Keyforge

Keyforge — connector documentation

• MCP endpoint: https://keyforge.connectorbay.com/mcp
• REST API: POST https://keyforge.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://keyforge.connectorbay.com/openapi.json
• Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
• Authentication: none required. An optional Authorization: Bearer <key> raises rate limits.
• Health: https://keyforge.connectorbay.com/health · Tool schemas: https://keyforge.connectorbay.com/tools.json
• Publisher: Unify Dynamics LLC · connectorbay.com/keyforge · agent@connectorbay.com

What Keyforge is for

A strong password or passphrase, an honest strength check, and a straight answer on how long something would take to crack -- all computed on this server, entirely offline, with nothing you generate or submit ever stored, logged, or transmitted anywhere.

What it does

Cryptographically random passwords via Python's secrets module (never random), 8-128 characters, with configurable character classes and an option to drop visually ambiguous characters (generate_password); Diceware-style passphrases drawn from a bundled, hand-curated ~3,000-word list, with optional capitalization and an inserted digit (generate_passphrase); an entropy-based strength estimate with a plain-language rating and specific suggestions, flagging local heuristic weaknesses like all-lowercase text, sequential runs, keyboard-walk patterns, repeated characters, and common passwords with or without leet-style substitutions -- never a live breach-database lookup (password_strength); crack-time estimates for a password or a raw entropy value under three standard guess-rate assumptions, from a throttled login form to offline GPU cracking (estimate_crack_time); random numeric PINs that can steer away from repeated digits, sequences, and well-known weak PINs like 1234 or 0000 (pin_generator); the same pattern checks on their own (check_common_patterns); validation against the NIST SP 800-63B-style "nist" preset, a stricter "strict" preset, or fully custom requirements (password_policy_check); and a short, hand-curated reference on password managers, multi-factor authentication, passphrases vs. passwords, why length beats complexity, reuse, and safe storage (security_tips).

What it is not

Not a breach-database lookup -- Keyforge never checks a password against a live "has this password been seen in a leak" service, because that would mean sending the password (or a fingerprint of it) somewhere else. Every strength and pattern check here runs against local heuristics and a small bundled list of well-known weak passwords and PINs. It's also not a vault: Keyforge generates and evaluates, but never stores anything -- pair it with a password manager to actually keep the results.

Tools

Generate

generate_password — A cryptographically random password (Python's secrets module, never random), 8-128 characters, with configurable character classes. At least one class must stay enabled. Use for "generate a strong password", "give me a 20-character password with no symbols". Args: length, use_upper, use_lower, use_digits, use_symbols, exclude_ambiguous.

generate_passphrase — A Diceware-style passphrase: several words chosen uniformly at random (via secrets) from a bundled, hand-curated ~3,000-word list, joined by separator. Use for "give me a passphrase", "make a 6-word passphrase I can remember". Args: word_count, separator, capitalize, include_number.

pin_generator — A random numeric PIN (via secrets), optionally avoiding obviously weak patterns -- repeated digits (1111), sequences (1234, 4321), and well-known common PINs (1234, 0000, 2580, ...). Use for "give me a 6-digit PIN". Args: length, avoid_patterns.

Evaluate

password_strength — Entropy-based strength estimate (bits, from character-class coverage and length), a plain-language rating (very weak/weak/fair/strong/very strong), and specific improvement suggestions. Flags local heuristic weaknesses -- all-lowercase, sequential runs, keyboard-walk patterns, repeated characters, common passwords (with or without leet substitutions) -- never a live breached-password database lookup. The password is never stored or logged. Use for "how strong is this password". Args: password.

estimate_crack_time — Estimated time to crack a password (or a given entropy-bits value) under three standard guess-rate assumptions: online throttled (~100/hour), offline slow hash like bcrypt/Argon2 (~10,000/second), and offline fast hash on GPUs (~10 billion/second). Use for "how long would it take to crack this password", "how long to brute-force 60 bits of entropy". Args: password_or_entropy_bits.

check_common_patterns — Flags keyboard-walk patterns (qwerty, asdf), sequential runs (1234, abcd), repeated characters or substrings, and common weak passwords (with or without leet-style substitutions like P@ssw0rd) -- all from a bundled local list, with no breach-database lookup. Use for "does this password have any obvious weak patterns". Args: password.

Policy & Guidance

password_policy_check — Validates a password against the "nist" preset (SP 800-63B modern guidance: length over composition rules, screened against common passwords), the "strict" preset (longer minimum, all four character classes required), or "custom" with explicit overrides. Use for "does this password meet NIST rules", "check this against a 14-character strict policy". Args: password, policy, min_length, require_upper, require_lower, require_digit, require_symbol.

security_tips — A short, hand-curated reference: password managers (explained generically, no specific product named or recommended), multi-factor authentication, passphrases vs. passwords, why length beats complexity (per NIST guidance), password reuse, and safe storage. Use for "tips on using a password manager", "why does length matter more than complexity". Args: topic.

Conventions

• Read-only. Every tool reads public data or computes; nothing is written anywhere and nothing about the user is stored.
• Result envelope. ok: true with data, or ok: false with a structured error (bad_input, not_found, upstream_error). degraded lists optional sources that were unreachable.
• Rate limits. Free tier 60 tool calls/minute and 300/day per user (keyed on the user identifier supplied by the host agent, else client IP); Pro keys raise this. Over-limit calls return HTTP 429 with Retry-After. initialize and tools/list are never counted.

Support

agent@connectorbay.com · connectorbay.com/keyforge/support

Keyforge — Privacy Policy

Effective 24 September 2026. Unify Dynamics LLC ("we", "us"), Menlo Park, California.

What Keyforge is. Keyforge is a connector (an MCP server and REST API) that AI assistants and personal agents call on your behalf to generate passwords and passphrases, and to score or check ones you already have. You interact with your assistant; the assistant sends us only the arguments needed for that one call.

The core promise: nothing you generate or submit is stored, logged, or transmitted. Every password, passphrase, and PIN this connector generates or receives for checking is used only in memory, for the duration of that single request, and is discarded the instant the response is returned. Keyforge makes no outbound network calls at all -- every tool computes its answer locally from code and a bundled reference word/pattern list shipped with the server. Application logs deliberately exclude request and response bodies, so a password or passphrase is never written to a log file, a database, or a third party, by design and in the running code, not just in policy.

What we receive. The technical headers needed to serve the request (an IP address or a client identifier supplied by the assistant, and a Pro API key if you have one) and standard server logs that record the tool name and timestamp of each call, never its arguments or its result.

What we do not receive or store. We do not receive your conversation with the assistant or your name. We do not build a profile from your usage, and nothing carries over between requests. Rate-limit counters (a client identifier and timestamps, no password content) are held in memory for at most 24 hours. Hosting-provider access logs, which contain IP addresses and request paths but not request bodies, are retained for up to 30 days for security and abuse prevention.

Sub-processors. None -- there is no upstream call of any kind. Hosting: Vercel (United States regions).

Legal bases and your rights. Our processing is necessary to provide the service you request through your assistant. Because we store no password, passphrase, or PIN content, and no personal data beyond short-lived technical logs, requests to access, correct or delete personal data are usually satisfied automatically; you can still contact agent@connectorbay.com and we will respond within 30 days. We do not sell or share personal information and do not use your data to train models.

Children. Keyforge is a general-audience service operated by the adult using the assistant.

Changes. We will post changes here with a new effective date.

Keyforge — Terms of Service

Effective 24 September 2026. These terms govern use of the Keyforge connector ("the Service") operated by Unify Dynamics LLC ("we", "us").

1. The Service. Keyforge generates cryptographically random passwords and Diceware-style passphrases, and scores or checks passwords, PINs, and policy compliance you submit -- entirely through local computation, with no outbound network calls. It is accessed through an AI assistant or directly over MCP or HTTP.
2. Nothing is stored. Every value generated or submitted for checking is processed only in memory for the duration of a single request and is never logged, cached, or transmitted elsewhere. See our Privacy Policy for the full detail.
3. No breach-database lookup. Keyforge's strength and pattern checks run entirely against local heuristics and a small bundled list of well-known weak passwords and PINs. It does not check whether a password has appeared in a real-world data breach, and a "strong" or "passed" result is an estimate, not a guarantee against every possible attack.
4. Your responsibility. You are responsible for how you store, use, and share any password, passphrase, or PIN this Service generates. We recommend an encrypted password manager for anything you need to keep.
5. Acceptable use. Automated use within the published rate limits is welcome. Do not use the Service to generate credentials intended to gain unauthorized access to any system.
6. Availability. The Service is provided "as is" without warranty. We may change, limit, or discontinue it at any time.
7. Pro keys. Optional Pro API keys are issued at our discretion, are personal to the holder, and may be revoked for abuse.
8. Liability. To the fullest extent permitted by law, Unify Dynamics LLC is not liable for any loss arising from use of or reliance on the Service, including any compromise resulting from a password or passphrase it generated or evaluated. Our total liability is limited to US $100.
9. Governing law. California law; venue in San Mateo County, California.
10. Contact. Unify Dynamics LLC · agent@connectorbay.com · https://connectorbay.com/keyforge

Keyforge support

Email agent@connectorbay.com. We answer within two business days.

• MCP endpoint: https://keyforge.connectorbay.com/mcp
• REST API: https://keyforge.connectorbay.com/openapi.json
• Live status: https://keyforge.connectorbay.com/health

When you report a problem, include the question you asked your agent, roughly when, and which agent you used (for example Claude, ChatGPT or Gemini). Never send us passwords, account numbers or ID numbers. Keyforge never asks for them.