# ByteScope MCP

> ByteScope MCP is a fully offline MCP server for file analysis: hash bytes, detect file types, decode pcap, ELF and X.509, and make test files. One npx line.

- URL: https://bytescope.dev/en/mcp/
- Locale: en · Also: [ja](https://bytescope.dev/ja/mcp.md) · [zh-Hant](https://bytescope.dev/zh-Hant/mcp.md)
- Runs: The local server runs on your machine and never touches the network. The hosted endpoint handles each request and keeps nothing.
- Requires: The page reads in any modern browser. The server is not a browser tool: the local one runs with npx on Node.js 20 or newer, fully offline, and the hosted one is an HTTP endpoint any MCP client can add.
- Updated: 2026-09-08

## What it does

ByteScope MCP is a fully offline MCP server. `npx -y @bytescope/mcp` starts it on your machine over stdio, and it never touches the network: no telemetry, no API call, no key, no account. It is the same code as the pages on this site, the `core-*` packages behind each tool, bundled into one file for coding agents.

### An MCP server for file analysis

An agent is good at reasoning about bytes and bad at producing them from memory. This server hands it the real thing: a file type from magic bytes with a confidence, CRCs and a CRC model recovered from known pairs, X.509 certificates and CSRs, subnets, pcap and pcapng packets, ELF headers and symbols, Intel HEX and UF2 address maps, HID report descriptors, and EXIF with GPS masked unless asked for. `generate_fixture` builds valid PNG, ZIP, pcap, PDF, MP4 or X.509 test files with the same generators as the test file page.

### A hash MCP server, and lookups that say `found: false`

`hash_bytes` returns MD5, SHA-1, SHA-256, SHA-512 and CRC-32 for the bytes it is given. The `lookup_*` tools answer from real tables: USB vendor and product ids, BLE UUIDs, HID usages, MIDI controllers and manufacturer ids, ports, HTTP status codes and file signatures. An id the table does not have gets `found: false`, never a plausible guess.

### Bytes in, never paths

Binary input is a base64 or hex string. A tool never takes a file path, so an agent cannot hand over something on disk you did not mean to share, and the local and hosted servers accept the same schema. The local server takes up to 8 MB per call. The hosted endpoint at `https://bytescope.dev/api/mcp` is best effort, stores nothing, and caps a payload at 4 MB; past that it tells the agent to use the local server. The table on this page is read from the server's own registry when the page is built.

## Limits

Does not read file paths, does not call any LLM or network API from the local server, and does not store requests. The hosted endpoint is best effort and caps a payload at 4 MB.

## FAQ

### Does ByteScope MCP send my files anywhere?

The local server does not. It runs under Node on your machine, speaks stdio, and has no network code path. The hosted endpoint is different by nature: the bytes you pass travel to a Cloudflare Worker, are processed in that request, and are not stored. Use the local server for anything you would not paste into a web form.

### How do I add it to Claude Code or Cursor?

`claude mcp add bytescope -- npx -y @bytescope/mcp` adds it to Claude Code. A client that reads `.mcp.json` takes the snippet on this page as is, and Cursor takes the same `mcpServers` block in `.cursor/mcp.json` (or `~/.cursor/mcp.json` for every project): `command` is `npx` and `args` is `-y @bytescope/mcp`. It needs Node.js 20 or newer.

### Why does a tool not take a file path?

Handing an agent a local path opens a way to read files you never meant to share. Taking bytes only means the server processes exactly what was passed. The same schema also works on the hosted endpoint, where a path on your disk would mean nothing.

### What happens past the 4 MB limit on the hosted endpoint?

The call fails with a message that says to use the local server, `npx @bytescope/mcp`, which takes up to 8 MB. Nothing is cut short silently.

### Does it cost anything or need an API key?

No. There is no key, no account and no quota. The local server runs on your machine. The hosted one runs on Cloudflare Workers, with the platform's rate limiting in front of it to stop abuse.

## Related tools

- [Test File Generator](https://bytescope.dev/en/test-files.md) — The generate_fixture generators as a download page: PNG, PDF, MP4, ZIP, pcap, X.509 and more.
- [File Type Identifier](https://bytescope.dev/en/file-type.md) — Identify a file from its magic bytes in the browser, the page behind detect_file_type.
- [File Hash Calculator](https://bytescope.dev/en/file-hash.md) — MD5, SHA-1 and SHA-256 of a local file in the browser, the page behind hash_bytes.