Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@io.github.daedalus/mcp-cryptography hash the string 'hello' using SHA-256"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP server exposing cryptography library functionality.
mcp-name: io.github.daedalus/mcp-cryptography
pip install mcp-cryptographyRelated MCP server: Azure Key Vault MCP
from mcp_cryptography import mcp
# Run the MCP server
if __name__ == "__main__":
mcp.run()The server provides the following cryptographic tools:
generate_symmetric_key - Generate a Fernet symmetric key
generate_rsa_key - Generate an RSA key pair
generate_x25519_key - Generate an X25519 key pair
fernet_encrypt / fernet_decrypt - Fernet encryption
aes_encrypt / aes_decrypt - AES encryption (CBC/GCM modes)
rsa_encrypt / rsa_decrypt - RSA OAEP encryption
rsa_sign / rsa_verify - RSA digital signatures
hash_sha256 - SHA-256 hash
hash_sha512 - SHA-512 hash
hash_sha1 - SHA-1 hash
hmac_sign - Generate HMAC
hmac_verify - Verify HMAC
pbkdf2_derive - PBKDF2 key derivation
scrypt_derive - Scrypt key derivation
generate_self_signed_cert - Generate self-signed certificate
parse_certificate - Parse X.509 certificate
generate_random_bytes - Generate random bytes
generate_random_base64 - Generate random base64 bytes
git clone https://github.com/daedalus/mcp-cryptography.git
cd mcp-cryptography
pip install -e ".[test]"
# run tests
pytest
# format
ruff format src/ tests/
# lint
ruff check src/ tests/
# type check
mcp_cryptography src/Decrypt AES ciphertext.
Args: key: Hex-encoded AES key. ciphertext: Hex-encoded ciphertext. iv: Hex-encoded initialization vector. mode: Encryption mode - 'CBC' or 'GCM' (default CBC).
Returns: Decrypted string.
Raises: ValueError: If key size is invalid.
Inputs: iv (required), key (required), ciphertext (required), mode. Returns: result
Encrypt data using AES.
Args: key: Hex-encoded AES key (16, 24, or 32 bytes). data: String to encrypt. mode: Encryption mode - 'CBC' or 'GCM' (default CBC).
Returns: Dictionary with 'ciphertext' (hex) and 'iv' (hex).
Raises: ValueError: If key size is invalid.
Inputs: key (required), data (required), mode. Returns: object
Decrypt Fernet ciphertext.
Args: key: Base64-encoded Fernet key. ciphertext: Base64-encoded ciphertext.
Returns: Decrypted plain text string.
Raises: cryptography.fernet.InvalidToken: If decryption fails.
Inputs: key (required), ciphertext (required). Returns: result
Encrypt data using Fernet symmetric encryption.
Args: key: Base64-encoded Fernet key. data: Plain text string to encrypt.
Returns: Base64-encoded ciphertext.
Example: >>> key = generate_symmetric_key() >>> ciphertext = fernet_encrypt(key, "Hello, World!") >>> len(ciphertext) > 0 True
Inputs: key (required), data (required). Returns: result
Generate random bytes encoded as base64.
Args: length: Number of bytes to generate (default 32).
Returns: Base64-encoded random string.
Inputs: length. Returns: result
Generate random bytes.
Args: length: Number of bytes to generate (default 32).
Returns: Hex-encoded random bytes.
Example: >>> generate_random_bytes(16) 'a1b2c3d4e5f6...'
Inputs: length. Returns: result
Generate an RSA key pair.
Args: key_size: Key size in bits (default 2048). Must be at least 2048.
Returns: Dictionary with 'public_key' and 'private_key' in PEM format.
Raises: ValueError: If key_size is less than 2048.
Inputs: key_size. Returns: object
Generate a self-signed X.509 certificate.
Args: common_name: Common name for the certificate subject. organization: Organization name (optional). days_valid: Number of days the certificate is valid (default 365).
Returns: Dictionary with 'certificate' (PEM) and 'private_key' (PEM).
Inputs: common_name (required), days_valid, organization. Returns: object
Generate a Fernet symmetric key.
Returns: Base64-encoded 32-byte key suitable for Fernet encryption.
Example: >>> key = generate_symmetric_key() >>> len(key) # 44 characters base64 encoded 44
Inputs: no named parameters. Returns: result
Generate an X25519 key pair for key exchange.
Returns: Dictionary with 'public_key' and 'private_key' in PEM format.
Example: >>> keys = generate_x25519_key() >>> len(keys['public_key']) > 0 True
Inputs: no named parameters. Returns: object
Compute SHA-1 hash.
Note: SHA-1 is considered cryptographically broken. Use only for legacy compatibility.
Args: data: String to hash.
Returns: Hex-encoded hash.
Inputs: data (required). Returns: result
Compute SHA-256 hash.
Args: data: String or base64-encoded bytes to hash.
Returns: Hex-encoded hash.
Example: >>> hash_sha256("Hello, World!") 'dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f'
Inputs: data (required). Returns: result
Compute SHA-512 hash.
Args: data: String to hash.
Returns: Hex-encoded hash.
Inputs: data (required). Returns: result
Generate HMAC.
Args: key: Hex-encoded key. data: String to sign. algorithm: Hash algorithm - 'sha256' or 'sha512' (default sha256).
Returns: Hex-encoded HMAC.
Example: >>> hmac_sign("aabbcc", "message") 'c053c4f7...'
Inputs: key (required), data (required), algorithm. Returns: result
Verify HMAC.
Args: key: Hex-encoded key. data: String that was signed. hmac: Hex-encoded HMAC to verify. algorithm: Hash algorithm - 'sha256' or 'sha512'.
Returns: True if HMAC is valid.
Inputs: key (required), data (required), hmac (required), algorithm. Returns: result
Parse X.509 certificate.
Args: certificate_pem: Certificate in PEM format.
Returns: Dictionary with 'subject', 'issuer', 'not_valid_before', 'not_valid_after'.
Inputs: certificate_pem (required). Returns: object
Derive key using PBKDF2.
Args: password: Password to derive from. salt: Hex-encoded salt (optional, will generate if not provided). iterations: Number of iterations (default 480000, OWASP recommended).
Returns: Dictionary with 'derived_key' (hex) and 'salt' (hex).
Inputs: password (required), salt, iterations. Returns: object
Decrypt RSA ciphertext using private key.
Args: private_key_pem: RSA private key in PEM format. ciphertext: Base64-encoded ciphertext.
Returns: Decrypted string.
Inputs: ciphertext (required), private_key_pem (required). Returns: result
Encrypt data using RSA with OAEP asymmetric_padding.
Args: public_key_pem: RSA public key in PEM format. data: String to encrypt (max ~446 bytes for 4096-bit key).
Returns: Base64-encoded ciphertext.
Raises: ValueError: If data is too large for the key size.
Inputs: data (required), public_key_pem (required). Returns: result
Create RSA digital signature.
Args: private_key_pem: RSA private key in PEM format. data: String to sign.
Returns: Base64-encoded signature.
Inputs: data (required), private_key_pem (required). Returns: result
Verify RSA digital signature.
Args: public_key_pem: RSA public key in PEM format. data: Original signed data. signature: Base64-encoded signature.
Returns: True if signature is valid.
Inputs: data (required), signature (required), public_key_pem (required). Returns: result
Derive key using Scrypt.
Args: password: Password to derive from. salt: Hex-encoded salt (optional, will generate if not provided).
Returns: Dictionary with 'derived_key' (hex) and 'salt' (hex).
Inputs: password (required), salt. Returns: object
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 22 tools
Tools are generally distinct, but generate_symmetric_key and generate_random_bytes both produce random data, which could cause confusion; however, descriptions clarify their purposes.
Naming conventions vary: some tools use verb_noun (generate_symmetric_key), others use algorithm_verb (fernet_encrypt, aes_encrypt), and hash_sha256 mixes verb and algorithm. Inconsistency reduces predictability.
22 tools cover a broad cryptography domain; while slightly above the typical 3-15 range, each tool has a clear purpose and the count is justified.
Major cryptographic operations are covered: symmetric/asymmetric encryption, hashing, signing, key derivation, certificates. Missing modern algorithms like Ed25519 or ECDSA are minor gaps.
Production-grade cryptography toolkit with 31 MCP tools for classical, PQC, and KMS workflows.
Hash passwords with bcrypt and issue/verify JWT session tokens over A2A + MCP.
Exact hashing, base64/hex/URL encoding, JWT decoding and UUIDs for AI agents. No auth required.