SuperAPI AI Directory
Partner with us中文AI newsFavorites
All toolsAI codingCyberChef-MCP

CyberChef-MCP

GCHQ CyberChef's encryption, encoding, compression and forensics operations, plus analysis tools such as hash identification, cipher solving and RSA attacks.

Open website

About this tool

Purpose

CyberChef-MCP is a Model Context Protocol (MCP) server that wraps the core Node.js API of GCHQ's CyberChef (the "cyber Swiss Army knife") as MCP tools. Its goal is to bridge the gap between natural-language AI intent and deterministic data processing, enabling AI assistants (such as Claude, Cursor AI, etc.) to natively invoke CyberChef's 504 data operations, including encryption, encoding, compression, and forensic analysis.

Main Capabilities

  • Exposes all 504 CyberChef operations as MCP tools, covering scenarios such as encryption, encoding, compression, and forensics.
  • Provides the core "universal" tool cyberchef_bake, used to execute complete CyberChef recipes (operation chains), suitable for multi-step transformations, for example "first Base64 decode, then Gunzip, then format JSON".
  • Provides cyberchef_search to help AI discover operations and their descriptions by keyword.
  • Reduces the size of tools/list through an indexed tool discovery mechanism: by default it returns 23 tools (15,620 bytes) instead of 546 tools (427,123 bytes); any operation can be reached layer by layer via cyberchef_categories → cyberchef_list_operations → cyberchef_describe_operation, or found by keyword with cyberchef_search, then executed by name with cyberchef_bake.
  • Optional tool surfaces: CYBERCHEF_TOOL_SURFACE=curated (120 tools, 109,548 bytes) or all (all 546 tools, 427,123 bytes).
  • Recipe management (since v1.6.0): 10 tools for saving, organizing, and reusing multi-operation workflows, including cyberchef_recipe_create, cyberchef_recipe_get, cyberchef_recipe_list, cyberchef_recipe_update, cyberchef_recipe_delete, cyberchef_recipe_execute, cyberchef_recipe_export, cyberchef_recipe_import, cyberchef_recipe_validate, cyberchef_recipe_test.
  • Advanced features (since v1.7.0): cyberchef_batch (execute multiple operations in parallel or sequentially), cyberchef_telemetry_export (opt-in privacy-first usage analytics), cyberchef_cache_stats / cyberchef_cache_clear (cache inspection and management), cyberchef_quota_info (resource quota and usage tracking).
  • Analysis tools (non-operation): expanded from the initial four to nineteen, including cyberchef_xor_key_length, cyberchef_cyclic_pattern, cyberchef_hash_identify, cyberchef_rsa_attack; v3.3.0 added classical ciphers, crib dragging, entropy scanning, hash cracking and statistics, JWT weaknesses, plaintext scoring, multi-key RSA, substitution cipher and Vigenère cracking, timestamp identification, corpus comparison, etc.; v3.4.0 added cyberchef_ecdsa_recover; v3.8.0 added cyberchef_cert_chain; v3.11.0 added cyberchef_pqc_identify. Since v4.1.0 they are accessed via cyberchef_analyse({tool, arguments}).
  • Prompts and resources (since v2.2.0): five workflow prompts (analyse-unknown-data, extract-iocs, deobfuscate-script, identify-hash, decode-chain), and saved recipes as readable resources recipe://<id>.
  • Image and audio returns (since v2.2.0): generating QR codes, rendering images, etc. return MCP image content blocks; playing media returns audio blocks; other binary remains byte-lossless latin1 text, or is returned as base64 via CYBERCHEF_BINARY_OUTPUT=base64.
  • Tool annotations (v2.2.0 ): each tool includes readOnlyHint, destructiveHint, idempotentHint, openWorldHint, and a readable title, making it easy for clients to skip approval.

Usage

  • After running the MCP server, AI assistants can call the above tools. It can be accessed via three transports: stdio, Streamable HTTP, or socket (Unix domain socket or loopback TCP, CYBERCHEF_TRANSPORT=socket).
  • Protocol revision 2026-07-28 (since v2.3.0) is served simultaneously over stdio and HTTP, and coexists with the 2025-era version, handled by the same set of handlers, so existing clients are unaffected.
  • OAuth 2.1 authentication is supported over HTTP (since v2.5.0): as an OAuth 2.1 resource server, it supports RFC 9728 protected resource metadata, JWKS-based bearer validation, and RFC 8707 audience binding; scope-based RBAC includes three scopes: cyberchef:read, cyberchef:write, and cyberchef:network; disabled by default unless CYBERCHEF_AUTH_ISSUER is set, and should not be used with stdio.
  • Multi-tenancy (since v2.5.0): operation cache, recipe storage, concurrency pool, and audit trail are isolated per tenant, with the tenant coming from a validated token claim (CYBERCHEF_TENANT_CLAIM). Disabled by default.
  • Observability (since v2.7.0): optional Prometheus endpoint /metrics (20 metric families, disabled by default), OpenTelemetry spans following MCP semantic conventions, and log lines carrying trace_id / span_id; tool parameters are never logged.
  • Offline mode: setting CYBERCHEF_OFFLINE=true is suitable for air-gapped hosts; of the 504 operations, 502 do not access the network in the first place, and this switch performs a fail-closed check per recipe for the other two.
  • Deployment: since v2.6.0, a Helm chart and Compose file are provided, including liveness/readiness/startup probes and a draining mechanism that avoids dropping requests during rolling updates; images are published for both linux/arm64 and linux/amd64, with size reduced from 643 MB to 453 MB.
  • Startup performance: since v2.6.0, startup takes about 185 milliseconds (previously about 1.3 seconds); the 505-operation bucket is loaded only by the three tools that need it, and a normal operation call loads only the one operation being run.

Use cases

  • AI-assisted cybersecurity analysis and forensics: identifying hashes, cracking classical ciphers, analyzing encrypted data, extracting IOCs, and deobfuscating scripts.
  • Complex multi-step data transformations: chained operations such as Base64 decoding, Gunzip, and JSON formatting via cyberchef_bake.
  • Scenarios requiring saving and reusing workflows: recipe management tools.
  • Enterprise-grade deployment: OAuth 2.1 authentication, multi-tenant isolation, audit logging, quota management, observability, and Kubernetes deployment.

Limitations

  • The web UI components have been removed (88 files, about 19,260 lines), and are not applicable to the MCP server.
  • One-way synchronization with upstream GCHQ/CyberChef (pull only); as a whole it has been GPL-3.0-or-later since v2.0.0, and MCP-layer changes cannot be fed back to the Apache-2.0 upstream.
  • Migration tools have been removed in v4.0.0 (cyberchef_migration_preview, cyberchef_deprecation_stats, and the cyberchef-migrate binary); v1-format recipes do not require migration.
  • There is no WebSocket transport, because MCP does not define that transport.
  • There is no plugin loader, because node:vm does not constitute a security boundary (measured rather than assumed, see ADR 0002).
  • The socket transport does not carry authentication; non-loopback binding is rejected unless explicitly allowed, and Unix sockets are created with 0600.
  • OAuth and multi-tenancy are disabled by default and require explicit configuration; configuring multi-tenancy without authentication configured will cause a startup error.
  • Analysis tools cannot be expressed through ordinary operations or cyberchef_bake, and must be accessed through dedicated tools.
  • Other features, fees, prices, platforms, or effects not explicitly stated in the materials are not currently provided.

Related tools

Browse category