ghostkit-mcp

[](https://modelcontextprotocol.io) [](https://ghostkit.net/mcp) [](https://ghostkit.net/terms)

MCP server that gives Claude, Cursor, Windsurf, and any MCP-compatible AI client access to 26 security and developer tools. Ask your AI to decode a JWT, analyze HTTP security headers, hash a payload, or inspect a phishing URL, and it picks the right tool automatically.

Free during early access. Sign in and get your API key

Ask your AI things like:

• "Decode this JWT and tell me if it's expired"
• "Check this HTTP response for missing security headers"
• "Analyze the CSP policy and grade it"
• "Is this URL a phishing attempt? Check for homoglyphs"
• "Generate an Ed25519 keypair"
• "Decode this Ethereum calldata"
• "Hash this string with SHA-256 and MD5"
• "Inspect these email headers for SPF/DKIM issues"

The MCP server routes each request to the right tool. No manual tool selection needed.

• Encoder/Decoder - Base64, Hex, URL, HTML entities, Unicode, Octal with auto-detection
• JWT Decoder - Parse headers, claims, expiry, and flag security warnings (alg:none, missing iss)
• JS Deobfuscator - Decode hex/unicode strings, unpack arrays, unwrap eval(), beautify output
• SAML Decoder - Decode base64 SAML responses, extract assertions, attributes, and conditions

• URL Analyzer - Break down URLs, detect phishing indicators, homoglyphs, suspicious TLDs, defang for sharing
• Email Header Analyzer - Trace message routes, check SPF/DKIM/DMARC, detect spoofing
• CSP Analyzer - Parse Content-Security-Policy, detect unsafe-inline/eval, grade A-F
• CORS Checker - Detect wildcard origins, credenti