MODEL CONTEXT PROTOCOL

Zefer as an MCP server

Every Zefer capability available to any AI agent — Claude, Cursor, Windsurf or your own — via the Model Context Protocol, 100% local.

What is it?

zefer-cli ships an MCP server over stdio: your agents can encrypt, decrypt, generate scored keys, analyze passwords and inspect .zefer files without any data leaving your machine. No extra dependencies — it works with the npm install and the standalone binaries.

Setup in 2 steps

01Install the CLI

npm install -g zefer-cli

02Add the server to your MCP client (Claude Code, Claude Desktop, Cursor, Windsurf, VS Code…)

Option A — global install

{
  "mcpServers": {
    "zefer": { "command": "zefer", "args": ["mcp"] }
  }
}

Option B — via npx, nothing to install

{
  "mcpServers": {
    "zefer": { "command": "npx", "args": ["-y", "zefer-cli", "mcp"] }
  }
}

Per-tool integration

Copy-ready configurations for the most popular tools. They all share the same principle: launch “zefer mcp” as a stdio server.

Create .mcp.json at the project root, or run: claude mcp add zefer -- zefer mcp

Option A — global install

{
  "mcpServers": {
    "zefer": { "command": "zefer", "args": ["mcp"] }
  }
}

Option B — via npx, nothing to install

{
  "mcpServers": {
    "zefer": { "command": "npx", "args": ["-y", "zefer-cli", "mcp"] }
  }
}

Or from the terminal:

# global install
claude mcp add zefer -- zefer mcp

# via npx (no install)
claude mcp add zefer -- npx -y zefer-cli mcp

Smart detection

  • zefer mcp — starts the server explicitly
  • Launched with no arguments and piped stdin (how MCP clients spawn servers) — automatic MCP mode
  • A human terminal (TTY) always gets the regular CLI

Exposed tools

zefer_encrypt

Encrypts text or files into .zefer with every option: dual key, reveal key, expiration, secret question, compression, IPs

Key parameters

passphrasetext | inputPathoutputPathsecondPassphraserevealKeyttlMinutescompressionquestionmaxAttemptsallowedIps

Returns: .zefer file path, size, format (ZEFB3/ZEFR3) and expiration date

zefer_encrypt({ text: "api_key=abc", passphrase: "…", ttlMinutes: 1440 })

zefer_decrypt

Decrypts .zefer files — text inline, files to disk

Key parameters

inputPathpassphrasesecondPassphrasequestionAnsweroutputPathoverwrite

Returns: the decrypted text inline, or the path of the file written to disk with its original name and size

zefer_decrypt({ inputPath: "secret.zefer", passphrase: "…" })

zefer_keygen

Generates scored keys — 7 modes + advanced options, sorted strongest first

Key parameters

modelengthcountexcludeAmbiguousexcludeCharsrequireAllClassesnoRepeatsgroupSize

Returns: list of keys sorted strongest first, each with score, label and effective bits

zefer_keygen({ mode: "base58", length: 24, count: 3, groupSize: 6 })

zefer_analyze_password

Full strength report: entropy, 4 attack scenarios, NIST/OWASP/AES-128/post-quantum compliance

Key parameters

password

Returns: full report: score, estimated alphabet, entropies, keyspace, post-quantum bits, per-scenario times, compliance, weaknesses and the vs-average-human comparison

zefer_analyze_password({ password: "Tr0ub4dor&3" })

zefer_inspect

Deep .zefer analysis without the passphrase: structure, entropy, SHA-256, KDF resistance, observations

Key parameters

inputPath

Returns: public header, structural integrity, chunks, ciphertext entropy, salt/IV, SHA-256, KDF resistance table and severity-tagged observations

zefer_inspect({ inputPath: "secret.zefer" })

Example: what your agent sends

A JSON-RPC tool call over stdio. The response includes the encrypted file path, size and format:

{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {
  "name": "zefer_encrypt",
  "arguments": {
    "text": "api_key=abc123",
    "passphrase": "my-strong-pass",
    "outputPath": "secret.zefer",
    "ttlMinutes": 1440,
    "compression": "gzip"
  }
}}

Everything runs locally: no network, no telemetry. Passphrases never leave your machine nor touch any server.

View zefer-cli on GitHub MCP specification