Skip to main content
Glama
doublegate

CyberChef MCP Server

by doublegate

cyberchef_hash_identify

Read-onlyIdempotent

Identify password hashes by structure and get hashcat mode plus John format for each match. Use before cracking to recognize bcrypt, sha512crypt, argon2, and other formats.

Instructions

Identify a password hash by its structure — bcrypt, sha512crypt, argon2, PHPass, Django, LDAP, MySQL, NetNTLM and others — and report the hashcat mode and John format name for each match. Falls back to length-based candidates for a bare digest. Use this before trying to crack something: CyberChef's Analyse hash operation reads hex length only and reports "Invalid hash" for bcrypt, sha512crypt and argon2.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
inputYesThe hash, one per call. Whitespace is trimmed.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. First observedv3.6.0

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile needs no repetition. The description adds genuine behavioral context beyond annotations: the length-based fallback for bare digests, multiple matches (one report 'for each match'), and why structure-based identification is required for non-hex hashes. No annotation contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: purpose plus outputs, fallback behavior, then routing guidance. The core purpose is front-loaded before the format list, and the when-to-use advice is saved for last. No filler or repetition of schema/annotation content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity tool (1 required parameter, no output schema, read-only/idempotent annotations), the description covers what the tool returns (hashcat mode, John format), edge-case behavior (bare digests), and when to invoke it. With no output schema present, the description adequately conveys the return shape. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% ('The hash, one per call. Whitespace is trimmed.'), so the baseline is 3. The description adds semantic meaning by specifying the input type (a password hash, not arbitrary data) and implying that bare hex digests are also accepted via the fallback, which helps an agent judge what to pass. This pushes it above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource — 'Identify a password hash by its structure' — and enumerates concrete output artifacts (hashcat mode, John format name) plus supported formats. It differentiates itself from siblings like cyberchef_hash_crack and cyberchef_timestamp_identify by scoping to structure-based identification rather than cracking or timestamp detection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it ('Use this before trying to crack something') and names the alternative it replaces (CyberChef's Analyse hash operation), explaining that the alternative misreads bcrypt, sha512crypt and argon2 as 'Invalid hash'. This is concrete routing guidance an agent can act on without inspecting siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/doublegate/CyberChef-MCP'

If you have feedback or need assistance with the MCP directory API, please join our Discord server