password_strengthAnalyze password strength with entropy-based scoring and concrete feedback. Do not log or store the password.
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | The password to score; it is analysed in memory and not stored |
| Name | Required | Description | Default |
|---|---|---|---|
| score | No | ||
| result | No | The result, when it is not an object | |
| entropy | No | ||
| strength | No | ||
| crackTime | No |
Changes observed during successful MCP inspections. Dates show when Glama detected each change.
Input schema / properties / password / descriptionAdded value: +"The password to score; it is analysed in memory and not stored"Output schema / (root)Previous value: -nullNew value: +{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "additionalProperties": {},
+ "properties": {
+ "crackTime": {
+ "type": "string"
+ },
+ "entropy": {
+ "type": "number"
+ },
+ "result": {
+ "description": "The result, when it is not an object"
+ },
+ "score": {
+ "type": "number"
+ },
+ "strength": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+}Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare the tool read-only, idempotent, and non-destructive. The description adds meaningful behavioral context by explicitly stating 'Do not log or store the password' and clarifies the in-memory analysis approach. This goes beyond the structured hint metadata and is important for sensitive data handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no redundant wording. The primary action and scoring method are front-loaded, and the privacy warning is a necessary addition. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only tool with a full input schema and an output schema, the description is complete. It covers what the tool does, how it evaluates, and the critical privacy constraint. No important calling information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents the only parameter, including the in-memory/no-storage behavior. The description adds no additional parameter-level detail beyond what is already in the schema, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Analyze') with a clear resource ('password strength') and specifies the method ('entropy-based scoring') and output ('concrete feedback'). It is unambiguous and distinguishes the tool from the sibling validators and converters by its unique focus on password strength.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the name and description: use when password strength analysis is needed. However, there are no explicit when-to-use, when-not-to-use, or alternative tool guidance. The description does not mention any exclusions or competing sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Add one secure layer between your agents and this server.
Every tool targets a distinct resource or action, and the detailed descriptions clearly separate near neighbors like generate_test_bsn versus generate_brp_test_data, read_page versus url_screenshot versus url_to_pdf, and image_compress/convert/resize. Even with 40 tools, there is no real boundary-blurring overlap.
All names are snake_case and readable, but the set mixes conventions: verb_noun (generate_*, validate_*), noun_verb (pdf_merge, image_resize), conversion-style names (csv_to_json, html_to_pdf), and bare nouns (base64, qr_code_png). The groups are recognizable, but there is no single predictable pattern.
Forty tools is an oversized surface for an agent to consider on every call, well above the point where tool selection cost starts to hurt. The broad purpose explains the count, but many one-off utilities could be grouped or exposed selectively.
The server covers many domains—encoding, Dutch test data, image/PDF handling, memory, and workflows—but several categories are partial: there are no reverse conversions like json_to_csv or html_to_markdown, no PDF text extraction, and no workflow create/update/delete tools. Agents can work around some gaps, but notable operations are missing.