CyberChef MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| prompts | {} |
| resources | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| cyberchef_analyseA | Run one of this server's analysis tools -- analyses a CyberChef operation cannot express, such as recovering an XOR key length, breaking a classical cipher, identifying a hash, validating an X.509 chain or identifying a post-quantum key. List them with cyberchef_categories, get a schema with cyberchef_describe_operation, then run it here. These are NOT operations and cannot be used in a cyberchef_bake recipe. |
| cyberchef_bakeB | Execute a CyberChef recipe. Use this for complex chains of operations. |
| cyberchef_batchB | Execute multiple CyberChef operations in batch (parallel or sequential mode). Supports partial success. |
| cyberchef_cache_clearB | Clear the operation result cache. |
| cyberchef_cache_statsA | Get cache statistics including hits, misses, size, and items. |
| cyberchef_categoriesA | List CyberChef's operation categories with counts and examples. Start here to browse what this server can do, then use cyberchef_list_operations. |
| cyberchef_describe_operationA | Full argument schema, defaults and types for one or more operations. This is what you need before calling cyberchef_bake with a new operation. |
| cyberchef_list_operationsA | List the operations in one category, with a one-line summary of each. Use cyberchef_describe_operation for full argument schemas. |
| cyberchef_quota_infoA | Get current resource quota information including concurrent operations and data sizes. |
| cyberchef_recipe_createC | Create a new recipe with multiple operations. |
| cyberchef_recipe_deleteB | Delete a recipe by ID. |
| cyberchef_recipe_executeC | Execute a saved recipe with input data. |
| cyberchef_recipe_exportA | Export a recipe to various formats (json, yaml, url, cyberchef). |
| cyberchef_recipe_getA | Get a recipe by ID. |
| cyberchef_recipe_importB | Import a recipe from various formats. |
| cyberchef_recipe_listB | List all recipes with optional filtering. |
| cyberchef_recipe_testB | Test a recipe with sample inputs. |
| cyberchef_recipe_updateC | Update an existing recipe. |
| cyberchef_recipe_validateB | Validate a recipe without saving it. |
| cyberchef_searchA | Search for available CyberChef operations. Returns names and one-line summaries; follow up with cyberchef_describe_operation for argument schemas. |
| cyberchef_telemetry_exportB | Export collected telemetry metrics. Returns anonymized usage statistics. |
| cyberchef_worker_statsA | Get worker thread pool statistics including thread count, utilization, and completed tasks. Only available when ENABLE_WORKERS=true. |
| cyberchef_magicB | The Magic operation attempts to detect various properties of the input data and suggests which operations could help to make more sense of it.OptionsDepth: If an operation appears to match the data, it will be run and the result will be ana... |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| analyse-unknown-data | Identify what an unknown string or blob is, then decode it. Use this when you do not yet know the encoding, cipher or file type. |
| extract-iocs | Pull URLs, IP addresses, email addresses, domains and hashes out of a document, log or script, and defang them for safe reporting. |
| deobfuscate-script | Unwrap an obfuscated PowerShell, JavaScript, VBScript or PHP payload layer by layer and report what it does. |
| identify-hash | Work out which algorithm produced a hash, and what can be done with it. |
| break-cipher | Recover the plaintext from a classical or repeating-key cipher when you do not have the key. |
| decode-chain | Walk a known chain of nested encodings, when you already know roughly what was done to the data. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 23 tools
Most tools are distinct, but cyberchef_recipe_execute, cyberchef_bake, and cyberchef_batch overlap heavily in executing operations/recipes; the description clarifies that bake is for complex chains and batch for multiple operations, but the boundaries remain fuzzy for an agent.
All tools follow the consistent prefix_noun_verb pattern (cyberchef_recipe_delete, cyberchef_list_operations, etc.), making the set predictable and scannable.
23 tools is on the heavy side for a single domain; the 10 recipe lifecycle tools are justified, but cache, worker, quota, and telemetry stats tools add operational overhead that feels tangential to core CyberChef usage.
Recipe lifecycle is fully covered (create, get, list, update, delete, test, validate, import, export, execute), and operation discovery plus analysis tools are present; minor gaps include no direct recipe duplicate/copy or operation-level metadata export.