cyberark-mcp 1.0.1 → 1.0.2

package/README.md

@@ -1,19 +1,42 @@
 # cyberark-mcp
 
-CyberArk PVWA API: logon, safes, accounts. Token cached per process.
+Password breach checks and identity security audits - no API key.
+
+## Tools
+
+- `check_password` — Check a password against known data breaches using k-anonymity, so only five characters of its SHA-1 hash are sent and the password itself never leaves your machine. No API key needed.
+- `check_passwords` — Check up to 10 passwords for known breaches in one call and report how many have already been leaked.
+- `password_strength` — Score a password offline: entropy, character classes, common-word, keyboard and sequence patterns, plus an estimated offline crack time and a clear verdict.
+- `generate_password` — Generate a random password from a cryptographically secure source, with control over length and character classes, and report its estimated crack time.
+- `breach_catalog` — List breaches from the Have I Been Pwned catalogue, largest first, filtered by company domain or year, with the number of accounts and the kinds of data exposed.
+- `breach_detail` — Look up one breach by name and get its date, exposed account count, verification status and the classes of data leaked.
+- `domain_email_security` — Audit a domain's anti-spoofing setup: SPF, DMARC, DKIM selectors, MX records and CAA, graded A to F with the exact gaps to fix.
+- `identify_hash` — Identify the likely algorithm behind a hash string — bcrypt, Argon2, crypt formats, MD5, SHA-1, SHA-256, SHA-512 and more — entirely offline.
+- `hash_text` — Compute MD5, SHA-1, SHA-256 or SHA-512 digests of a string locally, for checksum and fingerprint checks.
+- `breach_timeline` — Year-by-year view of known breaches from Have I Been Pwned: how many sites were breached and how many accounts were exposed.
+- `subdomain_inventory` — Resolve common subdomains of a domain and show what each points to, flagging third-party CNAME targets that no longer resolve.
 
 ## Setup
 
-```bash
-export CYBERARK_BASE_URL=...
-```
+No setup. Breach lookups use the public k-anonymity API and the rest runs locally.
 
-Needs CYBERARK_BASE_URL (PVWA host) plus CYBERARK_USERNAME and CYBERARK_PASSWORD.
+Part of [awesome-mcps](https://github.com/mrfentmen/awesome-mcps).
 
-## Tools
+<!-- paywall -->
+## Premium tools
 
-- `list_safes` — CyberArk safes visible to the logon user.
-- `list_accounts` — CyberArk accounts, optionally filtered by safe.
-- `get_account` — One CyberArk account by id (metadata, not the password value).
+These tools need a license key:
 
-Part of [awesome-mcps](https://github.com/mrfentmen/awesome-mcps).
+* `password_variation_audit`
+* `dns_record_inventory`
+
+Buy a key at https://mcp-marketplace.io/server/io-github-mrfentmen-cyberark-mcp and set it in your MCP client config:
+
+```json
+"env": { "MCP_LICENSE_KEY": "mcp_live_..." }
+```
+
+The key is checked against MCP Marketplace, cached for 24 hours, and keeps
+working offline once one check has succeeded. Every other tool on this server
+stays free.
+<!-- /paywall -->

package/dist/api.d.ts

@@ -1,7 +1,70 @@
-export declare class CyberarkError extends Error {
-    constructor(message: string);
-}
 export declare function errorMessage(e: unknown): string;
-export declare function listSafes(): Promise<string>;
-export declare function listAccounts(safeName?: string): Promise<string>;
-export declare function getAccount(accountId: string): Promise<string>;
+export declare function checkPassword(args: {
+    password: string;
+}): Promise<string>;
+export declare function checkPasswords(args: {
+    passwords: string[];
+}): Promise<string>;
+export interface StrengthResult {
+    length: number;
+    classes: number;
+    entropyBits: number;
+    crackSeconds: number;
+    findings: string[];
+    verdict: string;
+}
+/** Scores a password locally. Nothing is transmitted. */
+export declare function analyzeStrength(password: string): StrengthResult;
+export declare function passwordStrength(args: {
+    password: string;
+}): Promise<string>;
+export declare function generatePassword(args: {
+    length?: number;
+    symbols?: boolean;
+    digits?: boolean;
+    upperCase?: boolean;
+}): Promise<string>;
+export declare function breachCatalog(args: {
+    domain?: string;
+    year?: number;
+    limit?: number;
+}): Promise<string>;
+export declare function breachDetail(args: {
+    name: string;
+}): Promise<string>;
+export declare function domainEmailSecurity(args: {
+    domain: string;
+}): Promise<string>;
+export declare function identifyHash(args: {
+    hash: string;
+}): Promise<string>;
+export declare function hashText(args: {
+    text: string;
+    algorithm?: string;
+}): Promise<string>;
+export declare function breachTimeline(args: {
+    from?: number;
+    to?: number;
+}): Promise<string>;
+export declare function subdomainInventory(args: {
+    domain: string;
+    names?: string;
+    limit?: number;
+}): Promise<string>;
+export interface DnsInventoryArgs {
+    domain: string;
+}
+/** The full public DNS picture for a domain: delegation, mail, policy and zone authority in one pass. */
+export declare function dnsRecordInventory(args: DnsInventoryArgs): Promise<string>;
+export interface DnssecArgs {
+    domain: string;
+}
+/** Whether a domain is actually DNSSEC-signed and validated, following the chain from DS to DNSKEY to RRSIG. */
+export declare function dnssecStatus(args: DnssecArgs): Promise<string>;
+export interface VariationAuditArgs {
+    base: string;
+    year?: number;
+    limit?: number;
+}
+/** Builds the mutation dictionary a credential-stuffing attack would use from one base word and reports which variants are already breached. */
+export declare function passwordVariationAudit(args: VariationAuditArgs): Promise<string>;

package/dist/api.js

@@ -1,75 +1,735 @@
-export class CyberarkError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "CyberarkError";
-    }
-}
+import { createHash, randomInt } from "node:crypto";
+const UA = "mrfentmen-cyberark-mcp/1.0";
+const PWNED = "https://api.pwnedpasswords.com";
+const HIBP = "https://haveibeenpwned.com/api/v3";
+const DOH = "https://dns.google/resolve";
 export function errorMessage(e) {
     return e instanceof Error ? e.message : String(e);
 }
-const UA = { "User-Agent": "awesome-mcps/1.0" };
-function envStrict(name) {
-    const v = process.env[name];
-    if (!v)
-        throw new CyberarkError(`Set the ${name} environment variable.`);
-    return v;
-}
-async function apiBase() {
-    return envStrict("CYBERARK_BASE_URL").replace(/\/$/, "");
-}
-let cachedToken = "";
-async function authHeaders() {
-    if (!cachedToken) {
-        const base = await apiBase();
-        const res = await fetch(`${base}/PasswordVault/API/Auth/Cyberark/Logon`, {
-            method: "POST",
-            headers: { ...UA, "Content-Type": "application/json" },
-            body: JSON.stringify({ username: envStrict("CYBERARK_USERNAME"), password: envStrict("CYBERARK_PASSWORD") }),
-        });
-        if (!res.ok)
-            throw new CyberarkError(`CyberArk logon failed: HTTP ${res.status}`);
-        const data = (await res.json());
-        if (!data.CyberArkLogonResult)
-            throw new CyberarkError("CyberArk logon returned no token");
-        cachedToken = data.CyberArkLogonResult;
-    }
-    return { Authorization: cachedToken };
-}
-function pretty(data) {
-    const t = typeof data === "string" ? data : JSON.stringify(data, null, 2);
-    return t.length > 12000 ? t.slice(0, 12000) + "\n…(truncated)" : t;
-}
-async function req(url, init = {}) {
-    const res = await fetch(url, { headers: { ...UA, ...(await authHeaders()), ...(init.headers ?? {}) }, ...init });
-    const ct = res.headers.get("content-type") ?? "";
-    const data = ct.includes("json") ? await res.json() : await res.text();
-    if (!res.ok) {
-        const detail = typeof data === "string" ? data.slice(0, 300) : JSON.stringify(data).slice(0, 300);
-        throw new CyberarkError(`HTTP ${res.status}: ${detail}`);
-    }
-    return data;
-}
-export async function listSafes() {
-    const base = await apiBase();
-    let url = `${base}/PasswordVault/API/Safes`;
-    const data = await req(url);
-    return pretty(data);
-}
-export async function listAccounts(safeName) {
-    const base = await apiBase();
-    let url = `${base}/PasswordVault/API/Accounts`;
-    const qs = new URLSearchParams();
-    if (safeName !== undefined)
-        qs.append("safeName", String(safeName));
-    const qstr = qs.toString();
-    if (qstr)
-        url += (url.includes('?') ? '&' : '?') + qstr;
-    const data = await req(url);
-    return pretty(data);
-}
-export async function getAccount(accountId) {
-    const base = await apiBase();
-    let url = `${base}/PasswordVault/API/Accounts/${encodeURIComponent(String(accountId))}`;
-    const data = await req(url);
-    return pretty(data);
+/**
+ * Checks a password against the Have I Been Pwned range API using k-anonymity:
+ * only the first five characters of the SHA-1 hash ever leave this server, and
+ * the full password is never sent or logged.
+ */
+async function pwnedCount(password) {
+    if (!password)
+        throw new Error("Provide the password to check.");
+    const hash = createHash("sha1").update(password, "utf8").digest("hex").toUpperCase();
+    const prefix = hash.slice(0, 5);
+    const suffix = hash.slice(5);
+    const res = await fetch(`${PWNED}/range/${prefix}`, {
+        headers: { "User-Agent": UA, "Add-Padding": "true" },
+        signal: AbortSignal.timeout(20000),
+    });
+    if (!res.ok)
+        throw new Error(`Have I Been Pwned returned HTTP ${res.status}.`);
+    const body = await res.text();
+    for (const line of body.split(/\r?\n/)) {
+        const [candidate, count] = line.split(":");
+        if (candidate?.trim().toUpperCase() === suffix)
+            return Number(count) || 0;
+    }
+    return 0;
+}
+export async function checkPassword(args) {
+    const count = await pwnedCount(args.password);
+    const lines = count > 0
+        ? [
+            `BREACHED — this password appears in ${count.toLocaleString("en-US")} known data breach record(s).`,
+            "Do not use it. Attackers try these first and it is not safe for any account.",
+        ]
+        : [
+            "Not found in any known breach.",
+            "It has not appeared in a public data breach dump. Pair it with a unique password per site.",
+        ];
+    return [
+        `Password breach check`,
+        `Only the first 5 characters of the SHA-1 hash were sent (k-anonymity), never the password itself.`,
+        "",
+        ...lines,
+    ].join("\n");
+}
+export async function checkPasswords(args) {
+    const list = (args.passwords ?? []).map((p) => String(p)).filter(Boolean).slice(0, 10);
+    if (!list.length)
+        return "Provide up to 10 passwords to check.";
+    const rows = [];
+    let breached = 0;
+    // Sequential so a burst of requests does not get rate limited.
+    for (let i = 0; i < list.length; i += 1) {
+        const count = await pwnedCount(list[i]);
+        if (count > 0)
+            breached += 1;
+        rows.push(`#${i + 1}: ${count > 0 ? `BREACHED (${count.toLocaleString("en-US")} record(s))` : "not in any breach"}`);
+    }
+    return [
+        `Checked ${list.length} password(s): ${breached} already breached.`,
+        "Passwords are never stored or echoed — each is hashed and only its 5-character hash prefix is sent.",
+        "",
+        ...rows,
+    ].join("\n");
+}
+const COMMON_WORDS = [
+    "password", "letmein", "welcome", "admin", "qwerty", "iloveyou", "monkey", "dragon",
+    "football", "baseball", "sunshine", "princess", "login", "abc123", "changeme", "secret",
+    "summer", "winter", "spring", "autumn", "shadow", "master", "freedom", "whatever",
+    "michael", "jordan", "superman", "trustno1", "starwars", "computer", "internet",
+];
+const KEYBOARD_RUNS = ["qwertyuiop", "asdfghjkl", "zxcvbnm", "1234567890"];
+function humanDuration(seconds) {
+    if (seconds < 1)
+        return "less than a second";
+    const units = [
+        ["year", 31557600], ["day", 86400], ["hour", 3600], ["minute", 60], ["second", 1],
+    ];
+    for (const [name, size] of units) {
+        const value = seconds / size;
+        if (value >= 1) {
+            const rounded = Math.round(value);
+            return `${rounded.toLocaleString("en-US")} ${name}${rounded === 1 ? "" : "s"}`;
+        }
+    }
+    return "less than a second";
+}
+/** Scores a password locally. Nothing is transmitted. */
+export function analyzeStrength(password) {
+    const value = password ?? "";
+    const length = value.length;
+    const findings = [];
+    const hasLower = /[a-z]/.test(value);
+    const hasUpper = /[A-Z]/.test(value);
+    const hasDigit = /\d/.test(value);
+    const hasSymbol = /[^A-Za-z0-9]/.test(value);
+    const classes = [hasLower, hasUpper, hasDigit, hasSymbol].filter(Boolean).length;
+    let alphabet = 0;
+    if (hasLower)
+        alphabet += 26;
+    if (hasUpper)
+        alphabet += 26;
+    if (hasDigit)
+        alphabet += 10;
+    if (hasSymbol)
+        alphabet += 33;
+    let entropyBits = alphabet > 0 ? length * Math.log2(alphabet) : 0;
+    if (length < 12)
+        findings.push(`Only ${length} character(s) — use at least 12, ideally 16 or a passphrase.`);
+    if (classes < 3)
+        findings.push(`Uses ${classes} character type(s) — mix upper case, lower case, digits and symbols.`);
+    if (/(.)\1{2,}/.test(value))
+        findings.push("Repeats the same character three or more times.");
+    if (/(012|123|234|345|456|567|678|789|890|abc|bcd|cde|def)/i.test(value))
+        findings.push("Contains a straight sequence like 123 or abc.");
+    const lowerValue = value.toLowerCase();
+    for (const run of KEYBOARD_RUNS) {
+        for (let i = 0; i + 4 <= run.length; i += 1) {
+            const chunk = run.slice(i, i + 4);
+            if (lowerValue.includes(chunk)) {
+                findings.push(`Contains the keyboard pattern "${chunk}".`);
+                break;
+            }
+        }
+    }
+    const matchedWord = COMMON_WORDS.find((word) => lowerValue.includes(word));
+    if (matchedWord)
+        findings.push(`Contains the common word "${matchedWord}".`);
+    const hasYear = /(19|20)\d{2}/.test(value);
+    if (hasYear)
+        findings.push("Contains a four-digit year, which is easy to guess.");
+    const capitalisedPlus = /^[A-Z][a-z]{3,}[\d!@#$%^&*.]{1,6}$/.test(value);
+    if (capitalisedPlus)
+        findings.push("Looks like a capitalised word plus digits or symbols — a pattern cracking tools try early.");
+    const keyboardRun = KEYBOARD_RUNS.some((run) => lowerValue.includes(run.slice(0, 4)));
+    const sequence = /(012|123|234|345|456|567|678|789|890|abc|bcd|cde|def)/i.test(value);
+    if (matchedWord || keyboardRun || sequence || hasYear || capitalisedPlus) {
+        // Dictionary words, keyboard walks, sequences and years collapse the search
+        // space, so bill those passwords far below the raw alphabet product.
+        entropyBits = Math.min(entropyBits, length * 3);
+    }
+    // 10 billion guesses per second: a modern offline attack on a fast hash.
+    const guesses = Math.pow(2, Math.max(entropyBits, 1));
+    const crackSeconds = guesses / 1e10;
+    const verdict = crackSeconds > 31557600 * 100
+        ? "Strong"
+        : crackSeconds > 31557600
+            ? "Reasonable"
+            : crackSeconds > 86400
+                ? "Weak"
+                : "Very weak";
+    return { length, classes, entropyBits: Math.round(entropyBits), crackSeconds, findings, verdict };
+}
+export async function passwordStrength(args) {
+    const r = analyzeStrength(args.password);
+    return [
+        "Password strength analysis (computed locally, never sent anywhere)",
+        `Verdict: ${r.verdict}`,
+        `Length: ${r.length} character(s) | Character types used: ${r.classes} of 4`,
+        `Estimated entropy: ${r.entropyBits} bits`,
+        `Offline crack time at 10 billion guesses/second: ${humanDuration(r.crackSeconds)}`,
+        "",
+        r.findings.length
+            ? `Issues found (${r.findings.length}):\n${r.findings.map((f) => `  - ${f}`).join("\n")}`
+            : "No obvious weaknesses found.",
+    ].join("\n");
+}
+const SYMBOLS = "!@#$%^&*()-_=+[]{};:,.?/";
+export async function generatePassword(args) {
+    const length = Math.min(Math.max(Number(args.length ?? 20) || 20, 8), 128);
+    const pools = ["abcdefghijkmnopqrstuvwxyz"];
+    if (args.upperCase !== false)
+        pools.push("ABCDEFGHJKLMNPQRSTUVWXYZ");
+    if (args.digits !== false)
+        pools.push("23456789");
+    if (args.symbols !== false)
+        pools.push(SYMBOLS);
+    const all = pools.join("");
+    const chars = [];
+    // One character from every pool first, so the result always uses each class.
+    for (const pool of pools) {
+        if (chars.length >= length)
+            break;
+        chars.push(pool[randomInt(0, pool.length)]);
+    }
+    while (chars.length < length)
+        chars.push(all[randomInt(0, all.length)]);
+    // Shuffle with a cryptographic random source so the required characters are not first.
+    for (let i = chars.length - 1; i > 0; i -= 1) {
+        const j = randomInt(0, i + 1);
+        const tmp = chars[i];
+        chars[i] = chars[j];
+        chars[j] = tmp;
+    }
+    const password = chars.join("");
+    const r = analyzeStrength(password);
+    return [
+        "Generated password (from a cryptographically secure random source)",
+        "",
+        password,
+        "",
+        `Length: ${length} | Character classes: ${r.classes} of 4 | Entropy: ${r.entropyBits} bits`,
+        `Offline crack time: ${humanDuration(r.crackSeconds)}`,
+        "Store it in a secret manager, not in a document or chat.",
+    ].join("\n");
+}
+export async function breachCatalog(args) {
+    const res = await fetch(`${HIBP}/breaches`, {
+        headers: { "User-Agent": UA, Accept: "application/json" },
+        signal: AbortSignal.timeout(20000),
+    });
+    if (!res.ok)
+        throw new Error(`Have I Been Pwned returned HTTP ${res.status}.`);
+    let breaches = (await res.json());
+    if (args.domain) {
+        const wanted = args.domain.trim().toLowerCase();
+        breaches = breaches.filter((b) => (b.Domain ?? "").toLowerCase().includes(wanted));
+    }
+    if (args.year) {
+        breaches = breaches.filter((b) => b.BreachDate?.startsWith(String(args.year)));
+    }
+    breaches = breaches.filter((b) => !b.IsSensitive);
+    breaches.sort((a, b) => b.PwnCount - a.PwnCount);
+    const limit = Math.min(Math.max(Number(args.limit ?? 15) || 15, 1), 100);
+    const shown = breaches.slice(0, limit);
+    const lines = [
+        `Breach catalogue${args.domain ? ` for "${args.domain}"` : ""}${args.year ? ` in ${args.year}` : ""} — ${breaches.length} matching breach(es), largest first`,
+        "Source: Have I Been Pwned, which aggregates publicly disclosed breaches.",
+        "",
+    ];
+    shown.forEach((b, i) => {
+        lines.push(`${i + 1}. ${b.Title} (${b.Domain || "no domain"})`);
+        lines.push(`   breached ${b.BreachDate} | ${b.PwnCount.toLocaleString("en-US")} accounts | data: ${(b.DataClasses ?? []).join(", ")}`);
+    });
+    if (!shown.length)
+        lines.push("No breaches matched those filters.");
+    return lines.join("\n");
+}
+export async function breachDetail(args) {
+    const name = (args.name ?? "").trim();
+    if (!name)
+        return "Provide a breach name such as LinkedIn or Adobe.";
+    const res = await fetch(`${HIBP}/breach/${encodeURIComponent(name)}`, {
+        headers: { "User-Agent": UA, Accept: "application/json" },
+        signal: AbortSignal.timeout(20000),
+    });
+    if (res.status === 404)
+        return `No breach named "${name}" is in the Have I Been Pwned catalogue.`;
+    if (!res.ok)
+        throw new Error(`Have I Been Pwned returned HTTP ${res.status}.`);
+    const b = (await res.json());
+    return [
+        `Breach: ${b.Title}`,
+        `Domain: ${b.Domain || "not disclosed"}`,
+        `Breach date: ${b.BreachDate}`,
+        `Added to the catalogue: ${b.AddedDate?.slice(0, 10) ?? "unknown"}`,
+        `Accounts exposed: ${b.PwnCount.toLocaleString("en-US")}`,
+        `Verified by the site: ${b.IsVerified ? "yes" : "no"}`,
+        `Data classes: ${(b.DataClasses ?? []).join(", ")}`,
+        "",
+        b.Description?.replace(/<[^>]+>/g, "").slice(0, 1200) ?? "",
+    ].filter(Boolean).join("\n");
+}
+const TYPE_NAMES = {
+    1: "A", 2: "NS", 5: "CNAME", 15: "MX", 16: "TXT", 257: "CAA",
+};
+async function dns(name, type) {
+    const res = await fetch(`${DOH}?name=${encodeURIComponent(name)}&type=${encodeURIComponent(type)}`, {
+        headers: { "User-Agent": UA, Accept: "application/dns-json" },
+        signal: AbortSignal.timeout(15000),
+    });
+    if (!res.ok)
+        throw new Error(`DNS-over-HTTPS returned HTTP ${res.status}.`);
+    return (await res.json());
+}
+const records = (d, type) => (d.Answer ?? [])
+    .filter((row) => TYPE_NAMES[row.type ?? 0] === type)
+    // TXT answers arrive wrapped in quotes; CAA answers start with a flag digit and
+    // must keep their inner quotes, so only strip a pair that wraps the whole value.
+    .map((row) => String(row.data ?? "").trim().replace(/^"([\s\S]*)"$/, "$1"));
+const DKIM_SELECTORS = ["default", "google", "selector1", "selector2", "k1", "mail", "dkim"];
+export async function domainEmailSecurity(args) {
+    const raw = (args.domain ?? "").trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+    if (!raw || !raw.includes("."))
+        return "Provide a domain like example.com.";
+    const [spfRes, dmarcRes, mxRes, caaRes] = await Promise.all([
+        dns(raw, "TXT"),
+        dns(`_dmarc.${raw}`, "TXT"),
+        dns(raw, "MX"),
+        dns(raw, "CAA"),
+    ]);
+    const spf = records(spfRes, "TXT").find((r) => r.startsWith("v=spf1"));
+    const dmarc = records(dmarcRes, "TXT").find((r) => r.startsWith("v=DMARC1"));
+    const mx = records(mxRes, "MX");
+    const caa = records(caaRes, "CAA");
+    const dkimHits = [];
+    for (const selector of DKIM_SELECTORS) {
+        const res = await dns(`${selector}._domainkey.${raw}`, "TXT");
+        if (records(res, "TXT").some((r) => /v=DKIM1|k=rsa|p=/.test(r)))
+            dkimHits.push(selector);
+    }
+    const checks = [
+        ["SPF record", Boolean(spf), spf ?? "missing — anyone can send mail claiming to be this domain"],
+        ["DMARC policy", Boolean(dmarc), dmarc ?? "missing — receiving servers have no instruction for spoofed mail"],
+        ["DKIM signing", dkimHits.length > 0, dkimHits.length ? `published selectors: ${dkimHits.join(", ")}` : `no key found at common selectors (${DKIM_SELECTORS.join(", ")})`],
+        ["MX records", mx.length > 0, mx.length ? `${mx.length} mail host(s)` : "no MX record — the domain cannot receive mail"],
+        ["CAA record", caa.length > 0, caa.length ? caa.join(" | ") : "missing — any certificate authority may issue certificates for this domain"],
+    ];
+    const passing = checks.filter(([, ok]) => ok).length;
+    const grade = passing === 5 ? "A" : passing === 4 ? "B" : passing === 3 ? "C" : passing === 2 ? "D" : "F";
+    return [
+        `Email and identity security for ${raw}`,
+        `Grade: ${grade} — ${passing} of ${checks.length} controls in place`,
+        "",
+        ...checks.map(([name, ok, detail]) => `${ok ? "PASS" : "MISS"} ${name}\n     ${detail}`),
+        "",
+        spf && /[-~?]all/.test(spf)
+            ? `SPF enforcement: "${spf.match(/[-~?]all/)?.[0]}" (${spf.includes("-all") ? "rejects unauthorised senders" : spf.includes("~all") ? "soft-fails unauthorised senders" : "allows unauthorised senders"})`
+            : "",
+        dmarc && /p=(none|quarantine|reject)/.test(dmarc)
+            ? `DMARC policy: ${dmarc.match(/p=(none|quarantine|reject)/)?.[1]}`
+            : "",
+    ].filter(Boolean).join("\n");
+}
+// ---- batch-3 tools: hash ID, hashing, breach trends, subdomain inventory (2026-09-27) ----
+const HASH_PATTERNS = [
+    { name: "bcrypt", pattern: /^\$2[aby]?\$\d{2}\$[./A-Za-z0-9]{53}$/, note: "bcrypt, with the cost factor in the third field" },
+    { name: "argon2", pattern: /^\$argon2(i|d|id)\$/, note: "Argon2 — modern password hash" },
+    { name: "sha512crypt", pattern: /^\$6\$/, note: "SHA-512 crypt, used in Linux /etc/shadow" },
+    { name: "sha256crypt", pattern: /^\$5\$/, note: "SHA-256 crypt, used in Linux /etc/shadow" },
+    { name: "md5crypt", pattern: /^\$1\$/, note: "MD5 crypt — obsolete" },
+    { name: "phpass", pattern: /^\$P\$[./A-Za-z0-9]{31}$/, note: "phpass, used by older WordPress and phpBB" },
+    { name: "mysql5", pattern: /^\*[A-F0-9]{40}$/, note: "MySQL 5 password hash" },
+    { name: "windows-lmntlm", pattern: /^[a-f0-9]{32}:[a-f0-9]{32}$/i, note: "Windows LM:NTLM pair" },
+    { name: "md5", pattern: /^[a-f0-9]{32}$/i, note: "MD5 or NTLM — same length, both fast and broken" },
+    { name: "sha1", pattern: /^[a-f0-9]{40}$/i, note: "SHA-1 or MySQL 4.1 password hash" },
+    { name: "sha256", pattern: /^[a-f0-9]{64}$/i, note: "SHA-256 or SHA3-256" },
+    { name: "sha512", pattern: /^[a-f0-9]{128}$/i, note: "SHA-512 or SHA3-512" },
+    { name: "crc32", pattern: /^[a-f0-9]{8}$/i, note: "CRC-32 checksum, not a security hash" },
+];
+export async function identifyHash(args) {
+    const value = (args.hash ?? "").trim();
+    if (!value)
+        throw new Error("Provide a hash string to identify.");
+    if (value.length > 512)
+        throw new Error("That is longer than any supported hash; paste one hash at a time.");
+    const matches = HASH_PATTERNS.filter((p) => p.pattern.test(value));
+    const lines = [
+        `Hash identification (${value.length} character(s))`,
+        `Preview: ${value.slice(0, 72)}${value.length > 72 ? "…" : ""}`,
+        "",
+        matches.length ? `Possible formats (${matches.length}):` : "No known hash format matched.",
+        ...matches.map((m) => `  - ${m.name}: ${m.note}`),
+    ];
+    if (!matches.length) {
+        lines.push("A hash is normally hex or starts with $; check for a truncation, a salt prefix, or mixed case that broke the pattern.");
+    }
+    const weak = matches.some((m) => ["md5", "sha1", "crc32", "md5crypt"].includes(m.name));
+    if (weak)
+        lines.push("", "Warning: MD5, SHA-1 and CRC-32 are unsuitable for password storage. Migrate to bcrypt, scrypt or Argon2.");
+    lines.push("", "The format was identified locally — nothing was cracked and nothing left this machine.");
+    return lines.join("\n");
+}
+const HASH_ALGORITHMS = ["md5", "sha1", "sha256", "sha512"];
+export async function hashText(args) {
+    const value = args.text ?? "";
+    if (!value)
+        throw new Error("Provide the text to hash.");
+    const wanted = (args.algorithm ?? "all").trim().toLowerCase();
+    const chosen = wanted === "all" ? [...HASH_ALGORITHMS] : HASH_ALGORITHMS.filter((a) => a === wanted);
+    if (!chosen.length)
+        throw new Error(`algorithm must be one of ${HASH_ALGORITHMS.join(", ")} or all`);
+    return [
+        `Hashes of ${value.length} character(s), computed locally:`,
+        ...chosen.map((a) => `${a}: ${createHash(a).update(value, "utf8").digest("hex")}`),
+        "",
+        "MD5 and SHA-1 are checksums, not password storage. Use bcrypt, scrypt or Argon2 for credentials.",
+    ].join("\n");
+}
+export async function breachTimeline(args) {
+    const res = await fetch(`${HIBP}/breaches`, {
+        headers: { "User-Agent": UA, Accept: "application/json" },
+        signal: AbortSignal.timeout(20000),
+    });
+    if (!res.ok)
+        throw new Error(`Have I Been Pwned returned HTTP ${res.status}.`);
+    const breaches = (await res.json()).filter((b) => !b.IsSensitive);
+    const thisYear = new Date().getFullYear();
+    const from = Math.min(Math.max(Math.floor(Number(args.from ?? 2004) || 2004), 1990), thisYear);
+    const to = Math.min(Math.max(Math.floor(Number(args.to ?? thisYear) || thisYear), from), thisYear);
+    const byYear = new Map();
+    for (const b of breaches) {
+        const year = Number((b.BreachDate ?? "").slice(0, 4));
+        if (!Number.isFinite(year) || year < from || year > to)
+            continue;
+        const row = byYear.get(year) ?? { breaches: 0, accounts: 0 };
+        row.breaches += 1;
+        row.accounts += Number(b.PwnCount ?? 0);
+        byYear.set(year, row);
+    }
+    const years = [...byYear.entries()].sort((a, b) => a[0] - b[0]);
+    if (!years.length)
+        return `No breaches in the Have I Been Pwned catalogue between ${from} and ${to}.`;
+    const totBreaches = years.reduce((s, [, r]) => s + r.breaches, 0);
+    const totAccounts = years.reduce((s, [, r]) => s + r.accounts, 0);
+    return [
+        `Have I Been Pwned breaches per year, ${from}-${to}`,
+        `${totBreaches} breached site(s) and ${totAccounts.toLocaleString("en-US")} exposed account record(s) in that window.`,
+        "",
+        ...years.map(([year, row]) => `${year}: ${String(row.breaches).padStart(4)} breach(es) | ${row.accounts.toLocaleString("en-US").padStart(16)} accounts`),
+    ].join("\n");
+}
+const TAKEOVER_SERVICES = [
+    { suffix: "github.io", service: "GitHub Pages" },
+    { suffix: "s3.amazonaws.com", service: "Amazon S3" },
+    { suffix: "herokuapp.com", service: "Heroku" },
+    { suffix: "netlify.app", service: "Netlify" },
+    { suffix: "vercel.app", service: "Vercel" },
+    { suffix: "myshopify.com", service: "Shopify" },
+    { suffix: "azurewebsites.net", service: "Azure App Service" },
+    { suffix: "cloudfront.net", service: "Amazon CloudFront" },
+    { suffix: "fastly.net", service: "Fastly" },
+    { suffix: "wordpress.com", service: "WordPress.com" },
+    { suffix: "surge.sh", service: "Surge" },
+    { suffix: "fly.dev", service: "Fly.io" },
+    { suffix: "onrender.com", service: "Render" },
+    { suffix: "web.app", service: "Firebase Hosting" },
+];
+const DEFAULT_SUBDOMAINS = [
+    "www", "mail", "dev", "staging", "api", "app", "cdn", "blog", "shop", "test",
+    "admin", "portal", "docs", "support", "status", "beta", "demo", "m", "vpn", "assets",
+];
+async function lookupHost(name, type) {
+    const body = await dns(name, type);
+    return { status: body.Status ?? -1, values: records(body, type) };
+}
+export async function subdomainInventory(args) {
+    const raw = (args.domain ?? "").trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+    if (!raw || !raw.includes("."))
+        return "Provide a domain like example.com.";
+    const candidates = args.names
+        ? args.names.split(/[,\s]+/).map((s) => s.trim().toLowerCase().replace(/\.$/, "")).filter(Boolean)
+        : DEFAULT_SUBDOMAINS;
+    const limit = Math.min(Math.max(Math.floor(Number(args.limit ?? 20) || 20), 1), 40);
+    const list = [...new Set(candidates)].slice(0, limit);
+    const rows = [];
+    const findings = [];
+    for (const name of list) {
+        const host = `${name}.${raw}`;
+        const cname = await lookupHost(host, "CNAME");
+        if (cname.values.length) {
+            const target = cname.values[0];
+            const bare = target.replace(/\.$/, "");
+            const targetA = await lookupHost(bare, "A");
+            const service = TAKEOVER_SERVICES.find((s) => bare.toLowerCase().endsWith(s.suffix));
+            const dangling = targetA.values.length === 0 || targetA.status === 3;
+            rows.push(`${host} -> CNAME ${bare}${service ? ` (${service.service})` : ""} | target ${dangling ? "does not resolve" : `resolves to ${targetA.values.slice(0, 2).join(", ")}`}`);
+            if (dangling && service) {
+                findings.push(`${host} points at ${service.service} but the target does not resolve — claim the resource or remove the record.`);
+            }
+            continue;
+        }
+        const a = await lookupHost(host, "A");
+        if (a.values.length) {
+            rows.push(`${host} -> ${a.values.slice(0, 3).join(", ")}`);
+            continue;
+        }
+        rows.push(`${host} -> no A or CNAME record${a.status === 3 ? " (NXDOMAIN)" : a.status !== 0 ? ` (DNS status ${a.status})` : ""}`);
+    }
+    return [
+        `Subdomain inventory for ${raw} (${list.length} name(s), DNS-over-HTTPS)`,
+        "",
+        ...rows,
+        "",
+        findings.length
+            ? `Possible dangling records (${findings.length}):\n${findings.map((f) => `  - ${f}`).join("\n")}`
+            : "No dangling third-party CNAME records found in this sample.",
+        "Resolving subdomains is reconnaissance, so only run this against domains you own or are authorised to test.",
+    ].join("\n");
+}
+// ---- muxD tools:
+const cleanDomain = (v) => (v ?? "").trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "").replace(/\.$/, "");
+const stripOuterQuotes = (v) => v.trim().replace(/^"([\s\S]*)"$/, "$1");
+/**
+ * The shared TYPE_NAMES table in this file only covers A, NS, CNAME, MX, TXT and
+ * CAA, so filtering through it silently yields nothing for SOA, AAAA, DS, DNSKEY
+ * and RRSIG. Filter by numeric type here instead so those are read correctly.
+ */
+const DNS_TYPES = {
+    A: 1, NS: 2, CNAME: 5, SOA: 6, MX: 15, TXT: 16, AAAA: 28, DS: 43, RRSIG: 46, DNSKEY: 48, CAA: 257,
+};
+function typedRecords(body, type) {
+    const want = DNS_TYPES[type];
+    if (want === undefined)
+        throw new Error(`Unsupported record type ${type}.`);
+    return (body.Answer ?? [])
+        .filter((row) => row.type === want)
+        .map((row) => String(row.data ?? "").trim().replace(/^"([\s\S]*)"$/, "$1"));
+}
+/** A DoH query with the DNSSEC OK bit set, so the resolver returns RRSIGs and the AD flag. */
+async function dnssecQuery(name, type) {
+    const res = await fetch(`${DOH}?name=${encodeURIComponent(name)}&type=${encodeURIComponent(type)}&do=1`, {
+        headers: { "User-Agent": UA, Accept: "application/dns-json" },
+        signal: AbortSignal.timeout(15000),
+    });
+    if (!res.ok)
+        throw new Error(`DNS-over-HTTPS returned HTTP ${res.status}.`);
+    return (await res.json());
+}
+/** The full public DNS picture for a domain: delegation, mail, policy and zone authority in one pass. */
+export async function dnsRecordInventory(args) {
+    const raw = cleanDomain(args.domain);
+    if (!raw || !raw.includes("."))
+        return "Provide a domain like example.com.";
+    const types = [
+        ["NS", "delegation"],
+        ["A", "web endpoints"],
+        ["AAAA", "IPv6 endpoints"],
+        ["MX", "mail exchangers"],
+        ["TXT", "text policy records"],
+        ["SOA", "zone authority"],
+        ["CAA", "certificate authority policy"],
+    ];
+    const results = await Promise.all(types.map(async ([type, label]) => {
+        try {
+            return { type, label, body: await dns(raw, type) };
+        }
+        catch (e) {
+            return { type, label, error: e instanceof Error ? e.message : String(e) };
+        }
+    }));
+    const lines = [`DNS inventory for ${raw} (via DNS-over-HTTPS)`, ""];
+    for (const r of results) {
+        lines.push(`${r.label} (${r.type}):`);
+        if ("error" in r && r.error) {
+            lines.push(`  lookup failed: ${r.error}`);
+            continue;
+        }
+        const body = r.body;
+        const found = typedRecords(body, r.type);
+        if (!found.length) {
+            const note = body.Status === 3 ? "none (NXDOMAIN for this type)" : "none published";
+            lines.push(`  ${note}`);
+            continue;
+        }
+        const shown = r.type === "TXT" ? found.slice(0, 12) : found.slice(0, 8);
+        for (const value of shown)
+            lines.push(`  ${value.length > 150 ? `${value.slice(0, 150)}…` : value}`);
+        if (found.length > shown.length)
+            lines.push(`  ...and ${found.length - shown.length} more`);
+    }
+    const find = (t) => {
+        const r = results.find((x) => x.type === t);
+        return r && !("error" in r) ? typedRecords(r.body, t) : [];
+    };
+    const ns = find("NS");
+    const soa = find("SOA");
+    const caa = find("CAA");
+    const mx = find("MX");
+    const txt = find("TXT");
+    lines.push("");
+    const notes = [];
+    if (ns.length) {
+        const registrars = new Set(ns.map((n) => n.replace(/\.$/, "").split(".").slice(-2).join(".")));
+        lines.push(`Delegated to ${ns.length} name server(s) across ${registrars.size} operator(s): ${[...registrars].join(", ")}`);
+        const glue = ns.filter((n) => !(n.replace(/\.$/, "") in {}));
+        if (glue.length !== ns.length)
+            lines.push(`  ${ns.length} name server record(s) in total`);
+    }
+    if (soa.length) {
+        const parts = soa[0].split(/\s+/);
+        const mname = parts[0] ?? "?";
+        const serial = parts[2] ?? "?";
+        lines.push(`Zone authority: primary ${mname.replace(/\.$/, "")}, serial ${serial}`);
+        if (/^\d{1,2}$/.test(serial))
+            notes.push(`SOA serial ${serial} is far below a normal epoch-based value, so this zone is not following the usual change-detection convention.`);
+    }
+    if (mx.length) {
+        const nullMx = mx.filter((m) => /^\s*0\s+\.\s*$/.test(m) || /^0 \.$/.test(m.trim()));
+        if (nullMx.length)
+            notes.push("A null MX (0 .) is published, which explicitly tells every mail server not to attempt delivery to this domain.");
+    }
+    else if (txt.length) {
+        notes.push("No MX record is published. If mail for this domain is expected, nothing will route it unless an MX-less sender falls back to A/AAAA, which almost none do.");
+    }
+    if (!caa.length) {
+        notes.push("No CAA record is published, so any public CA may issue a certificate for this domain. CAA is the only place to restrict that.");
+    }
+    else {
+        lines.push(`CAA permits: ${caa.join("; ")}`);
+    }
+    const spf = txt.filter((t) => /^v=spf1/i.test(t));
+    const dmarc = txt.filter((t) => /^v=DMARC1/i.test(t));
+    if (spf.length)
+        lines.push(`SPF present on the apex (${spf.length} record(s)); use domain_email_security for the full read.`);
+    if (dmarc.length)
+        lines.push("DMARC present on the apex.");
+    if (notes.length)
+        lines.push("", "Notes:", ...notes.map((n) => `- ${n}`));
+    return lines.join("\n");
+}
+/** Whether a domain is actually DNSSEC-signed and validated, following the chain from DS to DNSKEY to RRSIG. */
+export async function dnssecStatus(args) {
+    const raw = cleanDomain(args.domain);
+    if (!raw || !raw.includes("."))
+        return "Provide a domain like example.com.";
+    const [dsRes, dnskeyRes, aRes] = await Promise.all([
+        dnssecQuery(raw, "DS"),
+        dnssecQuery(raw, "DNSKEY"),
+        dnssecQuery(raw, "A"),
+    ]);
+    const ds = typedRecords(dsRes, "DS");
+    const keys = typedRecords(dnskeyRes, "DNSKEY");
+    const sigs = (aRes.Answer ?? []).filter((row) => row.type === 46);
+    const ad = aRes.AD === true;
+    const lines = [`DNSSEC status for ${raw} (DNS-over-HTTPS with the DO bit set)`, ""];
+    lines.push(`Delegation signer (DS) records: ${ds.length}`);
+    for (const d of ds.slice(0, 4))
+        lines.push(`  ${d}`);
+    lines.push(`Signing keys (DNSKEY) published: ${keys.length}`);
+    // A DNSKEY record reads "flags protocol algorithm public-key", so the key role
+    // lives in the flags field at index 0, not after the algorithm.
+    const flagOf = (k) => Number(k.trim().split(/\s+/)[0] ?? 0);
+    const algOf = (k) => k.trim().split(/\s+/)[2] ?? "?";
+    const algs = keys.map(algOf).filter(Boolean);
+    if (algs.length) {
+        const counts = new Map();
+        for (const a of algs)
+            counts.set(a, (counts.get(a) ?? 0) + 1);
+        lines.push(`  algorithms in use: ${[...counts.entries()].map(([a, n]) => `algorithm ${a} (${n} key${n === 1 ? "" : "s"})`).join(", ")}`);
+        const ksk = keys.filter((k) => flagOf(k) === 257).length;
+        const zsk = keys.filter((k) => flagOf(k) === 256).length;
+        const other = keys.length - ksk - zsk;
+        lines.push(`  key roles: ${ksk} key-signing (257), ${zsk} zone-signing (256)${other ? `, ${other} with another flag value` : ""}`);
+    }
+    lines.push(`Signatures returned with a normal A query: ${sigs.length}`);
+    lines.push(`Authenticated Data flag on the A answer: ${ad ? "set, the resolver validated the chain" : "not set"}`);
+    lines.push("");
+    if (ad) {
+        // The AD flag is the resolver's own verdict and outranks whatever appeared in
+        // the answer section, so trust it first.
+        lines.push("Signed and validated: the resolver returned the Authenticated Data flag, meaning it successfully built a chain of trust to a root key and verified the RRSIG on this answer.");
+        if (!ds.length || !keys.length) {
+            lines.push(`The answer section did not carry the DS and DNSKEY records for this query (${ds.length} DS, ${keys.length} DNSKEY returned), so the chain was validated out of band or from cache. That is normal and not a problem.`);
+        }
+        lines.push("Consequence for email: a receiver can verify a message claiming this domain was genuinely sent by it, provided the receiver actually validates DNSSEC. Most mail receivers do not, so treat this as defence in depth rather than a substitute for DMARC.");
+    }
+    else if (ds.length && keys.length) {
+        lines.push("Signed: this domain publishes both a DS record in the parent zone and DNSKEYs in its own zone, so a validating resolver can check answers for it.");
+        lines.push("The AD flag is still clear, which usually means the resolver in use was not a validating one, or the chain could not be completed. It is not proof the domain is unsigned.");
+    }
+    else if (!ds.length && !keys.length) {
+        lines.push("Not signed: this domain publishes neither a DS record nor any DNSKEYs, so answers for it can be spoofed by anyone on the path.");
+        lines.push("Consequence for email: a receiver cannot tell a forged message claiming to be from this domain from a genuine one using DNSSEC alone. Use DMARC with an enforcing policy instead, which is what actually stops spoofing.");
+    }
+    else if (!ds.length && keys.length) {
+        lines.push("Zoned but undelegated: DNSKEYs are published in the child zone but no DS record exists in the parent. The keys are ignored, so the domain is still treated as unsigned. This usually means signing was prepared but never completed.");
+    }
+    else {
+        lines.push("Broken chain: a DS record exists in the parent zone but the child publishes no DNSKEYs, so validation must fail. Expect SERVFAIL for validating resolvers until the keys are restored.");
+    }
+    return lines.join("\n");
+}
+const CAPS = "!@#$%^&*()-_=+[]{};:,.?";
+const LEET = { a: "@", e: "3", i: "1", o: "0", s: "$" };
+/** The predictable variations a credential-stuffing list would contain for a base word. */
+function mutations(base, year) {
+    const word = base.trim();
+    const lower = word.toLowerCase();
+    const capitalised = lower.charAt(0).toUpperCase() + lower.slice(1);
+    const upper = lower.toUpperCase();
+    const thisYear = String(year);
+    const lastYear = String(year - 1);
+    const leet = lower.replace(/[aeios]/g, (ch) => LEET[ch] ?? ch);
+    const out = new Set();
+    const bases = [word, lower, capitalised, upper, leet];
+    for (const b of bases) {
+        if (!b)
+            continue;
+        out.add(b);
+        for (const suffix of [thisYear, lastYear, "1", "12", "123", "1234", "!", "@", "#", "$", "!1", "2024"]) {
+            out.add(`${b}${suffix}`);
+            out.add(`${suffix}${b}`);
+        }
+        out.add(`${b}!`);
+        out.add(`${b}.`);
+        out.add(`${b}@${thisYear}`);
+    }
+    return [...out];
+}
+/** Builds the mutation dictionary a credential-stuffing attack would use from one base word and reports which variants are already breached. */
+export async function passwordVariationAudit(args) {
+    const base = (args.base ?? "").trim();
+    if (!base)
+        return "Provide a base word, name or company, e.g. acme.";
+    if (base.length < 3)
+        return "Provide at least three characters, otherwise every short string is already in a breach list.";
+    const year = Math.floor(Number(args.year ?? new Date().getUTCFullYear())) || new Date().getUTCFullYear();
+    const limit = Math.min(Math.max(Math.floor(Number(args.limit ?? 40)) || 40, 5), 80);
+    const all = mutations(base, year).slice(0, limit);
+    const rows = [];
+    for (const pw of all) {
+        // pwnedCount already sends only the 5-character hash prefix, so no password
+        // leaves this server.
+        rows.push({ pw, count: await pwnedCount(pw) });
+    }
+    const breached = rows.filter((r) => r.count > 0).sort((a, b) => b.count - a.count);
+    const clean = rows.filter((r) => r.count === 0);
+    const lines = [
+        `Mutation audit for "${base}" (${rows.length} candidate password${rows.length === 1 ? "" : "s"}: ${limit - rows.length > 0 ? `first ${rows.length} of ${limit}, ` : ""}lower/capitalised/upper/leetspeak forms crossed with ${year}, ${year - 1} and common numeric and symbol suffixes)`,
+        `Each candidate was hashed locally and only its 5-character prefix was sent to Have I Been Pwned, so no password or full hash left this server.`,
+        `That is one range request per candidate, roughly 700 KB each, so this is a deliberate audit rather than something to run on every keystroke.`,
+        "",
+        `Result: ${breached.length} of ${rows.length} candidates are already in a public breach, covering ${breached.reduce((s, r) => s + r.count, 0).toLocaleString("en-US")} total leak records.`,
+    ];
+    if (breached.length) {
+        lines.push("", "Most exposed variants:");
+        for (const r of breached.slice(0, 20))
+            lines.push(`  ${r.count.toLocaleString("en-US").padStart(12)} records  ${r.pw}`);
+        if (breached.length > 20)
+            lines.push(`  ...and ${breached.length - 20} more breached variants`);
+    }
+    if (clean.length) {
+        lines.push("", `Not found in any breach (${clean.length}): ${clean.slice(0, 12).map((r) => r.pw).join(", ")}${clean.length > 12 ? ", ..." : ""}`);
+        lines.push("  A clean result means the string is not in a public dump. It is still a predictable variation of a word an attacker will try, so it is not a safe choice for an account anyone else could guess the basis of.");
+    }
+    lines.push("", "Why this matters: if a password is a mutation of a company or product name, it will be in an attacker's dictionary even when no breach contains it, because lists like this are generated from the same guesswork.");
+    return lines.join("\n");
 }

package/dist/license.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export declare function premiumRequired(tool: string): Promise<string | null>;

package/dist/license.js

@@ -0,0 +1,79 @@
+// Premium tools on this server need a license key bought from MCP Marketplace.
+// Buyers put the key in their MCP client config as MCP_LICENSE_KEY. Every tool
+// that is not listed in PREMIUM keeps working without a key.
+const SLUG = "cyberark-mcp";
+// Tools that need a key. Everything else is free.
+const PREMIUM = new Set([
+    "password_variation_audit",
+    "dns_record_inventory",
+]);
+const BUY_URL = `https://mcp-marketplace.io/server/io-github-mrfentmen-${SLUG}`;
+// The license check calls the marketplace's verify endpoint directly instead of
+// using @mcp_marketplace/license. That SDK sends no `apikey` header, so every
+// check it makes is rejected by Supabase before it reaches the function. The
+// publishable key below is public by design - it ships in mcp-marketplace.io's
+// own JavaScript and only ever reaches their licence check.
+const DEFAULT_VERIFY_URL = "https://virupvwhtkpkjsiskckg.supabase.co/functions/v1/verify-key";
+const PUBLISHABLE_KEY = "sb_publishable_BuqlW96Ke8C_zzJG-LQv1Q_YHi_r_4h";
+const OK_CACHE_MS = 60 * 60 * 1000;
+const BAD_CACHE_MS = 60 * 1000;
+const seen = new Map();
+const REASONS = {
+    missing_key: "no key is set",
+    invalid_format: "that key is not a valid MCP Marketplace key",
+    not_found: "that key was not found",
+    revoked: "that key has been revoked",
+    rotated: "that key was rotated, use your new one",
+    expired: "that key has expired, renew it",
+    rate_limited: "there were too many checks just now, try again shortly",
+    network_error: "the license server could not be reached",
+};
+function blocked(tool, reason) {
+    const why = REASONS[reason] ?? `the license server answered "${reason}"`;
+    return `"${tool}" needs a license key, but ${why}. ` +
+        `Set MCP_LICENSE_KEY in your MCP client config. Get a key: ${BUY_URL}`;
+}
+async function verify(key) {
+    const res = await fetch(process.env.MCP_LICENSE_VERIFY_URL || DEFAULT_VERIFY_URL, {
+        method: "POST",
+        headers: {
+            apikey: PUBLISHABLE_KEY,
+            Authorization: `Bearer ${PUBLISHABLE_KEY}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ key, slug: SLUG }),
+        // an unusable key answers 400 with a JSON body, so read the body either way
+        signal: AbortSignal.timeout(15000),
+    });
+    const data = (await res.json());
+    if (typeof data?.valid !== "boolean")
+        return { valid: false, reason: "unexpected_response" };
+    return data;
+}
+/**
+ * Returns null when the caller may run the tool, or a short message telling
+ * them how to get a key.
+ *
+ * A good key is remembered for an hour, so a busy session does not hit the
+ * license server on every call and keeps working through a brief outage.
+ */
+export async function premiumRequired(tool) {
+    if (!PREMIUM.has(tool))
+        return null;
+    const key = process.env.MCP_LICENSE_KEY;
+    if (!key)
+        return blocked(tool, "missing_key");
+    const hit = seen.get(key);
+    if (hit && Date.now() - hit.at < (hit.valid ? OK_CACHE_MS : BAD_CACHE_MS)) {
+        return hit.valid ? null : blocked(tool, hit.reason ?? "invalid");
+    }
+    let result;
+    try {
+        result = await verify(key);
+    }
+    catch {
+        result = { valid: false, reason: "network_error" };
+    }
+    seen.set(key, { ...result, at: Date.now() });
+    return result.valid ? null : blocked(tool, result.reason ?? "invalid");
+}

package/dist/server.js

@@ -1,52 +1,241 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { z } from "zod";
-import { errorMessage, listSafes, listAccounts, getAccount, } from "./api.js";
+import { breachCatalog, breachDetail, checkPassword, checkPasswords, domainEmailSecurity, errorMessage, generatePassword, passwordStrength, identifyHash, hashText, breachTimeline, subdomainInventory, dnsRecordInventory, dnssecStatus, passwordVariationAudit } from "./api.js";
+import { premiumRequired } from "./license.js";
 const text = (t) => ({ content: [{ type: "text", text: t }] });
 const textError = (t) => ({ content: [{ type: "text", text: t }], isError: true });
 const READ_ONLY = { readOnlyHint: true, openWorldHint: true };
 export function createServer() {
     const server = new McpServer({
         name: "cyberark-mcp",
-        version: "1.0.0",
+        version: "2.0.0",
     });
-    server.registerTool("list_safes", {
-        title: "List safes",
-        description: "CyberArk safes visible to the logon user.",
-        inputSchema: z.object({}),
+    server.registerTool("check_password", {
+        title: "Check if a password is breached",
+        description: "Check a password against known data breaches using k-anonymity, so only five characters of its SHA-1 hash are sent and the password itself never leaves your machine. No API key needed.",
+        inputSchema: z.object({
+            password: z.string().describe("The password to check. It is hashed locally and never stored."),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ password }) => {
+        try {
+            return text(await checkPassword({ password }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("check_passwords", {
+        title: "Check several passwords",
+        description: "Check up to 10 passwords for known breaches in one call and report how many have already been leaked.",
+        inputSchema: z.object({
+            passwords: z.array(z.string()).describe("Passwords to check, maximum 10."),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ passwords }) => {
+        try {
+            return text(await checkPasswords({ passwords }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("password_strength", {
+        title: "Score password strength",
+        description: "Score a password offline: entropy, character classes, common-word, keyboard and sequence patterns, plus an estimated offline crack time and a clear verdict.",
+        inputSchema: z.object({
+            password: z.string().describe("The password to score. Analysis happens locally."),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ password }) => {
+        try {
+            return text(await passwordStrength({ password }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("generate_password", {
+        title: "Generate a strong password",
+        description: "Generate a random password from a cryptographically secure source, with control over length and character classes, and report its estimated crack time.",
+        inputSchema: z.object({
+            length: z.number().describe("Password length, 8 to 128. Defaults to 20.").optional(),
+            symbols: z.boolean().describe("Include symbols. Defaults to true.").optional(),
+            digits: z.boolean().describe("Include digits. Defaults to true.").optional(),
+            upperCase: z.boolean().describe("Include upper case letters. Defaults to true.").optional(),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ length, symbols, digits, upperCase }) => {
+        try {
+            return text(await generatePassword({ length, symbols, digits, upperCase }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("breach_catalog", {
+        title: "Browse known breaches",
+        description: "List breaches from the Have I Been Pwned catalogue, largest first, filtered by company domain or year, with the number of accounts and the kinds of data exposed.",
+        inputSchema: z.object({
+            domain: z.string().describe("Filter by company domain, for example adobe.com.").optional(),
+            year: z.number().describe("Filter by breach year, for example 2019.").optional(),
+            limit: z.number().describe("How many breaches to list, 1 to 100. Defaults to 15.").optional(),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ domain, year, limit }) => {
+        try {
+            return text(await breachCatalog({ domain, year, limit }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("breach_detail", {
+        title: "Breach details",
+        description: "Look up one breach by name and get its date, exposed account count, verification status and the classes of data leaked.",
+        inputSchema: z.object({
+            name: z.string().describe("Breach name such as LinkedIn or Adobe."),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ name }) => {
+        try {
+            return text(await breachDetail({ name }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("domain_email_security", {
+        title: "Domain email security audit",
+        description: "Audit a domain's anti-spoofing setup: SPF, DMARC, DKIM selectors, MX records and CAA, graded A to F with the exact gaps to fix.",
+        inputSchema: z.object({
+            domain: z.string().describe("Domain to audit, for example example.com."),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ domain }) => {
+        try {
+            return text(await domainEmailSecurity({ domain }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("identify_hash", {
+        title: "Identify a hash",
+        description: "Identify the likely algorithm behind a hash string — bcrypt, Argon2, crypt formats, MD5, SHA-1, SHA-256, SHA-512 and more — entirely offline.",
+        inputSchema: z.object({
+            hash: z.string().describe("One hash string to identify."),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ hash }) => {
+        try {
+            return text(await identifyHash({ hash }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("hash_text", {
+        title: "Hash text",
+        description: "Compute MD5, SHA-1, SHA-256 or SHA-512 digests of a string locally, for checksum and fingerprint checks.",
+        inputSchema: z.object({
+            text: z.string().describe("Text to hash."),
+            algorithm: z.string().describe("md5, sha1, sha256, sha512, or all (default all).").optional(),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ text: value, algorithm }) => {
+        try {
+            return text(await hashText({ text: value, algorithm }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("breach_timeline", {
+        title: "Breach timeline",
+        description: "Year-by-year view of known breaches from Have I Been Pwned: how many sites were breached and how many accounts were exposed.",
+        inputSchema: z.object({
+            from: z.number().describe("First year to include, defaults to 2004.").optional(),
+            to: z.number().describe("Last year to include, defaults to the current year.").optional(),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ from, to }) => {
+        try {
+            return text(await breachTimeline({ from, to }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("subdomain_inventory", {
+        title: "Subdomain inventory",
+        description: "Resolve common subdomains of a domain and show what each points to, flagging third-party CNAME targets that no longer resolve.",
+        inputSchema: z.object({
+            domain: z.string().describe("Your domain, e.g. example.com."),
+            names: z.string().describe("Subdomain labels to check instead of the default 20, comma separated.").optional(),
+            limit: z.number().describe("How many labels to check, 1-40. Defaults to 20.").optional(),
+        }),
+        annotations: READ_ONLY,
+    }, async ({ domain, names, limit }) => {
+        try {
+            return text(await subdomainInventory({ domain, names, limit }));
+        }
+        catch (e) {
+            return textError(errorMessage(e));
+        }
+    });
+    server.registerTool("dns_record_inventory", {
+        title: "DNS record inventory",
+        description: "The whole public DNS picture for one domain in a single pass: delegation, A and AAAA endpoints, mail exchangers, text policy records, zone authority and CAA. Notes a null MX, a missing MX where mail is expected, an absent CAA that lets any CA issue for the domain, and an SOA serial that is not epoch-based.",
+        inputSchema: z.object({
+            domain: z.string().describe("Domain to inventory, for example example.com."),
+        }),
         annotations: READ_ONLY,
-    }, async ({}) => {
+    }, async (args) => {
+        // ---- paywall: dns_record_inventory ----
+        const paywallMessage = await premiumRequired("dns_record_inventory");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
         try {
-            return text(await listSafes());
+            return text(await dnsRecordInventory(args));
         }
         catch (e) {
             return textError(errorMessage(e));
         }
     });
-    server.registerTool("list_accounts", {
-        title: "List accounts",
-        description: "CyberArk accounts, optionally filtered by safe.",
+    server.registerTool("dnssec_status", {
+        title: "DNSSEC status",
+        description: "Whether a domain is genuinely DNSSEC-signed, following the chain: the DS record in the parent zone, the DNSKEYs in the child, the RRSIGs returned with a normal query, and whether the resolver set the Authenticated Data flag. Separates a domain that is zoned but never delegated from one whose chain is genuinely broken, and explains what that means for email spoofing.",
         inputSchema: z.object({
-            safeName: z.string().optional().describe("Safe name filter"),
+            domain: z.string().describe("Domain to check, for example example.com."),
         }),
         annotations: READ_ONLY,
-    }, async ({ safeName }) => {
+    }, async (args) => {
         try {
-            return text(await listAccounts(safeName));
+            return text(await dnssecStatus(args));
         }
         catch (e) {
             return textError(errorMessage(e));
         }
     });
-    server.registerTool("get_account", {
-        title: "Get account",
-        description: "One CyberArk account by id (metadata, not the password value).",
+    server.registerTool("password_variation_audit", {
+        title: "Password variation audit",
+        description: "Builds the mutation dictionary a credential-stuffing attack would use from one base word, crossing case forms and leetspeak with the current and previous year plus common numeric and symbol suffixes, then checks every candidate against Have I Been Pwned. Shows which variants are already leaked and how many times, and which are still clean but still predictable.",
         inputSchema: z.object({
-            accountId: z.string().describe("Account id"),
+            base: z.string().describe("Base word, name or company to mutate, e.g. acme."),
+            year: z.number().int().optional().describe("Year to use in the suffixes, defaults to the current year"),
+            limit: z.number().int().min(5).max(80).default(40).describe("Candidates to check, 5-80. Each costs one HIBP range request, default 40"),
         }),
         annotations: READ_ONLY,
-    }, async ({ accountId }) => {
+    }, async (args) => {
+        // ---- paywall: password_variation_audit ----
+        const paywallMessage = await premiumRequired("password_variation_audit");
+        if (paywallMessage)
+            return { content: [{ type: "text", text: paywallMessage }], isError: true };
+        // ---- paywall: end ----
         try {
-            return text(await getAccount(accountId));
+            return text(await passwordVariationAudit(args));
         }
         catch (e) {
             return textError(errorMessage(e));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cyberark-mcp",
-  "version": "1.0.1",
-  "description": "CyberArk PVWA API: logon, safes, accounts. Token cached per process.",
+  "version": "1.0.2",
+  "description": "Password breach checks and identity security audits - no API key.",
   "type": "module",
   "mcpName": "io.github.mrfentmen/cyberark-mcp",
   "repository": {
@@ -22,11 +22,12 @@
     "inspect": "npx @modelcontextprotocol/inspector node dist/index.js"
   },
   "keywords": [
-    "mcp",
-    "cyberark",
-    "secrets",
-    "vault",
-    "security"
+    "security",
+    "passwords",
+    "breach",
+    "dns",
+    "spf",
+    "mcp"
   ],
   "license": "MIT",
   "dependencies": {