parobek/cyberchef-mcp repository overview

⁠CyberChef MCP Server

A Model Context Protocol (MCP) server wrapping GCHQ CyberChef⁠, the "Cyber Swiss Army Knife". It exposes 504 data-manipulation operations — encryption, encoding, compression, hashing, forensics — as tools an AI assistant can call directly.

Source & docs: https://github.com/doublegate/CyberChef-MCP⁠ · Licence: GPL-3.0-or-later (v1.9.x and earlier are Apache-2.0)

⁠Quick start

docker pull parobek/cyberchef-mcp:latest

echo '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
  | docker run -i --rm parobek/cyberchef-mcp:latest

The -i flag is required. Without stdin the container exits immediately — the single most common setup mistake.

⁠Use it with an MCP client

{
  "mcpServers": {
    "cyberchef": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "parobek/cyberchef-mcp:latest"]
    }
  }
}

Works with Claude Desktop, Claude Code, Cursor, and any client that speaks MCP over stdio.

⁠What you get

tools/list returns about 24 tools, not 504 — deliberately. Sending 504 tool schemas on every request costs roughly 86,000 tokens before the user types anything, so the default surface is an index:

Plus recipe management, batching, and cache/quota tools.

Nothing is unreachable. Every one of the 504 operations is reachable through this index — verified, not asserted: walking every category reaches 504/504 and describes 504/504.

Prefer the old behaviour? One variable:

# All 524 tools, ~86,000 tokens per tools/list
docker run -i --rm -e CYBERCHEF_TOOL_SURFACE=all parobek/cyberchef-mcp:latest

# A middle ground: ~100 tools, ~16,600 tokens
docker run -i --rm -e CYBERCHEF_TOOL_SURFACE=curated parobek/cyberchef-mcp:latest

⁠Tags

release-v1.x.x tags predate the current scheme and are kept so older references keep working.

Also on GHCR: ghcr.io/doublegate/cyberchef-mcp_v4 (major-versioned).

⁠Example

# Decode, decompress and extract indicators in one call
echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{
  "name":"cyberchef_bake","arguments":{
    "input":"H4sIAAAAAAAA/...",
    "recipe":[{"op":"From Base64"},{"op":"Gunzip"},{"op":"Extract IP addresses"}]}}}' \
  | docker run -i --rm parobek/cyberchef-mcp:latest

Eight runnable examples — quickstart, recipes, discovery, forensic triage, saved recipes, batching, multi-client HTTP, shell usage — are in examples/⁠, and CI executes them on every change.

⁠Configuration

Common variables (the User Guide⁠ documents all of them):

⁠HTTP transport

docker run --rm -p 3000:3000 \
  -e CYBERCHEF_TRANSPORT=http \
  -e CYBERCHEF_HTTP_HOST=0.0.0.0 \
  -e CYBERCHEF_ALLOWED_HOSTS=localhost:3000,127.0.0.1:3000 \
  parobek/cyberchef-mcp:latest

Serves many clients, each with its own session. DNS-rebinding protection is on by default, so a non-loopback bind needs CYBERCHEF_ALLOWED_HOSTS.

⁠Security

• Runs as unprivileged UID 65532 (Chainguard nonroot); both base images digest-pinned
• ReDoS screening on every user-supplied regular expression, before it executes
• SBOM (CycloneDX) and Trivy scan attached to every release
• Hardened invocation:

docker run -i --rm --read-only --tmpfs /tmp:size=100M \
  --cap-drop=ALL --security-opt=no-new-privileges parobek/cyberchef-mcp:latest

⁠Documentation

• Tutorial⁠ — a guided first hour
• User Guide⁠ — install, config, tuning
• Tool reference⁠
• Release notes⁠