script-decoder-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| SDMCP_WEB_HOST | No | Host for the optional browser GUI (FastAPI server). Binds to 127.0.0.1 by default. | 127.0.0.1 |
| SDMCP_WEB_PORT | No | Port for the optional browser GUI (FastAPI server). Defaults to 8787. | 8787 |
| SDMCP_TRANSPORT | No | Transport to use: 'stdio' or 'http'. Defaults to 'stdio'. | stdio |
| SDMCP_CYBERCHEF_ENABLED | No | Whether to enable the local CyberChef-style adapter. Defaults to 'false'. | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| analyze_scriptA | Statically analyze a script (Python, PowerShell, shell, JavaScript, batch, or VBScript) without executing it. Returns behaviors, decoded artifacts, indicators, a risk score, and plain-language and analyst summaries. Never runs the submitted content. |
| decode_blobA | Safely decode an encoded or obfuscated value (Base64, hex, URL encoding, Base32, Unicode escapes, HTML entities, gzip/zlib/bz2, explicit-key XOR, ROT13, reversed strings, PowerShell -EncodedCommand, integer/char arrays, simple string concatenation) without executing the result. |
| extract_indicatorsA | Extract potential security indicators (URLs, domains, IPs, emails, file paths, registry keys, hashes, and more) from text or source code, including defanged notations. Never resolves domains or makes network requests. |
| explain_commandA | Explain a single command line in plain English without executing it: executable, arguments, pipelines, redirections, environment changes, and suspicious features. |
| compare_scriptsA | Compare two versions of a script and report added/removed behaviors, changed indicators, newly decoded artifacts, and the risk score delta. Neither script is executed. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 5 tools
Each tool has a clearly distinct purpose: analyzing a full script, decoding a single blob, extracting indicators, explaining a command line, and comparing script versions. Although analyze_script returns decoded artifacts and indicators, the dedicated tools serve standalone use cases without ambiguity.
All tool names follow a consistent verb_noun pattern: analyze_script, decode_blob, extract_indicators, explain_command, compare_scripts. The naming convention is uniform and predictable.
Five tools is well-scoped for a static script decoding and analysis server. Each tool covers a distinct capability without redundancy or bloat.
The tool surface covers the full static analysis workflow: analyzing scripts, decoding blobs, extracting indicators, explaining commands, and comparing versions. There are no obvious missing operations for the stated purpose of safely decoding and analyzing scripts without execution.