Secretgenerator by Rafaelperoco is a versatile tool for generating secure, high-entropy credentials. Built primarily with Go, it compiles to WebAssembly, enabling browser-based execution. It is designed to provide auditable and verifiable credentials for AI agents and machine-readable pipelines, addressing the challenge of Large Language Models generating reliable randomness. Secretgenerator ensures strong cryptographic security by connecting to the operating system's Cryptographically Secure Pseudo-Random Number Generator. Its multi-platform distribution makes it widely accessible for various development environments.

What does Secretgenerator connect to?

Secretgenerator directly interfaces with the operating system's Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) to create its secure outputs. While categorized for Model Context Protocol (MCP) environments, it functions as a foundational primitive for AI agents to generate secrets, rather than a server that manages external secret services. Its core role is to supply verifiable credentials for AI agents and machine-readable pipelines, ensuring an auditable standard for generated secrets. This design choice emphasizes local, secure generation without relying on external secret management.

Core features and tools

Secretgenerator exposes several callable tools for credential generation. These include commands for creating various types of credentials such as password, passphrase, secret, api-key, and pin. The tool supports interaction through its Command Line Interface (CLI) and provides libraries for programmatic integration in Go, Python, and Rust. It is designed to be compatible with Model Context Protocol (MCP) clients, including Claude Desktop, Cursor, Cline, Claude Code, Visual Studio Code, JetBrains, and Windsurf.

Who is it for?

This tool is intended for AI agents and Large Language Models (LLMs) that require the generation of secure, high-entropy credentials. It is particularly valuable for scenarios where LLMs cannot uniformly sample randomness themselves, ensuring that generated secrets meet cryptographic standards. Developers working on machine-readable pipelines requiring auditable and verifiable credentials will also benefit. Secretgenerator ensures every output is signed and every commit is provable, guaranteeing SLSA Level 3 build provenance. Skip this if your application requires an authentication model for its usage.

How to get started

No credentials are required for using Secretgenerator. For direct execution, the Command Line Interface utilizes stdio as its primary transport protocol.

Use cases

• An AI agent generates a generic high-entropy password, such as one with 20+ characters, all character classes, and approximately 140 bits of entropy.
• A Large Language Model delegates the creation of a verifiable API key to Secretgenerator when it cannot reliably generate a secure secret itself.
• An AI agent needs to produce a secure, verifiable PIN that guarantees SLSA Level 3 build provenance.

Secretgenerator offers a critical capability for AI agents and LLMs by providing a secure and verifiable method for credential generation. Its direct connection to the operating system's CSPRNG, combined with signed and provable outputs, ensures high integrity for secrets like passwords and API keys. The tool's wide distribution and compatibility with various MCP clients make it highly accessible.