cyberark-mcp 1.0.0 → 1.0.2

package/README.md

@@ -1,19 +1,42 @@
 # cyberark-mcp
 
-CyberArk PVWA API: logon, safes, accounts. Token cached per process.
+Password breach checks and identity security audits - no API key.
+
+## Tools
+
+- `check_password` — Check a password against known data breaches using k-anonymity, so only five characters of its SHA-1 hash are sent and the password itself never leaves your machine. No API key needed.
+- `check_passwords` — Check up to 10 passwords for known breaches in one call and report how many have already been leaked.
+- `password_strength` — Score a password offline: entropy, character classes, common-word, keyboard and sequence patterns, plus an estimated offline crack time and a clear verdict.
+- `generate_password` — Generate a random password from a cryptographically secure source, with control over length and character classes, and report its estimated crack time.
+- `breach_catalog` — List breaches from the Have I Been Pwned catalogue, largest first, filtered by company domain or year, with the number of accounts and the kinds of data exposed.
+- `breach_detail` — Look up one breach by name and get its date, exposed account count, verification status and the classes of data leaked.
+- `domain_email_security` — Audit a domain's anti-spoofing setup: SPF, DMARC, DKIM selectors, MX records and CAA, graded A to F with the exact gaps to fix.
+- `identify_hash` — Identify the likely algorithm behind a hash string — bcrypt, Argon2, crypt formats, MD5, SHA-1, SHA-256, SHA-512 and more — entirely offline.
+- `hash_text` — Compute MD5, SHA-1, SHA-256 or SHA-512 digests of a string locally, for checksum and fingerprint checks.
+- `breach_timeline` — Year-by-year view of known breaches from Have I Been Pwned: how many sites were breached and how many accounts were exposed.
+- `subdomain_inventory` — Resolve common subdomains of a domain and show what each points to, flagging third-party CNAME targets that no longer resolve.
 
 ## Setup
 
-```bash
-export CYBERARK_BASE_URL=...
-```
+No setup. Breach lookups use the public k-anonymity API and the rest runs locally.
 
-Needs CYBERARK_BASE_URL (PVWA host) plus CYBERARK_USERNAME and CYBERARK_PASSWORD.
+Part of [awesome-mcps](https://github.com/mrfentmen/awesome-mcps).
 
-## Tools
+<!-- paywall -->
+## Premium tools
 
-- `list_safes` — CyberArk safes visible to the logon user.
-- `list_accounts` — CyberArk accounts, optionally filtered by safe.
-- `get_account` — One CyberArk account by id (metadata, not the password value).
+These tools need a license key:
 
-Part of [awesome-mcps](https://github.com/mrfentmen/awesome-mcps).
+* `password_variation_audit`
+* `dns_record_inventory`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-cyberark-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.d.ts

@@ -1,7 +1,70 @@
-export declare class CyberarkError extends Error {
-    constructor(message: string);
-}
 export declare function errorMessage(e: unknown): string;
-export declare function listSafes(): Promise<string>;
-export declare function listAccounts(safeName?: string): Promise<string>;
-export declare function getAccount(accountId: string): Promise<string>;
+export declare function checkPassword(args: {
+    password: string;
+}): Promise<string>;
+export declare function checkPasswords(args: {
+    passwords: string[];
+}): Promise<string>;
+export interface StrengthResult {
+    length: number;
+    classes: number;
+    entropyBits: number;
+    crackSeconds: number;
+    findings: string[];
+    verdict: string;
+}
+/** Scores a password locally. Nothing is transmitted. */
+export declare function analyzeStrength(password: string): StrengthResult;
+export declare function passwordStrength(args: {
+    password: string;
+}): Promise<string>;
+export declare function generatePassword(args: {
+    length?: number;
+    symbols?: boolean;
+    digits?: boolean;
+    upperCase?: boolean;
+}): Promise<string>;
+export declare function breachCatalog(args: {
+    domain?: string;
+    year?: number;
+    limit?: number;
+}): Promise<string>;
+export declare function breachDetail(args: {
+    name: string;
+}): Promise<string>;
+export declare function domainEmailSecurity(args: {
+    domain: string;
+}): Promise<string>;
+export declare function identifyHash(args: {
+    hash: string;
+}): Promise<string>;
+export declare function hashText(args: {
+    text: string;
+    algorithm?: string;
+}): Promise<string>;
+export declare function breachTimeline(args: {
+    from?: number;
+    to?: number;
+}): Promise<string>;
+export declare function subdomainInventory(args: {
+    domain: string;
+    names?: string;
+    limit?: number;
+}): Promise<string>;
+export interface DnsInventoryArgs {
+    domain: string;
+}
+/** The full public DNS picture for a domain: delegation, mail, policy and zone authority in one pass. */
+export declare function dnsRecordInventory(args: DnsInventoryArgs): Promise<string>;
+export interface DnssecArgs {
+    domain: string;
+}
+/** Whether a domain is actually DNSSEC-signed and validated, following the chain from DS to DNSKEY to RRSIG. */
+export declare function dnssecStatus(args: DnssecArgs): Promise<string>;
+export interface VariationAuditArgs {
+    base: string;
+    year?: number;
+    limit?: number;
+}
+/** Builds the mutation dictionary a credential-stuffing attack would use from one base word and reports which variants are already breached. */
+export declare function passwordVariationAudit(args: VariationAuditArgs): Promise<string>;