Cyber Chef MCP

🍳 CyberChef MCP Server

Deterministic Cryptographic Engine & Multi-Stage Deobfuscation Layer for AI Agents

-purple.svg?style=flat-square)

A pure-JavaScript Model Context Protocol (MCP) server that empowers autonomous AI agents (Claude Code, Cursor, Windsurf, Codex, Strix) to execute complex multi-stage deobfuscation recipes, evaluate calibrated Shannon entropy, parse modern password hashes (Argon2/bcrypt), and scan for PII/DLP data without LLM hallucination.

🌐 Live Cloud Dashboard • ⚡ Remote SSE Endpoint • 📦 NPM Package • 📜 MCP Server Card • 🤖 llms.txt

🌐 Live Cloud Deployment (Azure App Service)

CyberChef MCP is continuously hosted on Microsoft Azure with full HTTPS, SSE streaming, and discovery endpoints active:

⚡ Token Economics: Why Use CyberChef MCP?

Instead of burning thousands of output tokens having an LLM write, debug, and execute Python scripts in a sandbox, CyberChef MCP provides instantaneous, deterministic execution in a single tool call:

flowchart LR
    A[Untrusted / Obfuscated Payload] --> B[CyberChef Engine Core]
    B --> C{Execution Mode}
    C -->|Multi-Stage Pipeline| D[Sequential Recipe Bake<br>B64 → XOR → Gunzip → JSON]
    C -->|Unknown Encoding| E[Magic Heuristic Engine<br>Brute-Force & Byte Profiling]
    D & E --> F[Security & Forensics Layer<br>Calibrated Entropy / PHC Hashes / Luhn DLP / Safe Defang]
    F --> G[ReDoS Guard & Provenance Isolation]
    G --> H[Compact Bounded Result to AI Agent]

🚀 Quick Start & Integration

Option 1: Remote Azure SSE (Zero Setup Needed)

Connect your AI agent directly to the live cloud endpoint without installing any local packages:

In Claude Desktop (claude_desktop_config.json)

{
  "mcpServers": {
    "cyberchef-cloud": {
      "url": "https://cyber-chef-mcp-ehcdg4a5ebehgvc2.eastasia-01.azurewebsites.net/sse"
    }
  }
}

In Cursor (~/.cursor/mcp.json)

{
  "mcpServers": {
    "cyberchef": {
      "url": "https://cyber-chef-mcp-ehcdg4a5ebehgvc2.eastasia-01.azurewebsites.net/sse"
    }
  }
}

Option 2: Local Stdio via NPX (Recommended for Local Privacy)

Run locally on your workstation for zero network latency, air-gapped security, and offline operation:

Configuration (claude_desktop_config.json or mcp.json)

{
  "mcpServers": {
    "cyberchef": {
      "command": "npx",
      "args": ["-y", "@noorfatima123456/cyber-chef-mcp@latest"]
    }
  }
}

Via Claude Code CLI

claude mcp add cyberchef -- npx -y @noorfatima123456/cyber-chef-mcp@latest

Via Smithery (1-Click Install)

npx -y @smithery/cli install @noor-202401938/cyber-chef-mcp --client claude

🛠️ MCP Tools Catalog (17 Primary Forensic & Crypto Operations)

key: string
keyFormat?: string | Binary-Safe XOR Cipher: Bitwise encryption and decryption supporting UTF-8, Hex, and single-byte keys. | | cyberchef_rot13 | input: string
amount?: number | Caesar Rotation Cipher: Applies classic ROT13 or custom rotational character shifts. | | cyberchef_url_decode | input: string | URL Percent-Decoder: Decodes percent-encoded query strings and URI components. | | cyberchef_url_encode | input: string
encodeAll?: boolean | URL Percent-Encoder: Safely encodes special characters for web queries. | | cyberchef_sha256 | input: string | Cryptographic Hashing: Generates standard SHA-256 digests. | | cyberchef_help | query?: string | Dynamic Operation Catalog: Introspects available operations and schemas dynamically on demand. |

🔬 Empirical Claims Audit & Verification

CyberChef MCP was evaluated against an empirical verification test suite with cryptographic algorithms, adversarial regexes, and corrupted payloads:

================================================================================
🏁 EMPIRICAL CLAIMS AUDIT: 9/9 CYBERCHEF CLAIMS VERIFIED (100% PASS RATE)
================================================================================
[C1]  Core Cipher Involutions        ✅ Bidirectional lossless recovery (Base64/Hex/ROT13/XOR)
[C2]  Multi-Stage Recipe Execution   ✅ Successfully reversed Base64 -> XOR -> Gunzip pipeline
[C3]  Heuristic Magic Detection      ✅ Brute-forced XOR key 0x42 and recovered obfuscated string
[C4]  Modern PHC Hash Analysis       ✅ Parsed Argon2id memory (64MB), lanes, salt & bcrypt cost
[C5]  Calibrated Shannon Entropy     ✅ Repetitive: 0.00 bits; High-entropy: 5.43 bits (0.904 ratio)
[C6]  DLP Scanner (Luhn Verification)✅ Verified valid Visa, rejected bogus card, masked SSN
[C7]  Precise Indicator Defanging    ✅ Defanged URL & refanged back to exact byte-for-byte original
[C8]  ReDoS Backtracking Defense     ✅ Intercepted (a+)+$ nested quantifier before CPU starvation
[C9]  Untrusted Payload Isolation    ✅ Returned adversarial strings as inert data without evaluation

🏛️ Part of Project Hisaar (حصار)

CyberChef MCP powers the deep analysis engine inside Hisaar, the grassroots bilingual AI cybersecurity platform for Pakistan. While Hisaar provides automated AST remediation and community scam protection, cyber-chef-mcp is open-sourced as a standalone foundation for the global AI security ecosystem.

🏷️ Discoverability Tags & Keywords

mcp, mcp-server, cyberchef, cyber-chef-mcp, modelcontextprotocol, cybersecurity, agentic-ai, claude, cursor, windsurf, strix, cryptography, deobfuscation, reverse-engineering, dlp, entropy, argon2, bcrypt, jwt, aes-256, threat-hunting, defang, azure-app-service.

📄 License

Apache-2.0 © 2026 Noor Fatima