steganography-mcp

Extract archive-level and per-file comments from a ZIP archive. Comments are a common steganographic hiding spot as they can contain arbitrary data without affecting archive functionality.

Auto-detect steganography in ZIP archives. Checks for slack spaces between entries, prepended data before the first local header, appended data after the end-of-central-directory record, unusual extra fields, and file/archive comments that may conceal hidden data.

ZIP extra field analysis. Parses and describes each extra field in every entry of the archive (both local file headers and central directory entries). Extra fields can hide arbitrary data using custom or unknown header IDs.

Archive metadata summary. Reports file count, total compressed and uncompressed sizes, overall compression ratio, per-entry compression ratios, timestamps, version info, and encryption flags. Provides a high-level overview of the archive.

Archive polyglot detection. Checks if a ZIP archive has prepended data that could make it valid as another file format (e.g., PDF+ZIP, PNG+ZIP, ELF+ZIP). Polyglot files are used in CTF challenges and to bypass file type filters.

Slack space analysis for ZIP archives. Identifies and hex-dumps gaps between ZIP local file entries. Slack spaces are unused bytes between entries that can conceal hidden data without altering the archive's functionality.

ZIP entry structure analysis. Lists all local file headers with their byte offsets, compressed and uncompressed sizes, compression method, CRC-32, flags, and data start offsets. Provides a low-level structural map of the archive.

Auto-detect audio steganography in a WAV file. Runs LSB chi-square, entropy analysis, metadata inspection, and checks for appended data after the WAV data chunk.

Echo hiding detection via autocorrelation analysis. Computes normalized autocorrelation at common echo delays (50-1000 samples). Unusually regular echo patterns indicate steganographic echo hiding.

PCM sample LSB statistical analysis. Performs chi-square test on LSBs grouped by value pairs to detect LSB replacement steganography in WAV audio.

Extract LSB data from audio samples. Reads the least significant bit of each PCM sample and attempts to decode hidden data.

Extract metadata from a WAV file including RIFF INFO chunks, format details, and all chunk information.

Analyze silent sections in WAV audio for hidden data. Finds near-zero sample regions and checks their LSBs — silent sections with active LSBs are a strong indicator of steganography.

Basic spectral analysis for hidden signals in WAV audio. Analyzes sample value distribution, zero-crossing rate, RMS energy per block, and detects anomalous quiet sections with high entropy.

Estimate BPCS embedding capacity. Counts the number of complex blocks at various thresholds across all bit planes and channels, then calculates the maximum data that could be hidden using BPCS. Reports capacity in bits, bytes, and as a percentage of the image size.

Generate a detailed complexity map of all bit planes for a given channel. Computes border complexity for each 8x8 block across all 8 bit planes, producing a spatial map showing where complex (potentially data-carrying) regions are located in the image.

Auto-detect BPCS (Bit-Plane Complexity Segmentation) steganographic embedding. Computes the complexity map across all bit planes and channels, then checks for an abnormally high ratio of complex blocks — the signature of BPCS embedding which replaces complex bit-plane regions with hidden data.

Extract data from BPCS complex regions. Gathers bits from all blocks that exceed the complexity threshold in the specified bit plane, assembling them in raster-scan order. The extracted bytes are analyzed for structure including magic bytes, entropy, and printable text content.

Complexity threshold analysis for BPCS steganalysis. Tests multiple threshold values and analyzes how the complex/simple block ratio changes. Finds the optimal threshold boundary where BPCS embedding would be most detectable, and identifies threshold ranges that produce suspicious ratios.

Inject data into format-specific comment fields. Supports PNG tEXt chunks, JPEG COM markers, and GIF comment extensions. The comment is stored in a standards-compliant way that most viewers ignore but metadata tools can read.

Append data after a file's end-of-file marker. The injected data is invisible to most viewers/parsers since they stop reading at the format EOF. Supports any file format — simply appends the given data string to the file's end.

Inject data into a file's metadata fields. For PNG files, inserts a tEXt chunk with the given field name and data. For JPEG files, inserts EXIF APP1 data. The injected metadata persists in the file and is accessible via metadata readers.

Create null cipher text that hides a secret message using letter selection. In 'first_letter' mode, the first letter of each word spells out the secret. In 'nth_word' mode, every Nth word's first letter spells the secret. Returns the generated cipher text.

Embed data in palette color entry LSBs for indexed-color images (PNG with PLTE chunk or GIF). Each palette entry has R, G, B values — the least significant bit of each channel encodes one bit of the secret data. Capacity is 3 bits per palette entry.

Create polyglot files by prepending one file format before another. The resulting file is valid when interpreted as either format. For example, prepend a PDF before a ZIP to create a file that is both a valid PDF and a valid ZIP.

Embed data in file whitespace using trailing spaces and tabs on text lines. Each bit of the secret data is encoded as a trailing space (0) or tab (1) appended to lines in the cover text file. The whitespace is invisible in most text editors.

Multi-format decoder supporting Base64, hex, binary, decimal, octal, URL encoding, ROT13, Base32, Morse code, and HTML entities. In auto mode, detects the encoding first and applies the appropriate decoder.

Auto-detect encoding type of an input string. Tests against all known encoding patterns (Base64, hex, binary, morse, URL encoding, HTML entities, etc.) and returns matches sorted by confidence, with attempted decoding for top results.

Shannon entropy calculation and classification for strings. Computes both character-level and byte-level entropy, classifying the result into categories: very low (repeated), low (simple text), normal text, compressed/encoded, or encrypted/random.

Character frequency analysis for cryptanalysis. Counts character occurrences, compares to standard English letter frequency (ETAOINSHRDLU), and calculates the Index of Coincidence. IC near 0.0667 suggests English/monoalphabetic, IC near 0.038 suggests random/polyalphabetic.

Hash type identification. Matches the input against known hash patterns by length and format to identify possible hash algorithms (MD5, SHA-1, SHA-256, SHA-512, bcrypt, CRC32, NTLM, MySQL, etc.).

Known cipher and encoding pattern detection. Analyzes text for indicators of Caesar cipher, substitution cipher, Vigenere, rail fence transposition, Atbash cipher, and reversed text. Uses statistical methods like Index of Coincidence and frequency analysis.

XOR key brute-force for single-byte and multi-byte keys. Tries all single-byte XOR keys (0x00-0xFF) and scores by printable character ratio. For multi-byte keys, uses Index of Coincidence to estimate key length. Returns top 5 most likely results.

Hidden HTML content detection. Scans HTML files for covert content including HTML comments, elements with display:none or visibility:hidden, data-* attributes, hidden form inputs, base64 embedded content, zero-size elements, and other techniques used to hide information.

Hidden PDF content detection. Scans PDF files for suspicious elements including embedded JavaScript (/JS), auto-actions (/AA, /OpenAction), hidden annotations, invisible text (white-on-white), embedded files, and other potentially malicious or covert content.

PDF metadata extraction. Parses the /Info dictionary for standard fields (Title, Author, Creator, Producer, CreationDate, ModDate) and searches for XMP metadata blocks. Useful for forensic attribution and document provenance analysis.

PDF stream analysis. Locates all stream/endstream blocks in a PDF, attempts zlib decompression on each, and reports sizes and entropy. Useful for finding hidden data within compressed PDF content streams.

XML and Office document metadata extraction. Parses XML-like content for Dublin Core metadata (dc:creator, dc:title), Microsoft Office properties, processing instructions, and other metadata that may reveal authorship, editing history, or hidden information.

Detect data appended after a file's format-specific end-of-file marker. Supports PNG (IEND), JPEG (FFD9), BMP (file size header), ZIP (end of central directory), and PDF (%%EOF). Commonly used to hide data in images and documents.

Binary diff between two files. Compares files byte-by-byte and reports size comparison, first N differences with their offsets and values, percentage of identical bytes, and a summary of the changes. Useful for detecting steganographic modifications.

Scan for embedded files within a binary, similar to binwalk. Searches for known magic byte signatures at every offset within the file to discover hidden or appended files, concatenated archives, and other embedded content.

Section-by-section entropy analysis of a file. Calculates Shannon entropy per block and overall, flagging anomalous high-entropy sections that may indicate encrypted, compressed, or steganographically embedded data.

ASCII entropy visualization of a file. Renders a text-based bar chart showing entropy levels across the file, making it easy to visually spot high-entropy regions that may contain hidden data, encryption, or compression.

Deep header and structure analysis for known file formats. Parses and displays format-specific header fields including PNG IHDR chunk, JPEG SOF markers, BMP info header, ZIP local file headers, and PDF version/metadata. Provides low-level structural insight.

Hex dump with ASCII sidebar display. Shows file contents in traditional hex editor format with offset addresses, hexadecimal byte values, and printable ASCII representation. Useful for manual inspection of binary file structures.

File type identification via magic bytes. Reads the file header and matches against a comprehensive database of known file signatures. Also checks for extension vs actual type mismatch.

Detect polyglot files that are valid as two or more different file formats simultaneously. Checks for multiple valid file signatures at different offsets (e.g., PDF+ZIP, PNG+PDF). Useful for CTF challenges and forensic analysis.

Extract printable and Unicode strings from binary files, similar to the Unix 'strings' command. Scans for runs of printable characters of a configurable minimum length and reports them with their file offsets. Supports ASCII, UTF-8, and UTF-16.

Analyze GIF application extensions. Inspects NETSCAPE and other application extension blocks for anomalies or hidden data payloads.

Extract and analyze GIF comment extensions. Comments can be used to hide data within a GIF file. Reports all comment text, sizes, and entropy.

Auto-detect steganography in a GIF file. Analyzes the global color table for LSB patterns, checks for appended data after the trailer, inspects comment extensions, and reports frame count and animation info.

Analyze multi-frame GIF animation properties. Reports per-frame size, delay times, disposal methods, local color tables, and anomalies in frame dimensions or compression.

Analyze LZW compressed sub-block sizes and entropy in GIF image data. Checks individual sub-block sizes for anomalies and patterns that may indicate steganographic manipulation of the compressed stream.

Analyze the GIF global color table for steganographic indicators. Reports sort order, duplicate entries, unused slots, color distribution, and luminance profile.

Extract and analyze LSB patterns from GIF color table entries. Reports per-channel LSB bit strings, balance ratios, and chi-square test results for LSB uniformity.

Visualize the GIF block structure. Shows all blocks (header, color tables, extensions, image descriptors, trailer) with offsets and sizes for forensic analysis.

Detect and extract data appended after the image EOF marker. Checks for hidden data past PNG IEND, JPEG EOI, or BMP file size boundary.

Extract and visualize a specific bit plane from an image channel. Shows dimensions, percentage of 1-bits, and an ASCII art preview of the first rows.

Per-channel statistical analysis for R, G, B, and A channels. Reports mean, standard deviation, entropy, min, max, and unique value count for each channel.

Chi-square steganalysis attack on each color channel independently. Detects LSB replacement by testing whether adjacent pixel value pairs are equalized.

Pixel-by-pixel comparison of two images. Reports identical/different pixel counts, max difference, and which channels are affected. Useful for detecting steganographic modifications.

Auto-detect steganography in an image. Runs chi-square, RS analysis, entropy, metadata, appended data, and tool signature checks. Returns a comprehensive JSON report.

Per-block entropy analysis of an image. Splits the image into blocks and calculates Shannon entropy per block, flagging high-entropy regions that may contain hidden data.

Generate a pixel value histogram with anomaly detection. Detects Pairs-of-Values (PoV) anomalies that indicate LSB steganography.

Scan image file bytes for known steganography tool signatures. Checks against a database of known patterns from tools like OpenStego, Steghide, JSteg, F5, and others.

Statistical LSB steganography detection. Runs chi-square and sample pair analysis on each color channel independently.

Embed a message into an image using LSB steganography. Reads a PNG file, embeds the message into the least significant bits, and writes a new PNG file.

Extract hidden data from image LSBs. Extracts bits from specified channels and bit plane, attempts UTF-8 decode, and shows hex dump.

Deep metadata extraction from an image. For PNG: extracts text chunks, chunk list, IHDR info. For JPEG: extracts EXIF, comments, quantization tables, marker list.

RS (Regular-Singular) steganalysis using the Fridrich-Goljan-Du method. Analyzes pixel groups to estimate LSB embedding rate per channel.

Crop-recalibrate steganalysis. Crops the image by removing a few pixel rows/columns to break DCT block alignment, then compares DCT and pixel statistics between the original and calibrated version. Steganographic modifications are revealed because recalibration restores natural statistics that embedding had disrupted.

Sliding window chi-square analysis over sequential DCT coefficients. Divides the coefficient stream into windows of configurable size and runs chi-square pair analysis on each window. Returns per-window p-values and detection results to map where embedding starts and stops.

JPEG stego tool compatibility check. Analyzes the image to determine which steganography tools could have been used based on its properties: color space, quality factor, progressive vs baseline encoding, marker structure, quantization tables, and metadata patterns.

F5 steganography detection. F5 embeds data by decrementing the absolute values of DCT coefficients toward zero (shrinkage). Detects the characteristic excess of zeros relative to near-zero coefficients and the histogram dip at +/-1 that F5 matrix embedding produces.

JSteg steganography detection. JSteg replaces the LSB of non-zero, non-one DCT coefficients. Uses chi-square test on coefficient value pairs (2k, 2k+1) to detect the equalization that JSteg embedding produces. Includes sliding window analysis on sequential AC coefficients.

OutGuess steganography detection. OutGuess embeds data in DCT coefficients and adjusts unused coefficients to preserve first-order statistics. Detects by analyzing second-order statistics (inter-block coefficient correlations) that OutGuess disrupts, and checks for preserved histogram with disrupted spatial correlations.

Pixel Value Differencing (PVD) steganography detection applied to JPEG. PVD encodes data in the differences between adjacent pixel values. Detects by analyzing the distribution of pixel differences for the staircase pattern at PVD range boundaries (Wu-Tsai ranges). Works on decoded pixel data via jpeg-js.

Extract and analyze JPEG COM (comment) markers. Checks for hidden data patterns, unusually large comment segments, and high-entropy content that could indicate steganographic payloads concealed in comment fields.

DCT coefficient distribution analysis for steganography detection. Analyzes the Y-channel pixel value distribution and SOS entropy data to detect anomalies caused by DCT-domain stego tools like JSteg, F5, and OutGuess.

Detect double JPEG compression artifacts. Double compression occurs when a JPEG is decoded and re-encoded, which introduces characteristic blocking artifacts and quantization table anomalies — a common indicator of image tampering or steganographic embedding.

Deep EXIF analysis including GPS coordinates, timestamps, software info, thumbnails, maker notes, and all IFD entries. Flags interesting fields for forensic investigation such as editing software traces, GPS location, and temporal inconsistencies.

Quantization table analysis with quality estimation. Displays all quantization tables in 8x8 grid format and estimates the JPEG quality factor by comparing against the standard luminance/chrominance tables — essential for forensic analysis.

Parse JPEG markers/segments with offsets and sizes. Shows the internal structure of a JPEG file including all markers, their positions, and segment lengths — useful for identifying hidden data or anomalous segments.

Compare the EXIF thumbnail against the main JPEG image. A dimension or content mismatch between the thumbnail and the main image is a strong indicator that the main image was modified after capture while the original thumbnail was preserved — a common forensic artifact.

Auto-detect MP3 steganography. Checks ID3 tag padding, gaps before first audio frame, trailing data after last frame, bitrate anomalies, and inter-frame gaps for signs of hidden data.

MP3 frame header analysis. Examines bitrate changes, padding patterns, VBR detection, frame size consistency, and layer/version anomalies across audio frames.

ID3v1/v2 hidden data analysis. Inspects APIC (image) frames, PRIV (private) frames, excessive padding, unknown frame IDs, and overall tag entropy for signs of steganographic content.

Full MP3 metadata extraction. Reports ID3v1 tag, ID3v2 frames with content, duration, bitrate, VBR status, sample rate, and file structure overview.

Bit reservoir and padding manipulation detection. Analyzes the gap before the first audio frame, inter-frame gaps between consecutive frames, and checks for data inserted between or around audio frames.

Statistical analysis of decoded MP3 frame sizes. Computes entropy, variance, and anomalies in frame size distribution to detect steganographic manipulation of audio frame data.

MP3 frame structure visualization. Displays the first N frames with bitrate, padding bit, channel mode, and frame size for a detailed map of the file's audio frame layout.

Auto-detect network steganography in a PCAP file. Checks IP covert header fields, ICMP payload anomalies, DNS tunneling indicators, and inter-packet timing patterns. Returns a combined suspicion score.

DNS tunneling detection. Analyzes subdomain length distribution, label entropy, TXT record usage, query frequency per domain, and unique subdomain counts to identify DNS-based covert channels.

HTTP header covert channel analysis. Examines unusual/custom headers, cookie value entropy, header ordering anomalies, and hidden data in standard header fields across HTTP traffic in a PCAP.

ICMP echo payload analysis. Examines entropy, printable content ratio, payload size anomalies, and pattern consistency of ICMP echo request/reply payloads to detect covert data exfiltration.

IP header covert field analysis. Examines TTL patterns, IP identification field entropy, and TOS/DSCP usage across packets to detect hidden data in IP header fields.

PCAP statistics summary. Reports packet count, protocol distribution, top IP pairs, port usage, capture duration, and data volume for an overview of the capture file.

TCP sequence/acknowledgment number analysis. Checks for patterns in ISN (Initial Sequence Numbers), unusual TCP options, and seq/ack number anomalies that could indicate covert channel usage.

Inter-packet timing analysis. Computes packet arrival intervals and analyzes them for binary encoding patterns (e.g., short interval = bit 0, long interval = bit 1). Detects timing-based covert channels.

Compare two QR code images for differences. Performs pixel-by-pixel comparison, identifies differing modules, and analyzes whether differences are in the data region or function patterns. Useful for detecting stego modifications between an original and modified QR code.

Extract QR data region pixels from an image. Identifies the QR code grid, excludes function patterns (finder, timing, alignment), and returns the raw pixel values from the data/ECC modules. Useful for manual analysis of potentially modified data regions.

Detect steganography in QR code images. Analyzes the image for unusual pixel patterns around data modules, checks for sub-module color variations, and measures pixel value distributions that could indicate LSB embedding or other stego techniques applied to a QR code image.

Error correction capacity analysis for QR code images. Estimates the QR version and calculates the total, data, and ECC codewords for each error correction level (L/M/Q/H). Reports unused ECC capacity that could theoretically hold steganographic data without breaking the QR code.

Module-level pixel analysis of QR code images. Examines individual modules (the black/white squares) for sub-pixel anomalies: color variation within a single module, non-uniform grayscale values, and deviations from expected pure black (0) or pure white (255). These anomalies can indicate LSB stego or watermarking.

QR code structure analysis. Detects finder patterns (the 3 corner squares), estimates the QR version from the distance between patterns, reports the estimated module (pixel) size, and provides the image's dimensions relative to the expected QR grid.

Autocorrelation-based steganography detection. Computes the autocorrelation of pixel values to find periodic embedding patterns. Spread spectrum and watermarking methods often introduce periodic signals that appear as peaks in the autocorrelation function.

DFT magnitude spectrum analysis for spread spectrum steganography detection. Computes the Discrete Fourier Transform of pixel values and analyzes the frequency spectrum for hidden signals, unusual peaks, or spectral flatness anomalies that indicate spread spectrum embedding.

Noise floor embedding detection. Compares noise levels across image regions to detect spread spectrum or additive noise-based steganography. Embedded data adds noise to cover pixels, and uneven noise distribution between smooth and textured regions can reveal hidden content.

Patchwork watermark detection using the patchwork statistical test. Splits pixel values into two pseudo-random groups and tests whether the mean difference between groups is statistically significant. A significant difference indicates a patchwork watermark was embedded by adding/subtracting a small value from selected pixels.

Statistical watermark detection via variance comparison between image regions. Divides the image into blocks and compares pixel variance across regions. Watermarked regions tend to have altered variance patterns compared to natural image content, revealing the presence of additive watermarks.

Detect first-letter, first-word, last-letter, last-word, or nth-character patterns (acrostic messages) hidden across lines of text.

Auto-detect text steganography. Checks for zero-width characters, whitespace encoding, invisible Unicode, homoglyphs, and unusual patterns.

Detect Unicode homoglyph substitutions in text. Identifies non-ASCII characters that visually resemble ASCII letters (e.g., Cyrillic a vs Latin a, Greek o vs Latin o).

Scan text for ALL invisible Unicode characters. Checks every character against the full invisible character database and reports positions, names, and categories.

Full Unicode character distribution analysis. Categorizes all characters by script block, performs entropy analysis, and detects suspicious script mixing.

Detect whitespace encoding in text. Checks each line for trailing whitespace patterns where space=0 and tab=1 might encode binary data.

Extract a whitespace-encoded message from text. Reads trailing whitespace from each line and decodes space=0/tab=1 binary encoding.

Detect zero-width characters (ZWSP, ZWNJ, ZWJ, BOM) in text. Reports positions, counts, and potential encoded message length.

Embed a secret message into cover text using zero-width characters. Encodes the message to binary and maps bits to ZWSP(0)/ZWNJ(1), inserting them between characters of the cover text.

Decode a zero-width character encoded message. Extracts ZWC chars and decodes binary: ZWSP=0, ZWNJ=1 (attempts both polarities).

Auto-detect steganography in an AVI video. Runs LSB analysis on the first few frames, checks for appended data after the RIFF container, and analyzes frame size variance for anomalies.

Detect and analyze data appended after the AVI RIFF container EOF. Reports the offset, size, entropy, and hex dump of any trailing data that may contain hidden payloads.

Compare adjacent video frames for pixel-level anomalies. Computes byte-level diff, Mean Squared Error (MSE), and PSNR between two frames to detect steganographic modifications.

Extract LSB data from video frames as bytes. Collects the least significant bit from each byte of the specified frames and assembles them into a byte stream with hex dump and text preview.

LSB analysis of a specific video frame. Extracts the raw pixel data from the given frame index and checks LSB distribution, balance, and entropy.

Analyze frame types from the AVI idx1 index. Reports keyframe vs delta frame distribution, size statistics per type, and flag anomalies that may indicate steganographic manipulation.

Extract metadata from an AVI video file. Reports dimensions, FPS, codec, stream info, duration, and file-level properties.

Visualize the AVI/RIFF chunk structure as a tree. Shows all chunks, their FourCC codes, offsets, and sizes for forensic analysis of the container structure.