ByteScope

ByteScope MCP

Fully offline. One npx line gives a coding agent real hashes, file types, certificate and pcap decoding, test files and id lookups.

The local server runs on your machine and never touches the network. The hosted endpoint handles each request and keeps nothing.

Local server

Fully offline. Runs with npx on Node.js 20 or newer. No key, no account.

Claude Code
claude mcp add bytescope -- npx -y @bytescope/mcp
.mcp.json
{
  "mcpServers": {
    "bytescope": {
      "command": "npx",
      "args": [
        "-y",
        "@bytescope/mcp"
      ]
    }
  }
}

Hosted endpoint

Best effort, for a client that cannot run npx. One payload is capped at 4 MB; past that the call says to use the local server.

Claude Code
claude mcp add --transport http bytescope https://bytescope.dev/api/mcp
.mcp.json
{
  "mcpServers": {
    "bytescope": {
      "type": "http",
      "url": "https://bytescope.dev/api/mcp"
    }
  }
}

Tools

23 tools, read from the server's registry when this page was built. Descriptions are the English text an agent sees.

ToolWhat it does
detect_file_typeIdentify a file's real type from its leading bytes (magic numbers), with a confidence level, MIME type and usual extensions.
hash_bytesHash bytes with MD5, SHA-1, SHA-256, SHA-512 and/or CRC-32 (the zip/PNG/Ethernet CRC-32/ISO-HDLC).
crc_calculateCompute a CRC over bytes, either with a named model from the reveng catalogue (113 models, e.g. "CRC-32/ISO-HDLC", "CRC-16/MODBUS", "CRC-8/SMBUS"; aliases such as "CRC-32" or "MODBUS" work) or with custom Rocksoft parameters.
crc_reverseRecover the CRC model from known message/checksum pairs: first tries every model in the reveng catalogue, then brute-forces 8- and 16-bit polynomials within a time budget.
decode_certificateDecode X.509 certificates and CSRs: subject, issuer, SANs, validity window and status, signature algorithm, public key, key usage, fingerprints.
subnet_calcIPv4/IPv6 subnet calculator: CIDR → network, broadcast (IPv4 only), usable host range, netmask, wildcard, address count and address class/special-range classification.
parse_pcapParse a pcap or pcapng capture: file summary (format, link types, packet count, time span), a Wireshark-style packet list (protocol, source, destination, info), TCP/UDP stream summaries and protocol hierarchy / conversation statistics.
inspect_elfInspect an ELF binary (executable, shared object, object file, core): header (class, endianness, machine, type, entry point), program headers, section headers, symbol tables, dynamic section (NEEDED libraries, SONAME), notes (build id) and parse warnings.
parse_intel_hexMap a firmware image: Intel HEX, Motorola S-record or UF2 → contiguous address segments, gaps, start address, record errors (bad checksums, overlaps) and, for UF2, the family ids.
decode_hid_descriptorDecode a USB HID report descriptor: annotated item listing (like the HID Descriptor Tool), collections, and every input/output/feature report with bit offsets, sizes, usages and logical ranges.
parse_exifRead image metadata from a JPEG, PNG or raw TIFF/EXIF block: camera make/model, lens, exposure, ISO, focal length, orientation, capture time, ICC profile presence, plus the list of metadata carriers (EXIF, XMP, ICC, comments, text chunks, trailers) with byte offsets.
sqlite_schemaRead a SQLite database file's structure: every table with its CREATE statement, columns (declared type, primary-key position, NOT NULL, default, foreign-key target) and row count, plus indexes (unique, origin, columns), views, triggers, page size, page count, text encoding, user_version, journal mode and the SQLite version that last wrote the file.
convert_subtitleConvert subtitles between SRT, WebVTT and ASS/SSA.
generate_fixtureGenerate a real, standards-conformant test file for unit tests instead of hand-assembling bytes: images, archives (including encrypted, split or deliberately corrupted ZIPs), packet captures, self-signed certificates (valid, expiring in N days, expired or not yet valid), audio/video, SQLite, firmware images and PDFs.
lookup_usb_vendorLook up a USB vendor id (VID) in the linux-usb.org usb.ids database — the same data lsusb uses.
lookup_usb_productLook up a USB product by vendor id and product id (VID:PID) in the linux-usb.org usb.ids database.
lookup_ble_uuidLook up a Bluetooth LE GATT UUID in the Bluetooth SIG assigned-numbers tables (services, characteristics, descriptors) and a list of well-known vendor UUIDs.
lookup_hid_usageLook up a USB HID usage in the HID Usage Tables: usage page + usage id → names.
lookup_midi_ccLook up a MIDI 1.0 Control Change number (0-127) in the MMA controller assignment table, e.g. 7 → Channel Volume, 64 → Damper Pedal.
lookup_midi_manufacturerLook up a MIDI System Exclusive manufacturer id (the byte(s) after F0): one byte 01-7F (e.g. 41 → Roland, 43 → Yamaha) or an extended three-byte id 00 xx xx (e.g. 00 20 29 → Focusrite/Novation).
lookup_portLook up a TCP/UDP port number in ByteScope's port reference (the well-known service ports developers actually hit: 22, 443, 3306, 5432, 6379, 27017 …): service, transport, whether IANA assigned it, what it is for and its security exposure.
lookup_http_statusLook up an HTTP status code in ByteScope's status reference: name, class, defining standard, what it means and how it is confused with its neighbours.
lookup_file_signatureLook up which file formats' magic-number signatures match the given leading bytes, using ByteScope's format catalogue.

About this tool

ByteScope MCP is a fully offline MCP server. npx -y @bytescope/mcp starts it on your machine over stdio, and it never touches the network: no telemetry, no API call, no key, no account. It is the same code as the pages on this site, the core-* packages behind each tool, bundled into one file for coding agents.

An MCP server for file analysis

An agent is good at reasoning about bytes and bad at producing them from memory. This server hands it the real thing: a file type from magic bytes with a confidence, CRCs and a CRC model recovered from known pairs, X.509 certificates and CSRs, subnets, pcap and pcapng packets, ELF headers and symbols, Intel HEX and UF2 address maps, HID report descriptors, and EXIF with GPS masked unless asked for. generate_fixture builds valid PNG, ZIP, pcap, PDF, MP4 or X.509 test files with the same generators as the test file page.

A hash MCP server, and lookups that say found: false

hash_bytes returns MD5, SHA-1, SHA-256, SHA-512 and CRC-32 for the bytes it is given. The lookup_* tools answer from real tables: USB vendor and product ids, BLE UUIDs, HID usages, MIDI controllers and manufacturer ids, ports, HTTP status codes and file signatures. An id the table does not have gets found: false, never a plausible guess.

Bytes in, never paths

Binary input is a base64 or hex string. A tool never takes a file path, so an agent cannot hand over something on disk you did not mean to share, and the local and hosted servers accept the same schema. The local server takes up to 8 MB per call. The hosted endpoint at https://bytescope.dev/api/mcp is best effort, stores nothing, and caps a payload at 4 MB; past that it tells the agent to use the local server. The table on this page is read from the server's own registry when the page is built.

Frequently asked questions

Does ByteScope MCP send my files anywhere?

The local server does not. It runs under Node on your machine, speaks stdio, and has no network code path. The hosted endpoint is different by nature: the bytes you pass travel to a Cloudflare Worker, are processed in that request, and are not stored. Use the local server for anything you would not paste into a web form.

How do I add it to Claude Code or Cursor?

claude mcp add bytescope -- npx -y @bytescope/mcp adds it to Claude Code. A client that reads .mcp.json takes the snippet on this page as is, and Cursor takes the same mcpServers block in .cursor/mcp.json (or ~/.cursor/mcp.json for every project): command is npx and args is -y @bytescope/mcp. It needs Node.js 20 or newer.

Why does a tool not take a file path?

Handing an agent a local path opens a way to read files you never meant to share. Taking bytes only means the server processes exactly what was passed. The same schema also works on the hosted endpoint, where a path on your disk would mean nothing.

What happens past the 4 MB limit on the hosted endpoint?

The call fails with a message that says to use the local server, npx @bytescope/mcp, which takes up to 8 MB. Nothing is cut short silently.

Does it cost anything or need an API key?

No. There is no key, no account and no quota. The local server runs on your machine. The hosted one runs on Cloudflare Workers, with the platform's rate limiting in front of it to stop abuse.