Release Date: 2026-02-05
Upstream Base: CyberChef v10.20.0
This release delivers MCP streaming with progress notifications, a Piscina-based worker thread pool for CPU-intensive operations, comprehensive security dependency updates, and expanded test coverage reaching 689 tests.
executeWithStreamingProgress() consumes async generators and sends notifications/progress via the MCP SDK’s progress token mechanism- Streaming wired into the CallTool handler - extracts
progressToken from request._meta
- Falls back to direct execution when no progress token or streaming is disabled
- Progress notifications are best-effort (failures don’t break execution)
- Added
piscina dependency for worker thread management
- New
src/node/worker.mjs script that executes bake() with timeout in worker threads
- New
src/node/worker-pool.mjs manager with CPU_INTENSIVE_OPERATIONS set
- Configurable via
CYBERCHEF_WORKER_MIN_THREADS, MAX_THREADS, IDLE_TIMEOUT env vars
- Worker routing in CallTool handler before streaming execution
- New
cyberchef_worker_stats tool for monitoring pool utilization
- Enable with
CYBERCHEF_ENABLE_WORKERS=true environment variable
- New
src/node/transports.mjs transport factory
- Supports stdio (default) or Streamable HTTP via
CYBERCHEF_TRANSPORT=http
- HTTP transport configurable via
CYBERCHEF_HTTP_PORT (default: 3000) and CYBERCHEF_HTTP_HOST (default: 127.0.0.1)
- Merged 10 modified operations from CyberChef v10.20.0
- Includes Argon2, DeriveEVPKey (SHA-256 default, min 10000 iterations), Filter, FindReplace, JSONBeautify, PHPDeserialize, RAKE, Register, RegularExpression, Subsection
@modelcontextprotocol/sdk ^1.22.0 -> ^1.26.0lodash ^4.17.21 -> ^4.17.23diff ^5.2.0 -> ^5.2.2- Added
qs >=6.14.1 override
- Trivy container scan now fails CI on vulnerabilities (
exit-code: '1')
- Replaced
grunt-chmod dependency with native fs.chmod task
- Removed
shelljs override (no longer needed)
- elliptic (#46): No fix available from upstream. Deep transitive dependency - documented for tracking.
- Removed commented-out
BufferPool class from mcp-server.mjs
- Removed commented-out
CPU_INTENSIVE_OPERATIONS set (moved to worker-pool.mjs)
- 689 tests (up from 563), all passing
- Coverage: 75.64% lines, 71.98% branches, 91.5% functions
- New test files: handler-dispatch, config-variations, worker-pool, transports
- Expanded streaming tests for
executeWithStreamingProgress()
- Raised coverage thresholds: 75% lines/stmts, 90% functions, 70% branches
| Variable |
Default |
Description |
CYBERCHEF_TRANSPORT |
stdio |
Transport type: stdio or http |
CYBERCHEF_HTTP_PORT |
3000 |
HTTP transport port |
CYBERCHEF_HTTP_HOST |
127.0.0.1 |
HTTP transport host |
CYBERCHEF_WORKER_MIN_THREADS |
1 |
Minimum worker threads |
CYBERCHEF_WORKER_MAX_THREADS |
4 |
Maximum worker threads |
CYBERCHEF_WORKER_IDLE_TIMEOUT |
30000 |
Worker idle timeout (ms) |
CYBERCHEF_WORKER_MIN_INPUT_SIZE |
1024 |
Min input size for worker routing |
| File |
Purpose |
src/node/transports.mjs |
Transport factory (stdio/HTTP) |
src/node/worker.mjs |
Worker thread script for Piscina |
src/node/worker-pool.mjs |
Worker pool manager |
tests/mcp/handler-dispatch.test.mjs |
Handler dispatch tests |
tests/mcp/config-variations.test.mjs |
Env var configuration tests |
tests/mcp/worker-pool.test.mjs |
Worker pool tests |
tests/mcp/transports.test.mjs |
Transport factory tests |
| GitHub Item |
Type |
Resolution |
| #13 |
Issue |
MCP streaming with progress notifications |
| #14 |
Issue |
689 tests, raised coverage thresholds |
| #15 |
Issue |
Piscina worker thread pool |
| #16 |
Issue |
Trivy exit-code set to ‘1’ |
| #19 |
Issue |
grunt-chmod replaced with native fs.chmod |
| #20 |
Issue |
Dead BufferPool code removed |
| #26 |
Issue |
Upstream v10.20.0 merged |
| #24 |
PR |
Merged (qs bump) |
| #25 |
PR |
Superseded (changes incorporated) |
| #43 |
Alert |
qs override added |
| #45 |
Alert |
SDK upgraded |
| #46 |
Alert |
No fix available (documented) |
| #50 |
Alert |
diff upgraded |
| #51 |
Alert |
lodash upgraded |
| #52 |
Alert |
SDK upgraded |