OnlineCyberTools MCP (280+ filterable tools)

crypto_scrypt_verify

Read-onlyIdempotent

Verify a plaintext password against an existing scrypt hash by recomputing the derivation from the hash's N, r, p, and salt parameters. Returns match status, parsed parameters, and strength analysis.

Instructions

Scrypt Hash Verifier. Check whether a plaintext password matches an existing scrypt hash, recomputing the derivation from the N, r, p, and salt encoded in the hash string. Use this to verify a candidate password; use crypto_scrypt instead to generate a new hash. Runs locally on the input you provide: read-only, non-destructive, contacts no external service, and is rate-limited. Returns whether the password matched, the parameters parsed from the hash, and a strength analysis of those parameters.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`password`	Yes	The plaintext password to test against the hash.
`hash`	Yes	The encoded scrypt hash to verify against, in the format produced by crypto_scrypt: $scrypt$N=<N>,r=<r>,p=<p>$<saltHex>$<base64DerivedKey>. The N, r, p, and salt are read from this string to recompute the derivation and compare it against the supplied password.

Output Schema

TableJSON Schema

Name	Required	Description
`verified`	No	True when the password matches the supplied hash.
`info`	No	Parameters parsed from the hash; null when the hash format is invalid.
`security`	No	Strength analysis of the parsed parameters; null on error.
`error`	No	Error message when verification fails (e.g. invalid hash format); null on success.

Schema Changelog

Changes observed during successful MCP inspections.

Changed11 schema fields changedv0.5.1Jun 3, 2026

addedInput schema / additionalProperties
```
Added value: +false
```

removedInput schema / properties / N

Removed value: -{
-  "type": "integer"
-}

addedInput schema / properties / hash

Added value: +{
+  "description": "The encoded scrypt hash to verify against, in the format produced by crypto_scrypt: $scrypt$N=<N>,r=<r>,p=<p>$<saltHex>$<base64DerivedKey>. The N, r, p, and salt are read from this string to recompute the derivation and compare it against the supplied password.",
+  "examples": [
+    "$scrypt$N=32768,r=8,p=1$a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6$Base64DerivedKey=="
+  ],
+  "type": "string"
+}

removedInput schema / properties / length

Removed value: -{
-  "type": "integer"
-}

removedInput schema / properties / p

Removed value: -{
-  "type": "integer"
-}

addedInput schema / properties / password / description

Added value: +"The plaintext password to test against the hash."

addedInput schema / properties / password / examples

Added value: +[
+  "correct horse battery staple"
+]

removedInput schema / properties / r

Removed value: -{
-  "type": "integer"
-}

removedInput schema / properties / salt

Removed value: -{
-  "nullable": true
-}

changedInput schema / required

Previous value: -[
-  "password",
-  "N",
-  "r",
-  "p",
-  "length",
-  "salt"
-]New value: +[
+  "password",
+  "hash"
+]

changedOutput schema / (root)

Previous value: -nullNew value: +{
+  "properties": {
+    "error": {
+      "description": "Error message when verification fails (e.g. invalid hash format); null on success.",
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "info": {
+      "description": "Parameters parsed from the hash; null when the hash format is invalid.",
+      "properties": {
+        "N": {
+          "description": "CPU/memory cost factor (a power of 2).",
+          "type": "integer"
+        },
+        "length": {
+          "description": "Derived key length in bytes.",
+          "type": "integer"
+        },
+        "p": {
+          "description": "Parallelization factor.",
+          "type": "integer"
+        },
+        "r": {
+          "description": "Block-size factor.",
+          "type": "integer"
+        },
+        "salt": {
+          "description": "Salt parsed from the hash, in hexadecimal.",
+          "type": "string"
+        },
+        "saltLength": {
+          "description": "Length of the hex salt string.",
+          "type": "integer"
+        }
+      },
+      "type": [
+        "object",
+        "null"
+      ]
+    },
+    "security": {
+      "description": "Strength analysis of the parsed parameters; null on error.",
+      "properties": {
+        "estimatedTimeMs": {
+          "description": "Rough derivation time estimate in milliseconds.",
+          "type": "number"
+        },
+        "level": {
+          "description": "Qualitative rating: Very Low, Low, Moderate, High, or Very High.",
+          "type": "string"
+        },
+        "maxScore": {
+          "description": "Maximum possible score (3.0).",
+          "type": "number"
+        },
+        "memoryUsageKB": {
+          "description": "Estimated memory use in KB.",
+          "type": "number"
+        },
+        "memoryUsageMB": {
+          "description": "Estimated memory use in MB.",
+          "type": "number"
+        },
+        "notes": {
+          "description": "Advisory notes about weak parameters.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "score": {
+          "description": "Numeric strength score.",
+          "type": "number"
+        },
+        "totalOperations": {
+          "description": "The N * r * p work factor.",
+          "type": "integer"
+        }
+      },
+      "type": [
+        "object",
+        "null"
+      ]
+    },
+    "verified": {
+      "description": "True when the password matches the supplied hash.",
+      "type": "boolean"
+    }
+  },
+  "type": "object"
+}

First observedv0.1.0May 31, 2026

TDQS

A4.9/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable context beyond annotations: 'Runs locally on the input you provide: read-only, non-destructive, contacts no external service, and is rate-limited.' This aligns with the annotations (readOnlyHint, destructiveHint, idempotentHint) and provides additional details about execution locality and rate limiting.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: it starts with the purpose, then usage guidance, then behavioral traits, and finally the return value summary. Every sentence adds value with no superfluous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple tool (2 parameters) and the existence of an output schema, the description is complete. It mentions the return information (match result, parsed parameters, strength analysis), covering all necessary aspects for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions and examples for both parameters. The description further explains the hash format and how N, r, p, salt are extracted from it, adding meaningful context beyond the schema's individual parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check whether a plaintext password matches an existing scrypt hash.' It specifies the verb (verify) and resource (password against hash). It also distinguishes from sibling 'crypto_scrypt' by noting the alternative use case for generating new hashes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided: 'Use this to verify a candidate password; use crypto_scrypt instead to generate a new hash.' This clearly tells the agent when to use this tool versus the sibling tool for hash generation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server