# CyberChef MCP Server [Health: Active]

**Category:** 🔑 Cryptography  
**Repository:** https://github.com/noor202401938-netizen/cyber-chef-mcp  
**GitHub Stars:** 3  
**npm Downloads (last month):** 2832  
**Views:** 0  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/noor202401938-netizen-cyber-chef-mcp

## Description
CyberChef MCP server providing 28 core data transformations, ciphers, hashing, JWT decoding, representation-calibrated Shannon entropy, and multi-layer payload deobfuscation for AI coding and security agents. npx -y @noorfatima123456/cyber-chef-mcp

## Tools
Capabilities this server exposes over MCP:

- **cyberchef_bake** — Executes a multi-stage sequential data transformation pipeline ('recipe') on the input string across 28 core CyberChef operations (Base64, Hex, URL, HTML entities, XOR, ROT13, AES-CBC Encrypt/Decrypt, MD5, SHA1, SHA256, SHA512, Entropy, Magic, JWT, Defang, Dual-stack IP, DLP entities, Strings, JSON Beautify, Regex, Reverse, Find/Replace). Limits: 5000ms execution timeout, 10MB memory cap per recipe.
- **cyberchef_magic** — Performs heuristic forensic analysis on suspicious or obfuscated strings to detect encoding formats (Base64, Hex, URL encoding), hash signatures (MD5, SHA1, SHA256), ciphers, and compression. Returns detected patterns, confidence scores, and recommended CyberChef recipes.
- **cyberchef_help** — Searches the built-in catalog of 28 core CyberChef operations to find available tools, supported recipe names, and operation parameters by keyword or category.
- **cyberchef_from_base64** — Decodes RFC 4648 standard or URL-safe Base64 encoded strings and returns structured output { utf8, hex, isPrintable, byteLength }. Crucial: Distinguishes printable text from raw binary ciphertext/TOTP secrets without mojibake data corruption.
- **cyberchef_to_base64** — Encodes arbitrary text or byte data into standard RFC 4648 or URL-safe Base64 string representation.
- **cyberchef_from_hex** — Converts a hexadecimal byte string into character data and returns structured output { utf8, hex, isPrintable, byteLength }. Supports raw hex, space-separated bytes, 0x prefixes, and comma delimiters.
- **cyberchef_to_hex** — Converts UTF-8 text or character data into its hexadecimal byte representation with optional custom delimiter formatting.
- **cyberchef_url_decode** — Decodes percent-encoded URL query strings and path segments into standard UTF-8 characters.
- **cyberchef_url_encode** — Encodes reserved and unsafe characters in a string into standard percent-encoded format (%XX) for safe URL transmission.
- **cyberchef_rot13** — Applies the ROT13 substitution cipher or an arbitrary Caesar cipher shift to alphabetic characters while preserving case and non-alphabet symbols.
- **cyberchef_xor** — Applies a bitwise XOR cipher using a repeating key against the input string. Preserves raw binary bytes without UTF-8 corruption. Running XOR twice with the same key restores original plaintext.
- **cyberchef_analyse_hash** — Identifies probable cryptographic hash algorithms for a given digest based on character set, bit length, and structural signatures. Supports modern password hashes (Argon2id/i/d, scrypt, PBKDF2) with OWASP parameter audits, full bcrypt prefixes ($2$, $2a$, $2b$, $2x$, $2y$), and ranked confidence for hex digests (MD5 vs NTLM vs MD4). Note: Classifies format; does not crack hashes.
- **cyberchef_sha256** — Calculates the cryptographic SHA-256 digest of the input string and returns the resulting 64-character hexadecimal checksum.
- **cyberchef_entropy** — Calculates Shannon entropy and saturation against the input alphabet ceiling (Hex max 4.0 bits/char, Base64 max 6.0 bits/char, Raw max 8.0 bits/char). Reports bitsPerChar, maxForAlphabet, normalizedRatio, and totalBits to accurately determine whether data is plaintext, compressed, packed shellcode, or high-entropy ciphertext.
- **cyberchef_jwt_decode** — Decodes and inspects JSON Web Tokens (JWT) without requiring a signature secret. Parses and validates the Jose header, claims payload, algorithm specifications, expiration dates, and detects dangerous 'none' algorithms.
- **cyberchef_defang_url** — Sanitizes malicious URLs, domains, IPv4 addresses, and email addresses for safe display and reporting. Scoped: defangs protocol (hxxp/hxxps), defangs hostnames and IP dots while preserving path and query string decimals, and converts email '@' to '[at]'.
- **cyberchef_extract_entities** — Enterprise DLP and forensic entity scanner. Extracts and redacts: Credit Cards (with Luhn check), US SSN, India PAN, IBAN, E.164 phone numbers, strict dual-stack IPv4 (validating 0-255 octet range; rejects 999.999.999.999) and IPv6, AWS access keys, JWTs, private keys, URLs, and emails. Returns match type, offset, and masked preview to preserve privacy.
- **cyberchef_strix_triage** — Automated one-shot security triage for autonomous AI agents (Strix, Claude, Cursor). In a single turn, checks an unknown or suspicious string for DLP/PII leaks, calculates alphabet-calibrated entropy, attempts magic recipe detection, and produces actionable severity findings and remediation steps.

## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):

```json
"mcpServers": {
  "cyberchef-mcp-server": {
    "command": "npx",
    "args": ["-y","@noorfatima123456/cyber-chef-mcp@latest"]
  }
}
```

## Documentation

## What CyberChef MCP Server MCP server does

CyberChef MCP Server MCP server exposes a JavaScript implementation of CyberChef-style operations to MCP-compatible AI agents. Its catalog contains 17 primary tools covering 28 core operations, including encoding and decoding, ciphers, hashing, JWT inspection, entropy analysis, entity extraction, URL defanging, and multi-step recipe execution.

The server is suited to workflows where an agent must process a supplied string or token and receive a bounded, structured result. Examples include converting between hexadecimal and text, encoding or decoding Base64, applying XOR or ROT13, inspecting JWT claims, classifying modern password-hash formats, and identifying selected sensitive entities in text.

## How it works

The `cyberchef_bake` tool accepts an input string and an ordered recipe array. This lets an agent combine operations such as hexadecimal decoding, XOR, Base64 handling, and decompression in one pipeline.

For inputs with an unknown representation, `cyberchef_magic` provides heuristic decoding for cases such as unknown encodings, single-byte XOR keys, and compressed data. Other tools perform focused analysis: `cyberchef_entropy` calculates Shannon entropy with representation-specific reference points, while `cyberchef_jwt_decode` reads JOSE headers and claims, formats expiration timestamps, and checks for a signature.

The server can run locally over stdio or remotely over Server-Sent Events. The hosted deployment also exposes JSON-RPC messaging, a health endpoint, and MCP discovery documents. Local execution keeps processing on the workstation; remote execution uses the published Azure endpoint.

## Setup and configuration

For local use, configure an MCP client to run Node.js through `npx`:

```json
{
  "mcpServers": {
    "cyberchef": {
      "command": "npx",
      "args": ["-y", "@noorfatima123456/cyber-chef-mcp@latest"]
    }
  }
}
```

The package requires Node.js 18 or newer. The same command can be added through the Claude Code CLI.

For remote use, point an MCP client at the published SSE URL:

```json
{
  "mcpServers": {
    "cyberchef-cloud": {
      "url": "https://cyber-chef-mcp-ehcdg4a5ebehgvc2.eastasia-01.azurewebsites.net/sse"
    }
  }
}
```

## Tools and capabilities

CyberChef MCP Server MCP server includes tools for:

- Running sequential recipes with `cyberchef_bake`.
- Heuristic decoding with `cyberchef_magic`.
- Decoding JWT headers and claims with `cyberchef_jwt_decode`.
- Measuring calibrated Shannon entropy with `cyberchef_entropy`.
- Auditing PHC-format hashes and bcrypt with `cyberchef_analyse_hash`.
- Extracting selected credit-card, SSN, PAN, IBAN, IP, AWS key, and email patterns with `cyberchef_extract_entities`.
- Defanging URLs, IPs, and email indicators with `cyberchef_defang_url`.
- Encoding and decoding Base64 and hexadecimal data.
- Applying binary-safe XOR and ROT13 transformations.

The Base64 and hexadecimal decoders return structured information such as text, hexadecimal output, printability, or byte length, rather than requiring every result to be interpreted as text.

## Limitations and notes

The remote deployment requires network access, while local stdio is the documented option for offline or privacy-sensitive operation. Results depend on the input and the selected recipe, so agents should choose operations explicitly when heuristic decoding is not appropriate.

_Full upstream README: https://allmcps.com/mcp/noor202401938-netizen-cyber-chef-mcp/readme_