Log inSubmit server
Cyberchef MCP logo

Cyberchef MCP

Exposes CyberChef’s 504 data-transformation operations and security analysis tools through MCP.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Cyberchef MCP

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "cyberchef-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "cyberchef-mcp"
      ],
      "env": {
        "CYBERCHEF_OFFLINE": "YOUR_VALUE_HERE",
        "CYBERCHEF_AUTH_ISSUER": "YOUR_VALUE_HERE",
        "CYBERCHEF_TENANT_CLAIM": "YOUR_VALUE_HERE"
      }
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Values are written into the snippet above so you can paste it as is. They never leave your browser.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y cyberchef-mcp

No response to initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 5d ago.

Overview

The cyberchef-mcp MCP server exposes CyberChef’s 504 data-manipulation operations to AI assistants as executable MCP tools. It wraps CyberChef’s Node.js core, supporting encryption, encoding, compression, forensic analysis, and additional security-focused analysis. Use it when an agent needs deterministic transformations, batch processing, recipe execution, or structured analysis such as hash identification and certificate-chain validation. Optional HTTP authentication, tenancy, telemetry, quotas, and worker monitoring support service deployments.

Use cases

  • Transform encoded or encrypted data with CyberChef operations
  • Run multi-step recipes sequentially or in parallel
  • Identify hash formats and analyze cryptographic material
  • Validate X.509 certificate chains
  • Deploy CyberChef processing in an air-gapped environment

Key features

  • 504 CyberChef data-transformation operations
  • Batch execution in parallel or sequential modes
  • Cryptography and forensic analysis tools
  • Optional OAuth 2.1 authentication and tenant isolation
  • Quota and worker-pool monitoring
  • Optional Prometheus and OpenTelemetry observability

Tools4

What Cyberchef MCP lets your agent do. Expand a tool for its parameters.

Self-reported~73 tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

5/5 checks healthy over the last 30d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 2h ago via OSV.dev · cyberchef-mcp (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars26Stargazers on the source repository.
npm downloads969Package downloads in the last 30 days.
Last commit3d agoMost recent push to the default branch.
Install checkInconclusiveDidn't respond in our test window — often a slow first install.
Tools exposed4Callable tools this server registers over MCP.
Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

How Cyberchef MCP works

What cyberchef-mcp MCP server does

The cyberchef-mcp MCP server connects MCP-compatible AI assistants to the CyberChef processing engine maintained by GCHQ. It makes 504 CyberChef operations available for data transformation, including encryption, encoding, compression, and forensic work. The project removes CyberChef’s web interface and retains the Node.js core together with MCP-specific server code.

Beyond ordinary operations, the server includes analysis tools for tasks such as repeating-key XOR length estimation, cyclic-pattern offset discovery, hash-format identification, RSA attack analysis, entropy scanning, classical cipher work, JWT weakness checks, plaintext scoring, substitution and Vigenère breaking, timestamp identification, corpus comparison, ECDSA nonce-reuse recovery, certificate-chain validation, and post-quantum cryptography parameter identification.

How it works

An MCP client sends tool calls to the server, which resolves the requested CyberChef operation and returns the processed result. The implementation loads operation code as needed rather than importing all 504 implementations at startup. Metadata can build the tool list without loading the complete operation barrel, while ordinary operation calls load the operation they need.

Batch processing is available through cyberchef_batch, with parallel and sequential execution modes. The server also provides tools for exporting opt-in telemetry, inspecting quotas and usage, and viewing worker-pool statistics. HTTP deployments can use OAuth 2.1 resource-server authentication, JWKS bearer-token validation, audience binding, scope-based access control, and audit logging. Multi-tenant isolation is available when authentication and a tenant claim are configured.

Setup and configuration

The cyberchef-mcp MCP server is published as an npm package and has Docker images for linux/amd64 and linux/arm64. The documented runtime requirement is Node.js 26 or later and below version 27. Deployments can also use the supplied Compose configuration or Helm chart, which include health probes and request-draining behavior for service updates.

Set CYBERCHEF_OFFLINE=true for an air-gapped deployment. This fail-closed mode checks recipes for the operations that can access a network. HTTP OAuth authentication remains disabled unless CYBERCHEF_AUTH_ISSUER is configured. Tenant isolation requires CYBERCHEF_TENANT_CLAIM together with the authentication issuer; configuring tenancy without the issuer causes startup failure.

Tools and capabilities

  • Run individual CyberChef transformations through MCP.
  • Execute multiple operations with cyberchef_batch in parallel or sequential mode.
  • Export opt-in, privacy-focused usage telemetry with cyberchef_telemetry_export.
  • Inspect resource limits and consumption with cyberchef_quota_info.
  • Monitor active and completed work, utilization, and pool settings with cyberchef_worker_stats.
  • Use analysis tools for cryptography, hashes, encoded data, certificates, timestamps, and related security tasks.
  • Expose Prometheus metrics when enabled and emit OpenTelemetry spans when an SDK is supplied.

Limitations and notes

The project follows selected upstream CyberChef source files through a one-way synchronization process. The combined project is licensed under GPL-3.0-or-later from version 2.0.0; earlier 1.9.x releases used Apache-2.0. Metrics are off by default, and tool arguments are not recorded in telemetry because they may contain sensitive input. OAuth applies to HTTP deployments, not stdio connections. The server’s offline mode does not imply that every CyberChef operation is network-free; it checks the recipe before execution.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Cyberchef MCP

cyberchef-mcp is an MCP server that connects AI assistants to GCHQ’s CyberChef Node.js core. Its main tools run CyberChef’s 504 data-transformation operations, execute batches, export opt-in telemetry, report quota usage, and expose worker-pool statistics for monitoring.

Install it from its npm package or run its published Docker image. Docker images support linux/amd64 and linux/arm64, while the documented runtime requires Node.js 26 or later and below version 27.

Yes, the README names Cursor AI as an example MCP client. It also names Claude and states that other MCP-compatible assistants can use the server.

Yes, set CYBERCHEF_OFFLINE=true to enable the fail-closed offline mode. The server checks the recipe for network-capable operations, which is intended for air-gapped hosts.

Yes, HTTP deployments support OAuth 2.1 resource-server authentication when CYBERCHEF_AUTH_ISSUER is configured. The server validates bearer tokens with JWKS, checks audience binding, supports scopes, and records audit information.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewCyberchef MCP AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/cyberchef-mcp?style=directory)](https://allmcps.com/mcp/cyberchef-mcp)
HTML Embed
<a href="https://allmcps.com/mcp/cyberchef-mcp"><img src="https://allmcps.com/api/badge/cyberchef-mcp?style=directory" alt="Cyberchef MCP on AllMCPs" /></a>