Skip to main content
Glama
doublegate

CyberChef MCP Server

by doublegate

cyberchef_substitution_break

Read-only

Recover plaintext from monoalphabetic substitution ciphers by hill-climbing against English trigram fitness. Also cracks Caesar, ROT-N, and Atbash; accept known letter pairs to refine results.

Instructions

Recover a monoalphabetic substitution mapping from ciphertext alone, by hill-climbing on English trigram fitness with random restarts. Substitute needs the mapping and no operation finds one. Also solves Caesar, ROT-N and Atbash. Measured on held-out prose: 83.6% of letters at 150, 91.2% at 250, 95.9% at 350 — so expect one or two letter pairs still swapped. Pin what you can read with known_mapping and run it again.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
seedNoMake the search reproducible. Unset is non-deterministic, which is the right default: a fixed seed that lands in a bad local optimum lands there every time.
inputYesThe ciphertext. Non-letters are ignored and restored in the output.
restartsNoIndependent hill climbs. More is better and slower; the measured figures used 120. Bounded by a 20-second wall clock.
known_mappingNoLetters you already know, as comma-separated `cipher:plain` pairs, e.g. "q:t,w:h". Held fixed and never swapped.
preview_lettersNoHow much decrypted text to return. 0 for none.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv3.6.0

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses stochastic hill-climbing with random restarts, non-deterministic behavior, benchmark success rates (83.6/91.2/95.9%), and the practical failure mode that a few letter pairs may remain swapped. It also provides the remediation (pass `known_mapping` and rerun). These details go well beyond the readOnly/non-destructive annotations and reveal the search is not guaranteed-exact.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences with no filler: purpose and method, alternative rationale, error-rate expectations, and a concrete follow-up instruction. The main action and scope are front-loaded, and each remaining sentence carries operational value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a non-deterministic cryptanalysis tool with five parameters and no output schema, the definition supplies the key behavioral context: domain (English prose), expected accuracy, and how to improve results. The only notable gap is that the return shape (what parts are the recovered mapping vs. the decrypted preview) is not stated explicitly, though `preview_letters`' schema hint partially covers it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All five parameters already have detailed schema descriptions (100% coverage), so the bar for description contributions is lower. The description still adds meaningful input-length/accuracy expectations via the benchmark figures and offers a concrete usage strategy for `known_mapping`. It appropriately relies on the schema for `seed`, `restarts`, and `preview_letters` rather than restating them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Recover a monoalphabetic substitution mapping') with the method (hill-climbing on English trigram fitness with random restarts), and scopes the cipher families covered ('Also solves Caesar, ROT-N and Atbash'). It also distinguishes itself from `Substitute` by noting that no operation finds a mapping. Readily distinguishable from siblings such as `vigenere_break`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly tells the agent to use this when the mapping is unknown: 'Substitute needs the mapping and no operation finds one.' It also gives a repair workflow: pin known letters with `known_mapping` and run again. It stops short of explicitly routing away from the near-sibling `vigenere_break` for polyalphabetic ciphers, though 'monoalphabetic' implies the boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/doublegate/CyberChef-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server