CyberChef MCP Server

What CyberChef MCP Server MCP server does

CyberChef MCP Server MCP server exposes a JavaScript implementation of CyberChef-style operations to MCP-compatible AI agents. Its catalog contains 17 primary tools covering 28 core operations, including encoding and decoding, ciphers, hashing, JWT inspection, entropy analysis, entity extraction, URL defanging, and multi-step recipe execution.

The server is suited to workflows where an agent must process a supplied string or token and receive a bounded, structured result. Examples include converting between hexadecimal and text, encoding or decoding Base64, applying XOR or ROT13, inspecting JWT claims, classifying modern password-hash formats, and identifying selected sensitive entities in text.

How it works

The cyberchef_bake tool accepts an input string and an ordered recipe array. This lets an agent combine operations such as hexadecimal decoding, XOR, Base64 handling, and decompression in one pipeline.

For inputs with an unknown representation, cyberchef_magic provides heuristic decoding for cases such as unknown encodings, single-byte XOR keys, and compressed data. Other tools perform focused analysis: cyberchef_entropy calculates Shannon entropy with representation-specific reference points, while cyberchef_jwt_decode reads JOSE headers and claims, formats expiration timestamps, and checks for a signature.

The server can run locally over stdio or remotely over Server-Sent Events. The hosted deployment also exposes JSON-RPC messaging, a health endpoint, and MCP discovery documents. Local execution keeps processing on the workstation; remote execution uses the published Azure endpoint.

Setup and configuration

For local use, configure an MCP client to run Node.js through npx:

{
  "mcpServers": {
    "cyberchef": {
      "command": "npx",
      "args": ["-y", "@noorfatima123456/cyber-chef-mcp@latest"]
    }
  }
}

The package requires Node.js 18 or newer. The same command can be added through the Claude Code CLI.

For remote use, point an MCP client at the published SSE URL:

{
  "mcpServers": {
    "cyberchef-cloud": {
      "url": "https://cyber-chef-mcp-ehcdg4a5ebehgvc2.eastasia-01.azurewebsites.net/sse"
    }
  }
}

Tools and capabilities

CyberChef MCP Server MCP server includes tools for:

• Running sequential recipes with cyberchef_bake.
• Heuristic decoding with cyberchef_magic.
• Decoding JWT headers and claims with cyberchef_jwt_decode.
• Measuring calibrated Shannon entropy with cyberchef_entropy.
• Auditing PHC-format hashes and bcrypt with cyberchef_analyse_hash.
• Extracting selected credit-card, SSN, PAN, IBAN, IP, AWS key, and email patterns with cyberchef_extract_entities.
• Defanging URLs, IPs, and email indicators with cyberchef_defang_url.
• Encoding and decoding Base64 and hexadecimal data.
• Applying binary-safe XOR and ROT13 transformations.

The Base64 and hexadecimal decoders return structured information such as text, hexadecimal output, printability, or byte length, rather than requiring every result to be interpreted as text.

Limitations and notes

The remote deployment requires network access, while local stdio is the documented option for offline or privacy-sensitive operation. Results depend on the input and the selected recipe, so agents should choose operations explicitly when heuristic decoding is not appropriate.