Skip to main content
Glama
rog0x

mcp-crypto-tools

by rog0x

mcp-crypto-tools

Cryptography and encoding tools for AI agents, served via the Model Context Protocol (MCP).

Tools

hash

Hash text using MD5, SHA-1, SHA-256, SHA-512, or HMAC. Compare two hash values. Compute all algorithms at once.

Actions: hash, hmac, compare, hash_all

encode_decode

Encode and decode text using Base64, URL encoding, HTML entities, hex, or binary. Auto-detect encoding format.

Actions: base64_encode, base64_decode, url_encode, url_decode, html_encode, html_decode, hex_encode, hex_decode, binary_encode, binary_decode, detect

generate_id

Generate unique identifiers: UUID v4, nanoid, ULID, CUID, or random strings with configurable length and charset.

Types: uuid, nanoid, ulid, cuid, random

password

Generate secure passwords with configurable character sets, length, and count. Check password strength with entropy calculation and crack time estimation.

Actions: generate, check_strength

jwt

Decode JWT tokens to inspect header and payload, check expiry status, or create unsigned JWTs for testing.

Actions: decode, check_expiry, create_unsigned

Related MCP server: lit-forge MCP server

Setup

npm install
npm run build

MCP Configuration

Add to your MCP client configuration:

{
  "mcpServers": {
    "crypto-tools": {
      "command": "node",
      "args": ["D:/products/mcp-servers/mcp-crypto-tools/dist/index.js"]
    }
  }
}

Dependencies

  • @modelcontextprotocol/sdk - MCP server framework

  • Node.js built-in crypto module - all cryptographic operations

No external crypto libraries required.

License

MIT

Available Tools

5 tools
encode_decodeA

Encode or decode text using Base64, URL encoding, HTML entities, hex, or binary. Can also auto-detect the encoding format of input.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesText to encode, decode, or detect
actionYesEncoding/decoding action to perform

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral disclosure burden. It does reveal one meaningful trait: the ability to auto-detect input encoding. However, it does not mention error behavior for invalid decode inputs, the output format for detect, or whether decode operations can fail on malformed text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no filler. The primary action is front-loaded, followed by a compact list of supported formats and the extended detect capability. Every word contributes to the tool's meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter utility with a self-explanatory enum, the description is nearly complete. It covers the full range of actions and the detect special case. The only gap is the absence of a stated output shape for detect or error behavior for decodes, but the core calling context is sufficiently clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds some context by grouping the enum actions into format families and highlighting the detect action, but it does not substantially enrich parameter meaning beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb-resource pair ('encode or decode text') and enumerates the supported formats (Base64, URL encoding, HTML entities, hex, binary), which distinguishes this tool from cryptographic siblings like hash or jwt. The auto-detect capability adds a distinct function, making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool — whenever encoding, decoding, or format detection is needed. However, it does not explicitly contrast with sibling tools (e.g., use hash for one-way hashing, or password for password generation), nor does it state when not to use encoding for security purposes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_idA

Generate unique identifiers: UUID v4, nanoid, ULID, CUID, or random strings with configurable length and charset.

ParametersJSON Schema
NameRequiredDescriptionDefault
typeYesType of ID to generate
countNoNumber of IDs to generate (max 100). Default: 1
lengthNoLength for nanoid or random string. Default: 21 for nanoid, 16 for random
charsetNoCharset for random strings: alphanumeric, alpha, numeric, hex, lowercase, uppercase, symbols, all, or a custom string of characters. Default: alphanumeric

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It claims to generate 'unique identifiers' but random strings may not be unique if length is short, which is a potential behavioral inaccuracy. It also does not disclose that when count > 1, the return value is likely an array (not a single string), nor does it mention any randomness source or side-effect-free nature. For a pure generation tool, the description lacks detail about output shape and the uniqueness caveat.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that immediately states the function and options. It front-loads the core purpose and lists variants, with no filler or unnecessary detail. Every word earns its place, and it is easy to scan. This is exemplary brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description does not specify the return format (e.g., a string vs. an array when count > 1). It also omits any details about error cases (e.g., invalid charset). However, the tool is simple and the schema covers parameter constraints (max count, defaults). The main missing element is the output shape, which is not explained. This is a moderate gap given the simplicity of the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, meaning every parameter (type, count, length, charset) is fully described in the schema. The description adds only the mention of 'configurable length and charset', which is redundant. Since the schema already provides defaults and constraints (e.g., max count 100), the description adds minimal value beyond what an agent can infer from the structured data. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Generate'), a resource ('unique identifiers'), and enumerates the types (UUID v4, nanoid, ULID, CUID, random) with configurable length and charset. This clearly distinguishes it from sibling tools like hash, encode_decode, password, and jwt, which serve different purposes. An agent can immediately grasp the tool's function without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus the sibling tools. The description implies it is for generating identifiers, and given the distinct nature of siblings, the use case is fairly obvious. However, it does not mention any specific context or exclusions (e.g., 'use this when you need a unique ID, not for cryptographic hashing'). The applicability is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hashB

Hash text using MD5, SHA-1, SHA-256, SHA-512, or HMAC. Can also compare two hash values or compute all hash algorithms at once.

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoSecret key (for hmac action)
textNoText to hash (for hash, hmac, hash_all actions)
hash1NoFirst hash (for compare action)
hash2NoSecond hash (for compare action)
actionYesAction to perform: hash (single algorithm), hmac (keyed hash), compare (compare two hashes), hash_all (all algorithms at once)
encodingNoOutput encoding. Default: hex
algorithmNoHash algorithm (for hash and hmac actions). Default: sha256

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral info. It mentions the four actions, default algorithm sha256, and default encoding hex, but does not state that hashing is one-way, that HMAC requires a key, or any side effects. For a pure utility, this is acceptable but not rich; it omits details like whether output is a string or object.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single but packed sentence. It front-loads the primary purpose and lists supported algorithms and actions efficiently. No redundant filler; however, the long list of algorithms could be abbreviated by referencing the parameter enums.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 7 parameters and four distinct actions, but the description covers the actions generically without detailing output format, return structure, or edge cases (e.g., required key for HMAC, potential errors). Since there is no output schema, the description alone must clarify what the agent gets back; it doesn't.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and every parameter has a description with enums where applicable. The description adds little beyond the schema—it repeats the action list and algorithm options but does not provide new semantic meaning or usage hints for parameters like key or encoding format specifics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it hashes text using specific algorithms (MD5, SHA-1, SHA-256, SHA-512) and supports HMAC, compare, and compute-all actions. It identifies the core resource (text) and the operation (hash/compare), but does not explicitly differentiate from sibling tools like password or jwt, which may also handle hashing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool over siblings (e.g., password, jwt, encode_decode). The description doesn't mention exclusions, prerequisites, or alternative selection criteria. Usage is implied by the action parameter but not contextualized.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

jwtA

Decode JWT tokens to inspect header and payload, check expiry status, or create unsigned JWTs for testing purposes. Not for production authentication.

ParametersJSON Schema
NameRequiredDescriptionDefault
tokenNoJWT token string (for decode and check_expiry)
actionYesAction: decode (full decode), check_expiry (just expiry info), create_unsigned (create test token)
payloadNoPayload object for creating unsigned JWT (for create_unsigned)
expires_in_secondsNoExpiration time in seconds from now (for create_unsigned)

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It fails to mention whether signatures are verified, how malformed tokens are handled, or that decode/check_expiry might not validate the token. 'Not for production authentication' hints at security limitations but is too vague to fully disclose the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no fluff. The primary purpose is front-loaded, and the important caveat about production authentication is clearly appended. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description should explain return values, but it doesn't specify what each action returns. It also omits conditional parameter requirements (e.g., token needed for decode/check_expiry) and error behavior. For a tool with multiple modes and nested objects, this leaves significant gaps for an agent to fill.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so each parameter already has a description. The tool description does not add any extra parameter-level detail beyond the schema; it merely restates the actions via the enum. With high schema coverage, the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with specific verbs and resources: decode JWT tokens to inspect header/payload, check expiry, or create unsigned JWTs for testing. It distinguishes this tool from generic siblings like encode_decode and hash by focusing exclusively on JWT operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Not for production authentication' provides an explicit exclusion, and 'for testing purposes' suggests the intended context. While it doesn't name sibling alternatives explicitly, the guidance is clear enough for an agent to know when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

passwordB

Generate secure passwords with configurable options, or check password strength with entropy calculation and crack time estimation.

ParametersJSON Schema
NameRequiredDescriptionDefault
countNoNumber of passwords to generate (max 100). Default: 1
actionYesAction: generate a password or check strength of an existing one
digitsNoInclude digits. Default: true
lengthNoPassword length (for generate). Default: 16
symbolsNoInclude symbols. Default: true
passwordNoPassword to check (for check_strength action)
lowercaseNoInclude lowercase letters. Default: true
uppercaseNoInclude uppercase letters. Default: true
exclude_ambiguousNoExclude ambiguous characters (0, O, l, I, 1). Default: false

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions entropy calculation and crack time estimation, which adds some behavioral context, but doesn't disclose output format, whether generation uses CSPRNG, what check_strength returns (score, verdict, both?), or any rate limits. For a security-related tool, the lack of detail about the strength check output is notable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One clear, efficient sentence that front-loads the primary function (generate) and adds the secondary capability (check strength). No wasted words. Could arguably add a hint about which parameters are relevant per action, but the length is appropriate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 9 parameters, two modes, and no output schema or annotations, the description is adequate but thin. It covers the two actions but doesn't explain what the check_strength action returns (entropy value? crack time? recommendation?) or how defaults apply per action. An agent could call it correctly from the schema, but might not understand the return format or edge cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents all 9 parameters with descriptions and defaults. The description adds minimal value beyond this - it doesn't explain how parameters interact (e.g., behavior when all character-type booleans are false) or clarify which params apply to which action. Baseline 3 is appropriate given the full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear purpose: generate secure passwords or check strength with entropy and crack time. It covers the tool's two main actions (generate, check_strength) matching the action enum. However, it doesn't distinguish itself from siblings like generate_id, though the domain (password vs ID) makes the distinction fairly obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies two modes (generate vs check strength) and the schema makes action required, but there's no explicit guidance on when to choose one over the other, nor when to use this vs hash or generate_id. The context is implied rather than stated. No exclusions or alternatives are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv1.0.0
    • First observedencode_decode
    • First observedgenerate_id
    • First observedhash
    • First observedjwt
    • First observedpassword

TDQS

A3.7/5.0
Disambiguation5/5

Each tool targets a clearly distinct cryptographic/utility operation: hashing, encoding/decoding, ID generation, password handling, and JWT processing. No two tools overlap in purpose, so an agent can confidently select the correct one based on the task.

Naming Consistency4/5

Most names follow a verb or verb_noun pattern (hash, encode_decode, generate_id), but two are nouns (password, jwt) that imply actions. The naming is still predictable and readable, with only minor stylistic deviations from a strict verb-first convention.

Tool Count5/5

With exactly 5 tools, the server is well-scoped for a crypto utility toolkit. Each tool earns its place by covering a fundamental operation, and the count avoids both redundancy and incompleteness.

Completeness4/5

The toolkit covers the core crypto-adjacent utilities one would expect: hashing, encoding, ID generation, password management, and JWT inspection. A minor gap is the absence of symmetric/asymmetric encryption or digital signatures, but for the apparent purpose of text/data utilities, the surface is complete enough.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides essential utility tools for text processing, file operations, hashing, temperature conversion, password generation, and date/time operations through a comprehensive MCP interface.
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables AI clients to use developer utilities like JSON formatting, JWT decoding, UUID generation, and more via MCP.
    12
    94
    2
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Exposes various cryptographic operations including key generation, symmetric/asymmetric encryption, hashing, and HMAC. Supports Fernet, AES, RSA, X.25519, and X.509 certificates.
    22
    MIT
  • F
    license
    Not graded
    quality
    D
    maintenance
    Provides various developer utilities such as UUID generation, timestamp conversion, Base64 encoding, color conversion, password generation, hash generation, and JSON formatting via MCP.
    28
    1
    -

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/rog0x/mcp-crypto-tools'

If you have feedback or need assistance with the MCP directory API, please join our Discord server