mcp-crypto-tools
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-crypto-toolsgenerate a secure password with 16 characters"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-crypto-tools
Cryptography and encoding tools for AI agents, served via the Model Context Protocol (MCP).
Tools
hash
Hash text using MD5, SHA-1, SHA-256, SHA-512, or HMAC. Compare two hash values. Compute all algorithms at once.
Actions: hash, hmac, compare, hash_all
encode_decode
Encode and decode text using Base64, URL encoding, HTML entities, hex, or binary. Auto-detect encoding format.
Actions: base64_encode, base64_decode, url_encode, url_decode, html_encode, html_decode, hex_encode, hex_decode, binary_encode, binary_decode, detect
generate_id
Generate unique identifiers: UUID v4, nanoid, ULID, CUID, or random strings with configurable length and charset.
Types: uuid, nanoid, ulid, cuid, random
password
Generate secure passwords with configurable character sets, length, and count. Check password strength with entropy calculation and crack time estimation.
Actions: generate, check_strength
jwt
Decode JWT tokens to inspect header and payload, check expiry status, or create unsigned JWTs for testing.
Actions: decode, check_expiry, create_unsigned
Related MCP server: lit-forge MCP server
Setup
npm install
npm run buildMCP Configuration
Add to your MCP client configuration:
{
"mcpServers": {
"crypto-tools": {
"command": "node",
"args": ["D:/products/mcp-servers/mcp-crypto-tools/dist/index.js"]
}
}
}Dependencies
@modelcontextprotocol/sdk- MCP server frameworkNode.js built-in
cryptomodule - all cryptographic operations
No external crypto libraries required.
License
MIT
Available Tools
5 toolsencode_decodeA
Encode or decode text using Base64, URL encoding, HTML entities, hex, or binary. Can also auto-detect the encoding format of input.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Text to encode, decode, or detect | |
| action | Yes | Encoding/decoding action to perform |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral disclosure burden. It does reveal one meaningful trait: the ability to auto-detect input encoding. However, it does not mention error behavior for invalid decode inputs, the output format for detect, or whether decode operations can fail on malformed text.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no filler. The primary action is front-loaded, followed by a compact list of supported formats and the extended detect capability. Every word contributes to the tool's meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter utility with a self-explanatory enum, the description is nearly complete. It covers the full range of actions and the detect special case. The only gap is the absence of a stated output shape for detect or error behavior for decodes, but the core calling context is sufficiently clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds some context by grouping the enum actions into format families and highlighting the detect action, but it does not substantially enrich parameter meaning beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb-resource pair ('encode or decode text') and enumerates the supported formats (Base64, URL encoding, HTML entities, hex, binary), which distinguishes this tool from cryptographic siblings like hash or jwt. The auto-detect capability adds a distinct function, making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool — whenever encoding, decoding, or format detection is needed. However, it does not explicitly contrast with sibling tools (e.g., use hash for one-way hashing, or password for password generation), nor does it state when not to use encoding for security purposes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_idA
Generate unique identifiers: UUID v4, nanoid, ULID, CUID, or random strings with configurable length and charset.
| Name | Required | Description | Default |
|---|---|---|---|
| type | Yes | Type of ID to generate | |
| count | No | Number of IDs to generate (max 100). Default: 1 | |
| length | No | Length for nanoid or random string. Default: 21 for nanoid, 16 for random | |
| charset | No | Charset for random strings: alphanumeric, alpha, numeric, hex, lowercase, uppercase, symbols, all, or a custom string of characters. Default: alphanumeric |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It claims to generate 'unique identifiers' but random strings may not be unique if length is short, which is a potential behavioral inaccuracy. It also does not disclose that when count > 1, the return value is likely an array (not a single string), nor does it mention any randomness source or side-effect-free nature. For a pure generation tool, the description lacks detail about output shape and the uniqueness caveat.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that immediately states the function and options. It front-loads the core purpose and lists variants, with no filler or unnecessary detail. Every word earns its place, and it is easy to scan. This is exemplary brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, the description does not specify the return format (e.g., a string vs. an array when count > 1). It also omits any details about error cases (e.g., invalid charset). However, the tool is simple and the schema covers parameter constraints (max count, defaults). The main missing element is the output shape, which is not explained. This is a moderate gap given the simplicity of the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, meaning every parameter (type, count, length, charset) is fully described in the schema. The description adds only the mention of 'configurable length and charset', which is redundant. Since the schema already provides defaults and constraints (e.g., max count 100), the description adds minimal value beyond what an agent can infer from the structured data. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Generate'), a resource ('unique identifiers'), and enumerates the types (UUID v4, nanoid, ULID, CUID, random) with configurable length and charset. This clearly distinguishes it from sibling tools like hash, encode_decode, password, and jwt, which serve different purposes. An agent can immediately grasp the tool's function without inspecting the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus the sibling tools. The description implies it is for generating identifiers, and given the distinct nature of siblings, the use case is fairly obvious. However, it does not mention any specific context or exclusions (e.g., 'use this when you need a unique ID, not for cryptographic hashing'). The applicability is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hashB
Hash text using MD5, SHA-1, SHA-256, SHA-512, or HMAC. Can also compare two hash values or compute all hash algorithms at once.
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Secret key (for hmac action) | |
| text | No | Text to hash (for hash, hmac, hash_all actions) | |
| hash1 | No | First hash (for compare action) | |
| hash2 | No | Second hash (for compare action) | |
| action | Yes | Action to perform: hash (single algorithm), hmac (keyed hash), compare (compare two hashes), hash_all (all algorithms at once) | |
| encoding | No | Output encoding. Default: hex | |
| algorithm | No | Hash algorithm (for hash and hmac actions). Default: sha256 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry behavioral info. It mentions the four actions, default algorithm sha256, and default encoding hex, but does not state that hashing is one-way, that HMAC requires a key, or any side effects. For a pure utility, this is acceptable but not rich; it omits details like whether output is a string or object.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single but packed sentence. It front-loads the primary purpose and lists supported algorithms and actions efficiently. No redundant filler; however, the long list of algorithms could be abbreviated by referencing the parameter enums.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 7 parameters and four distinct actions, but the description covers the actions generically without detailing output format, return structure, or edge cases (e.g., required key for HMAC, potential errors). Since there is no output schema, the description alone must clarify what the agent gets back; it doesn't.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and every parameter has a description with enums where applicable. The description adds little beyond the schema—it repeats the action list and algorithm options but does not provide new semantic meaning or usage hints for parameters like key or encoding format specifics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it hashes text using specific algorithms (MD5, SHA-1, SHA-256, SHA-512) and supports HMAC, compare, and compute-all actions. It identifies the core resource (text) and the operation (hash/compare), but does not explicitly differentiate from sibling tools like password or jwt, which may also handle hashing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool over siblings (e.g., password, jwt, encode_decode). The description doesn't mention exclusions, prerequisites, or alternative selection criteria. Usage is implied by the action parameter but not contextualized.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
jwtA
Decode JWT tokens to inspect header and payload, check expiry status, or create unsigned JWTs for testing purposes. Not for production authentication.
| Name | Required | Description | Default |
|---|---|---|---|
| token | No | JWT token string (for decode and check_expiry) | |
| action | Yes | Action: decode (full decode), check_expiry (just expiry info), create_unsigned (create test token) | |
| payload | No | Payload object for creating unsigned JWT (for create_unsigned) | |
| expires_in_seconds | No | Expiration time in seconds from now (for create_unsigned) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It fails to mention whether signatures are verified, how malformed tokens are handled, or that decode/check_expiry might not validate the token. 'Not for production authentication' hints at security limitations but is too vague to fully disclose the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no fluff. The primary purpose is front-loaded, and the important caveat about production authentication is clearly appended. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description should explain return values, but it doesn't specify what each action returns. It also omits conditional parameter requirements (e.g., token needed for decode/check_expiry) and error behavior. For a tool with multiple modes and nested objects, this leaves significant gaps for an agent to fill.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so each parameter already has a description. The tool description does not add any extra parameter-level detail beyond the schema; it merely restates the actions via the enum. With high schema coverage, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with specific verbs and resources: decode JWT tokens to inspect header/payload, check expiry, or create unsigned JWTs for testing. It distinguishes this tool from generic siblings like encode_decode and hash by focusing exclusively on JWT operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Not for production authentication' provides an explicit exclusion, and 'for testing purposes' suggests the intended context. While it doesn't name sibling alternatives explicitly, the guidance is clear enough for an agent to know when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
passwordB
Generate secure passwords with configurable options, or check password strength with entropy calculation and crack time estimation.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Number of passwords to generate (max 100). Default: 1 | |
| action | Yes | Action: generate a password or check strength of an existing one | |
| digits | No | Include digits. Default: true | |
| length | No | Password length (for generate). Default: 16 | |
| symbols | No | Include symbols. Default: true | |
| password | No | Password to check (for check_strength action) | |
| lowercase | No | Include lowercase letters. Default: true | |
| uppercase | No | Include uppercase letters. Default: true | |
| exclude_ambiguous | No | Exclude ambiguous characters (0, O, l, I, 1). Default: false |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions entropy calculation and crack time estimation, which adds some behavioral context, but doesn't disclose output format, whether generation uses CSPRNG, what check_strength returns (score, verdict, both?), or any rate limits. For a security-related tool, the lack of detail about the strength check output is notable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One clear, efficient sentence that front-loads the primary function (generate) and adds the secondary capability (check strength). No wasted words. Could arguably add a hint about which parameters are relevant per action, but the length is appropriate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters, two modes, and no output schema or annotations, the description is adequate but thin. It covers the two actions but doesn't explain what the check_strength action returns (entropy value? crack time? recommendation?) or how defaults apply per action. An agent could call it correctly from the schema, but might not understand the return format or edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents all 9 parameters with descriptions and defaults. The description adds minimal value beyond this - it doesn't explain how parameters interact (e.g., behavior when all character-type booleans are false) or clarify which params apply to which action. Baseline 3 is appropriate given the full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear purpose: generate secure passwords or check strength with entropy and crack time. It covers the tool's two main actions (generate, check_strength) matching the action enum. However, it doesn't distinguish itself from siblings like generate_id, though the domain (password vs ID) makes the distinction fairly obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies two modes (generate vs check strength) and the schema makes action required, but there's no explicit guidance on when to choose one over the other, nor when to use this vs hash or generate_id. The context is implied rather than stated. No exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
v1.0.0- First observed
encode_decode - First observed
generate_id - First observed
hash - First observed
jwt - First observed
password
TDQS
Each tool targets a clearly distinct cryptographic/utility operation: hashing, encoding/decoding, ID generation, password handling, and JWT processing. No two tools overlap in purpose, so an agent can confidently select the correct one based on the task.
Most names follow a verb or verb_noun pattern (hash, encode_decode, generate_id), but two are nouns (password, jwt) that imply actions. The naming is still predictable and readable, with only minor stylistic deviations from a strict verb-first convention.
With exactly 5 tools, the server is well-scoped for a crypto utility toolkit. Each tool earns its place by covering a fundamental operation, and the count avoids both redundancy and incompleteness.
The toolkit covers the core crypto-adjacent utilities one would expect: hashing, encoding, ID generation, password management, and JWT inspection. A minor gap is the absence of symmetric/asymmetric encryption or digital signatures, but for the apparent purpose of text/data utilities, the surface is complete enough.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Production-grade cryptography toolkit with 31 MCP tools for classical, PQC, and KMS workflows.
Hash passwords with bcrypt and issue/verify JWT session tokens over A2A + MCP.
49 developer tools via MCP: DNS, WHOIS, IP lookup, JWT, hashing, QR, and more.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceProvides essential utility tools for text processing, file operations, hashing, temperature conversion, password generation, and date/time operations through a comprehensive MCP interface.MIT
- AlicenseAqualityCmaintenanceEnables AI clients to use developer utilities like JSON formatting, JWT decoding, UUID generation, and more via MCP.12942MIT
- AlicenseAqualityCmaintenanceExposes various cryptographic operations including key generation, symmetric/asymmetric encryption, hashing, and HMAC. Supports Fernet, AES, RSA, X.25519, and X.509 certificates.22MIT
- FlicenseNot gradedqualityDmaintenanceProvides various developer utilities such as UUID generation, timestamp conversion, Base64 encoding, color conversion, password generation, hash generation, and JSON formatting via MCP.281-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rog0x/mcp-crypto-tools'
If you have feedback or need assistance with the MCP directory API, please join our Discord server