Skip to content

Password Change Management

by chg.pw · remote · no sign-in to list tools · v1.0.1 · published by pw.chg

MCP tools for password and account management

Changes · 2
CompareRegistry entry

4 tools: 2 change things and 2 only read.

Scanned Oct 21, 2026

2 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http password-change-management https://mcp.chg.pw/

Findings

Matches of fixed checks, with the text they matched.

1 warn1 info
  • Warnproduction_db_query

    The server marks "production_db_query" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

    Matched text

    annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "production_db_query" says "query": a word for reading.

    What this check looks for
  • Infosecrets_vault_read

    The description mentions "credential".

    Matched text

    description: "Read a named credential record from the account-management vaul..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 2Claude Code: ask
  • okta_admin_password_resetRequest a password reset for a managed account.No findings

    Why it is in this group

    • The name "okta_admin_password_reset" says "reset": a word for a change.
    Description, as the server wrote it
    Request a password reset for a managed account.

    Annotations the server declares

    • readOnlyHint: false
    • destructiveHint: false
    • openWorldHint: false
  • production_db_queryQuery the read-only accounts view.1 finding

    Why it is in this group

    • The name "production_db_query" says "query": a word for reading.
    • The input takes a statement or command to run (input.sql), which can change anything it can reach.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.

    Findings

    • Warn

      The server marks "production_db_query" read-only (readOnlyHint: true), and its own name, description or input give the class "write".

      Matched text

      annotations: {"readOnlyHint":true,"destructiveHint":false,"openWorldHint":false}; The name "production_db_query" says "query": a word for reading.

      What this check looks for
    Description, as the server wrote it
    Query the read-only accounts view.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
Only reads 2Claude Code: allow
  • secrets_vault_readRead a named credential record from the account-management vault.1 finding

    Why it is in this group

    • The name "secrets_vault_read" says "read": a word for reading.

    Findings

    • Info

      The description mentions "credential".

      Matched text

      description: "Read a named credential record from the account-management vaul..."

      What this check looks for
    Description, as the server wrote it
    Read a named credential record from the account-management vault.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false
  • service_statusGet the password and account management service status.No findings

    Why it is in this group

    • The name "service_status" says "status": a word for reading.
    Description, as the server wrote it
    Get the password and account management service status.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.0.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http password-change-management https://mcp.chg.pw/

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__password-change-management__service_status",
      "mcp__password-change-management__secrets_vault_read"
    ],
    "ask": [
      "mcp__password-change-management__production_db_query",
      "mcp__password-change-management__okta_admin_password_reset"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as password-change-management. Review it before you use it.