CyberChef

You expose CyberChef’s operations as a structured MCP server so AI agents and MCP-aware apps can discover, inspect, and execute CyberChef recipes through a stable, programmatic interface. This server translates CyberChef-server’s capabilities into MCP tools for searching operations, inspecting argument schemas, baking recipes, validating recipes, and probing data encodings.

How to use

Use an MCP client to discover CyberChef operations, inspect their argument schemas, and run single or multi-step recipes against text or binary data. You can also validate recipes and obtain helpful hints for fixes or missing arguments. Start by listing relevant operations with fuzzy search, then fetch exact argument schemas for the operation you intend to use, and finally bake one or more recipes against your input.

Typical workflows include: 1) search for an operation by name or description, 2) inspect the operation’s required arguments, 3) bake a recipe for a single input, and 4) validate or repair a recipe before execution. You can also run cross-input batch recipes to process many items with the same sequence of operations.

Key tools you will interact with are: search_operations, get_operation_args, bake_recipe, batch_bake_recipe, validate_recipe, help_bake_recipe, cyberchef_probe, and perform_magic_operation. These tools enforce input/output schemas, so provide the exact argument keys as defined for each operation.

How to install

Prerequisites you need before installing: a Python environment and access to a running CyberChef-server (the upstream API the MCP server uses to perform transforms). You should also be prepared to run the MCP server itself locally or in a container.

Install locally with a Python virtual environment and project dependencies.

# From your project root
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

Run the MCP server locally

Start the MCP server and point it at your running CyberChef-server. The MCP service exposes a streamable HTTP transport on the port you choose.

python mcp_cyberchef_service.py \
  --api-url http://localhost:3000/ \
  --host 127.0.0.1 \
  --port 3002

Run with Docker

You can run the MCP server in a lightweight Docker container. The container accepts the same API URL and host/port options.

# Build the image
docker build -f Dockerfile -t cyberchef-mcp .

# Run the container, pointing to your CyberChef-server
docker run -d -p 3002:3002 \
  cyberchef-mcp \
  --api-url http://host.docker.internal:3000/ \
  --host 0.0.0.0 \
  --port 3002

MCP endpoints you can call

Use the HTTP endpoint to connect to the CyberChef upstream and the STDIO endpoint to run the MCP server locally. The HTTP endpoint targets the CyberChef-server at http://localhost:3000/ by default. The STDIO endpoint runs the MCP server as a local process that you start with the command shown.

Notes on usage

Operation names and argument keys are case-sensitive and must match CyberChef exactly. Start with search_operations to find the right operation, then get_operation_args to confirm the exact argument schema before baking recipes.

Examples and tips

Example flow: 1) search_operations("base64") to shortlist an operation like "From Base64". 2) bake_recipe with input_data: "SGVsbG8gV29ybGQh" and recipe: [{"op":"From Base64","args":{}}]. This returns the decoded string.

Available tools

search_operations

Find relevant CyberChef operations by name/description with fuzzy matching and optional inclusion of argument schemas.

get_operation_args

Return the exact argument schema for a single operation; with compact mode, enum values can be slugified.

bake_recipe

Execute a single recipe for one input string, returning the transformed output and any errors or warnings.

batch_bake_recipe

Run the same recipe against a batch of input strings, producing a results list.

validate_recipe

Check a recipe for valid operation names and argument keys, and receive suggestions for fixes or missing args.

help_bake_recipe

Provide a cheat sheet with notes and examples for composing recipes.

cyberchef_probe

Quick heuristics to guess encodings and propose a minimal recipe for a given input.

perform_magic_operation

Invoke CyberChef Magic to transform data with broader, possibly slower heuristics.