len, slice_cap) => {
+						const str = unboxValue(v_ref);
+						loadSlice(slice_ptr, slice_len, slice_cap).set(str);
+					},
+
+					// func valueInstanceOf(v ref, t ref) bool
+					"syscall/js.valueInstanceOf": (v_ref, t_ref) => {
+ 						return unboxValue(v_ref) instanceof unboxValue(t_ref);
+					},
+
+					// func copyBytesToGo(dst []byte, src ref) (int, bool)
+					"syscall/js.copyBytesToGo": (ret_addr, dest_addr, dest_len, dest_cap, src_ref) => {
+						let num_bytes_copied_addr = ret_addr;
+						let returned_status_addr = ret_addr + 4; // Address of returned boolean status variable
+
+						const dst = loadSlice(dest_addr, dest_len);
+						const src = unboxValue(src_ref);
+						if (!(src instanceof Uint8Array || src instanceof Uint8ClampedArray)) {
+							mem().setUint8(returned_status_addr, 0); // Return "not ok" status
+							return;
+						}
+						const toCopy = src.subarray(0, dst.length);
+						dst.set(toCopy);
+						mem().setUint32(num_bytes_copied_addr, toCopy.length, true);
+						mem().setUint8(returned_status_addr, 1); // Return "ok" status
+					},
+
+					// copyBytesToJS(dst ref, src []byte) (int, bool)
+					// Originally copied from upstream Go project, then modified:
+					//   https://github.com/golang/go/blob/3f995c3f3b43033013013e6c7ccc93a9b1411ca9/misc/wasm/wasm_exec.js#L404-L416
+					"syscall/js.copyBytesToJS": (ret_addr, dst_ref, src_addr, src_len, src_cap) => {
+						let num_bytes_copied_addr = ret_addr;
+						let returned_status_addr = ret_addr + 4; // Address of returned boolean status variable
+
+						const dst = unboxValue(dst_ref);
+						const src = loadSlice(src_addr, src_len);
+						if (!(dst instanceof Uint8Array || dst instanceof Uint8ClampedArray)) {
+							mem().setUint8(returned_status_addr, 0); // Return "not ok" status
+							return;
+						}
+						const toCopy = src.subarray(0, dst.length);
+						dst.set(toCopy);
+						mem().setUint32(num_bytes_copied_addr, toCopy.length, true);
+						mem().setUint8(returned_status_addr, 1); // Return "ok" status
+					},
+				}
+			};
+
+			// Go 1.20 uses 'env'. Go 1.21 uses 'gojs'.
+			// For compatibility, we use both as long as Go 1.20 is supported.
+			this.importObject.env = this.importObject.gojs;
+		}
+
+		async run(instance) {
+			this._inst = instance;
+			this._values = [ // JS values that Go currently has references to, indexed by reference id
+				NaN,
+				0,
+				null,
+				true,
+				false,
+				global,
+				this,
+			];
+			this._goRefCounts = []; // number of references that Go has to a JS value, indexed by reference id
+			this._ids = new Map();  // mapping from JS values to reference ids
+			this._idPool = [];      // unused ids that have been garbage collected
+			this.exited = false;    // whether the Go program has exited
+			this.exitCode = 0;
+
+			if (this._inst.exports._start) {
+				let exitPromise = new Promise((resolve, reject) => {
+					this._resolveExitPromise = resolve;
+				});
+
+				// Run program, but catch the wasmExit exception that's thrown
+				// to return back here.
+				try {
+					this._inst.exports._start();
+				} catch (e) {
+					if (e !== wasmExit) throw e;
+				}
+
+				await exitPromise;
+				return this.exitCode;
+			} else {
+				this._inst.exports._initialize();
+			}
+		}
+
+		_resume() {
+			if (this.exited) {
+				throw new Error("Go program has already exited");
+			}
+			try {
+				this._inst.exports.resume();
+			} catch (e) {
+				if (e !== wasmExit) throw e;
+			}
+			if (this.exited) {
+				this._resolveExitPromise();
+			}
+		}
+
+		_makeFuncWrapper(id) {
+			const go = this;
+			return function () {
+				const event = { id: id, this: this, args: arguments };
+				go._pendingEvent = event;
+				go._resume();
+				return event.result;
+			};
+		}
+	}
+
+	if (
+		global.require &&
+		global.require.main === module &&
+		global.process &&
+		global.process.versions &&
+		!global.process.versions.electron
+	) {
+		if (process.argv.length != 3) {
+			console.error("usage: go_js_wasm_exec [wasm binary] [arguments]");
+			process.exit(1);
+		}
+
+		const go = new Go();
+		WebAssembly.instantiate(fs.readFileSync(process.argv[2]), go.importObject).then(async (result) => {
+			let exitCode = await go.run(result.instance);
+			process.exit(exitCode);
+		}).catch((err) => {
+			console.error(err);
+			process.exit(1);
+		});
+	}
+})();