ScorpTech x402 API

Password Generate

password_generate

Read-onlyIdempotent

Generate strong secrets with a CSPRNG (never stored or logged): random passwords (length, character classes, custom symbols, exclude look-alike characters, guarantee one of each class), diceware-style passphrases from a ~9,000-word common-English list (about 13 bits per word) (separator, capitalisation, optional digit) and PINs (weak / sequential PINs rejected). Up to 50 at once, with entropy bits, strength and offline crack-time estimate. Price: $0.001 USDC per successful call (x402, Solana). Same tool over HTTPS: GET https://scorptech.it.com/api/x402/v1/password-generate

Tool call template

This tool declares no required parameters. Add optional parameters from the input schema as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {},
    "name": "password_generate"
  }
}

Input Schema

Name	Required	Description	Default
`mode`	No		password
`count`	No
`lower`	No
`upper`	No
`words`	No	Passphrase words
`digits`	No
`length`	No	Characters (password, default 20) or digits (pin, default 6)
`exclude`	No	Characters never to use
`symbols`	No
`addNumber`	No	Passphrase: append a digit to one random word
`separator`	No		-
`symbolSet`	No	Custom symbol characters
`capitalize`	No
`requireEach`	No	At least one character of each enabled class
`excludeAmbiguous`	No	Drop look-alikes (I l 1 O 0 o \| ` ' ")

Schema Changelog

Changes observed during successful MCP inspections.

AddedOct 23, 2026

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses that values come from a CSPRNG, are never stored or logged, that up to 50 are returned per call, and — critically — that each successful call costs $0.001 USDC via x402 on Solana with an equivalent HTTPS endpoint. Payment and privacy behavior are exactly the context annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Effectively two sentences plus a price clause, with the core capability front-loaded and mode-specific options nested in tight parentheticals. Dense but zero filler; the pay-per-call and HTTPS facts are appended rather than buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the essentials for a 15-parameter, zero-required-parameter generator: what each mode yields, the output metrics returned ('entropy bits, strength and offline crack-time estimate'), and the commercial/auth model. It lacks explicit guidance on conflicting options (e.g., symbolSet vs symbols, addNumber only applying to passphrases), which matters given the absent output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 15 parameters and only 47% schema coverage, the description carries real weight: it explains character classes, custom symbols, excluding look-alikes, 'guarantee one of each class', separator, capitalisation, optional digit, and the 50-item cap. It also clarifies the mode-dependent meaning of length that the schema only hints at, though a few flags (addNumber, requireEach interactions) remain only implicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Generate strong secrets with a CSPRNG') and then enumerates exactly the three artifact types produced: random passwords, diceware-style passphrases, and PINs. An agent can distinguish it from neighbors like password_hash, password_strength, id_generate, and random_draw without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage through mode-specific detail (password vs passphrase vs PIN, 'weak / sequential PINs rejected'), which signals when each mode fits. However, it never explicitly routes the agent away from alternatives such as password_strength (checking an existing secret) or password_hash, and there are no stated prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All ScorpTech x402 API tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?