Auditable CSPRNG-backed credential generator for AI agents and machine-readable pipelines. Stable JSON schema, NIST entropy floors, SLSA 3 + cosign signed releases. CLI, Go/Python/Rust libs, MCP server.
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio counts 8 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
assess_entropy
-
estimate_crack_time
-
generate_api_key
-
generate_passphrase
-
generate_password
-
generate_pin
-
generate_secret
-
list_attacker_profiles
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 932f735 · analyzer v33 · 3d ago
danger signals1
- credential in logs credential in log rafaelperoco-secretgenerator-932f735/examples/node/generate.mjs :32
console.log(`password: ${result.password}`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 75
filesystem 8
- fs rafaelperoco-secretgenerator-932f735/cli/src/install.ts :23
} from "node:fs"; - fs rafaelperoco-secretgenerator-932f735/cli/src/run.ts :15
import { existsSync } from "node:fs"; - fs rafaelperoco-secretgenerator-932f735/cli/src/verify.ts :21
import { readFileSync } from "node:fs"; - fs (weak) rafaelperoco-secretgenerator-932f735/mcp/scripts/copy-wasm.mjs :8
import { copyFileSync, mkdirSync, existsSync } from "node:fs"; - fs rafaelperoco-secretgenerator-932f735/mcp/src/wasm.ts :8
import { readFileSync } from "node:fs"; - fs (weak) rafaelperoco-secretgenerator-932f735/web/scripts/build-llms-txt.mjs :16
import { mkdtempSync, readFileSync, writeFileSync, existsSync } from "node:fs"; - fs (weak) rafaelperoco-secretgenerator-932f735/web/scripts/build-og-image.mjs :9
import { readFileSync, writeFileSync, mkdirSync } from "node:fs"; - fs (weak) rafaelperoco-secretgenerator-932f735/web/scripts/build-releases-rss.mjs :12
import { writeFileSync } from "node:fs";
shell / exec 7
- shell rafaelperoco-secretgenerator-932f735/cli/src/install.ts :29
import { spawnSync } from "node:child_process"; - shell rafaelperoco-secretgenerator-932f735/cli/src/run.ts :14
import { spawn } from "node:child_process"; - shell rafaelperoco-secretgenerator-932f735/cli/src/verify.ts :20
import { spawnSync } from "node:child_process"; - shell (weak) rafaelperoco-secretgenerator-932f735/examples/node/generate.mjs :11
import { execFileSync } from "node:child_process"; - shell (weak) rafaelperoco-secretgenerator-932f735/mcp/scripts/copy-wasm.mjs :7
import { execSync, spawnSync } from "node:child_process"; - shell (weak) rafaelperoco-secretgenerator-932f735/web/scripts/build-llms-txt.mjs :15
import { execSync, spawnSync } from "node:child_process"; - shell rafaelperoco-secretgenerator-932f735/web/src/data/subcommands.ts :40
const NODE_SNIPPET = (subcommand: SubcommandSlug, args: string[]) => `import { execFileSync } from "node:child_process";
network 4
- net rafaelperoco-secretgenerator-932f735/cli/src/install.ts :165
const res = await fetch(url, { redirect: "follow" }); - net (weak) rafaelperoco-secretgenerator-932f735/web/scripts/build-og-image.mjs :12
import https from "node:https"; - net (weak) rafaelperoco-secretgenerator-932f735/web/scripts/build-releases-rss.mjs :53
const res = await fetch(url, { headers }); - net rafaelperoco-secretgenerator-932f735/web/src/lib/wasm.ts :139
fetch(wasmUrl),
secrets 1
- secrets (weak) rafaelperoco-secretgenerator-932f735/web/scripts/build-releases-rss.mjs :50
if (process.env.GITHUB_TOKEN) {
tool registrations 8
- generate_password rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :50
- generate_passphrase rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :107
- generate_secret rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :158
- generate_api_key rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :205
- generate_pin rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :242
- assess_entropy rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :275
- list_attacker_profiles rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :296
- estimate_crack_time rafaelperoco-secretgenerator-932f735/mcp/src/index.ts :311
install hooks 3
- prepack rafaelperoco-secretgenerator-932f735/cli/package.json :34
npm run build - postinstall rafaelperoco-secretgenerator-932f735/cli/package.json :35
node dist/install.js || echo 'secretgenerator: postinstall skipped (likely a tarball-only environment); run `npx secretgenerator --help` to retry' - prepack rafaelperoco-secretgenerator-932f735/mcp/package.json :35
npm run build
declared dependencies 8
- @types/node@^22.20.1
- typescript@^5.9.3
- github.com/spf13/cobra@v1.10.2
- github.com/spf13/pflag@v1.0.10
- github.com/inconshreveable/mousetrap@v1.1.0
- serde@1
- serde_json@1
- thiserror@2