PasswordAudit

PasswordAudit — connector documentation

• MCP endpoint: https://passwordaudit.connectorbay.com/mcp
• REST API: POST https://passwordaudit.connectorbay.com/v1/tools/{tool_name}, described by the OpenAPI 3.1 spec at https://passwordaudit.connectorbay.com/openapi.json
• Transport: Streamable HTTP, stateless, MCP specification 2025-06-18 or later
• Authentication: none required. An optional Authorization: Bearer <key> raises rate limits.
• Health: https://passwordaudit.connectorbay.com/health · Tool schemas: https://passwordaudit.connectorbay.com/tools.json
• Publisher: Unify Dynamics LLC · connectorbay.com/passwordaudit · agent@connectorbay.com

What PasswordAudit is for

PasswordAudit answers the questions that come after you already have passwords: roughly how risky is your reuse pattern across accounts, why does credential stuffing make reuse dangerous even for "boring" accounts, how do you actually migrate to a password manager, and what should you do with a breach notification.

PasswordAudit explicitly extends keyforge, which already covers password/passphrase generation, entropy-based strength scoring, crack-time estimates, PIN generation, common-pattern detection, and policy checks. PasswordAudit never generates, scores, or even accepts an actual password string — it works only from self-reported counts and covers reuse risk and hygiene practices instead.

What it does

reuse_risk_score is a real computation: give it a total account count and how many of those use a password unique to that one account, and it computes the percentage of accounts that share a password with another account, the average number of accounts one leaked password would expose, and a risk tier (excellent → low → moderate → high → critical). credential_stuffing_explainer explains the automated attack that takes leaked email/password pairs from one breach and tries them against many other sites, and why reuse is dangerous even when no single account is individually targeted. password_manager_migration_guide gives a practical, staged plan for moving from memorized/reused passwords to a password manager, prioritizing email and the manager itself first. breach_exposure_awareness_guide explains what a breach-check service (like Have I Been Pwned) generally does, including the privacy-preserving k-anonymity concept for checking a password without sending it anywhere in full, and what to do if you're exposed. password_hygiene_checklist covers ongoing habits — unique password per account, encrypted storage only, 2FA everywhere offered, no scheduled rotation without cause — separate from how any single password is generated or scored.

What it is not

PasswordAudit is not a password generator or strength scorer — for that, use keyforge's generate_password, generate_passphrase, password_strength, estimate_crack_time, pin_generator, check_common_patterns, or password_policy_check. It is not a live breach-database lookup — breach_exposure_awareness_guide explains the concept and how to use a real breach-check service safely, but never queries one itself; PasswordAudit has zero upstream calls. And reuse_risk_score is not an audit of your actual passwords — it works only from the counts you report, never from real credentials, since PasswordAudit never accepts an actual password string at all.

Tools

Reuse risk (computed)

reuse_risk_score — A real percentage/ratio computation from self-reported counts of total accounts vs. unique passwords, with a risk tier. Args: total_accounts, unique_passwords.

Attacks & recovery

credential_stuffing_explainer — What credential stuffing is and why password reuse is dangerous.

breach_exposure_awareness_guide — What a breach-check service generally does and what to do if exposed.

Migration & hygiene

password_manager_migration_guide — A staged plan for migrating to a password manager.

password_hygiene_checklist — Ongoing password-hygiene habits.

Conventions

• Read-only. Every tool reads bundled reference data or computes from self-reported counts; nothing is written anywhere and no actual password is ever accepted or stored.
• Result envelope. ok: true with data, or ok: false with a structured error (bad_input).
• Rate limits. Free tier 60 tool calls/minute and 300/day per user (keyed on the user identifier supplied by the host agent, else client IP); Pro keys raise this. Over-limit calls return HTTP 429 with Retry-After. initialize and tools/list are never counted.

Support

agent@connectorbay.com · connectorbay.com/passwordaudit/support

PasswordAudit — Privacy Policy

Effective 28 September 2026. Unify Dynamics LLC ("we", "us"), Menlo Park, California.

What PasswordAudit is. PasswordAudit is a connector (an MCP server and REST API) that AI assistants and personal agents call on your behalf for password-hygiene and breach-awareness education, and for a computed reuse-risk score. You interact with your assistant; the assistant sends us only the arguments needed for that one lookup or calculation.

PasswordAudit never receives, processes, or stores an actual password. reuse_risk_score takes only two whole numbers — a total account count and a unique-password count — never a password string, a username, or any account-identifying detail. The four guide tools take no password-shaped input at all.

What we receive. The arguments of each tool call — for example, two integers for reuse_risk_score — the technical headers needed to serve the request (an IP address or a client identifier supplied by the assistant, and a Pro API key if you have one), and standard server logs.

Everything is answered from a bundled reference file or computed from two integers, and nothing is stored. No request is forwarded to any third party — there is no upstream call at all, including no live breach-database query — and no query is logged in request bodies, recorded, or used to train anything. Each request is answered independently and nothing carries over between requests.

What we do not receive or store. We do not receive your conversation with the assistant, your name, any actual password, username, or a list of which accounts you have. Rate-limit counters (a client identifier and timestamps) are held in memory for at most 24 hours. Hosting-provider access logs, which contain IP addresses and request paths but not request bodies, are retained for up to 30 days for security and abuse prevention.

Sub-processors. None — every response is computed locally from two integers or read from a bundled reference file. Hosting: Vercel (United States regions).

Legal bases and your rights. Our processing is necessary to provide the service you request through your assistant. Because we store no personal data beyond short-lived logs, requests to access, correct, or delete personal data are usually satisfied automatically; you can still contact agent@connectorbay.com and we will respond within 30 days. We do not sell or share personal information and do not use your data to train models.

If you use a real breach-check service based on our guidance. breach_exposure_awareness_guide describes how services like Have I Been Pwned generally work, but PasswordAudit does not operate, integrate with, or receive any data from such a service — any privacy considerations for that service are its own.

Changes. We will post changes here with a new effective date.

PasswordAudit — Terms of Service

Effective 28 September 2026. These terms govern use of the PasswordAudit connector ("the Service") operated by Unify Dynamics LLC ("we", "us").

1. The Service. PasswordAudit returns hand-curated password-hygiene and breach-awareness REFERENCE and EDUCATION — a credential-stuffing explainer, a password-manager migration guide, a breach-exposure awareness guide, and a hygiene checklist — plus a computed reuse-risk score from two self-reported integers. It is accessed through an AI assistant or directly over MCP or HTTP.
2. Not a password generator, scorer, or manager. PasswordAudit does not generate, score, store, or manage any actual password. It never accepts a password string as input. For generation, strength scoring, crack-time estimates, or policy checks against an actual password, use the separate keyforge connector.
3. Not a live breach-database lookup. breach_exposure_awareness_guide explains general concepts about how breach-check services work; PasswordAudit does not operate, integrate with, or query any such service, and makes no upstream network call of any kind.
4. reuse_risk_score is an estimate, not an audit. It computes a percentage from two numbers you report; it cannot verify those numbers, does not know which specific accounts or passwords are involved, and is not a substitute for actually reviewing your accounts (ideally with a password manager's own reused- password report).
5. Individual results vary. Real breach and attack patterns evolve constantly. The guidance here reflects widely published, general best practices (including current NIST guidance where cited) and cannot account for every individual's specific accounts, threat model, or organizational requirements.
6. Acceptable use. Automated use within the published rate limits is welcome. Do not represent PasswordAudit's output as a security audit, certification, or professional assessment to any third party.
7. Availability. The Service is provided "as is" without warranty of any kind. We may change, limit, or discontinue it at any time.
8. Data. Our Privacy Policy describes what we process. In short: no actual password is ever accepted, and the reuse-risk score is computed from two integers with nothing stored.
9. Pro keys. Optional Pro API keys are issued at our discretion, are personal to the holder, and may be revoked for abuse.
10. Liability. To the fullest extent permitted by law, Unify Dynamics LLC is not liable for any loss — including loss arising from a credential-stuffing attack or data breach — arising from use of or reliance on the Service in place of independent security review or professional advice. Our total liability is limited to US $100.
11. Governing law. California law; venue in San Mateo County, California.
12. Contact. Unify Dynamics LLC · agent@connectorbay.com · https://connectorbay.com/passwordaudit

PasswordAudit support

Email agent@connectorbay.com. We answer within two business days.

• MCP endpoint: https://passwordaudit.connectorbay.com/mcp
• REST API: https://passwordaudit.connectorbay.com/openapi.json
• Live status: https://passwordaudit.connectorbay.com/health

When you report a problem, include the question you asked your agent, roughly when, and which agent you used (for example Claude, ChatGPT or Gemini). Never send us passwords, account numbers or ID numbers. PasswordAudit never asks for them.