CyberChef MCP Server: Install & Setup

Install CyberChef in Claude Code

Docker

Claude Code

claude mcp add cyberchef -- docker run -i --rm ghcr.io/doublegate/cyberchef-mcp_v4:4.2.0

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "cyberchef": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "ghcr.io/doublegate/cyberchef-mcp_v4:4.2.0"
      ]
    }
  }
}

npm

Claude Code

claude mcp add cyberchef -- npx -y cyberchef-mcp

mcp.json (Claude Desktop, Cursor, VS Code, Windsurf)

{
  "mcpServers": {
    "cyberchef": {
      "command": "npx",
      "args": [
        "-y",
        "cyberchef-mcp"
      ]
    }
  }
}

Frequently asked questions

What does the CyberChef MCP server do?

GCHQ CyberChef's encryption, encoding, compression and forensics operations, plus analysis tools such as hash identification, cipher solving and RSA attacks.

Is the CyberChef MCP server free?

Yes, most likely. Open source and no paid account or API key is mentioned in the listing. Check the provider for current pricing.

Does CyberChef run locally or remotely?

Local. Runs on your machine (stdio). You install it with npx, uvx, Docker or from source.

How do I add CyberChef to Claude Code?

Run: claude mcp add cyberchef -- docker run -i --rm ghcr.io/doublegate/cyberchef-mcp_v4:4.2.0

More security & identity MCP servers

View all

Roadrecon

atomicchonk/roadrecon_mcp_server

Analyze ROADrecon gather results from Azure tenant enumeration.

LocalFreePython

Appstore Connect

ryaker/appstore-connect-mcp

MCP server for Apple Store Connect API integration with OAuth authentication support

LocalAccount needed

Volatility

Gaffx/volatility-mcp

Memory forensics with Volatility 3, exposing plugins such as pslist and netscan through REST APIs.

LocalFree

Secrets-LE

11.7k

nolindnaidoo/secrets-le

Detect hardcoded secrets in source and config. Reports masked previews, never the values.

LocalFree

Security

fr0gger/MCP_Security

Query the ORKL API to fetch threat reports, analyze threat actors and retrieve intelligence sources.

LocalAccount neededTypeScript

Security Audit

qianniuspace/mcp-security-audit

Audit npm package dependencies for security vulnerabilities with real-time checks against the npm registry.

LocalAccount neededTypeScript