Published 2026-11-05 00:00:00 +0000 UTC · Updated 2026-11-05

File Sniff MCP Server: Magic-Byte & AI Provenance Tools for Claude, Cursor & AI Agents

AI coding assistants and desktop agents frequently run into binary files they cannot reliably inspect in text context: an unknown download with the wrong extension, an Office .xlsx workbook with hidden sheets, or an image carrying embedded EXIF, XMP or C2PA AI Content Credentials.

File Sniff provides two Model Context Protocol (MCP) servers—a zero-install Remote Streamable HTTP endpoint and a local stdio server—built on the same zero-dependency ES modules that power File Sniff’s browser tools.

Option 1: Zero-Install Remote HTTP MCP (`https://www.filesniff.dev/mcp`)

The remote server uses the MCP Streamable HTTP transport (2025-03-26 and 2024-11-05) and requires no installation, API keys, or local dependencies.

To preserve File Sniff’s no-file-upload privacy guarantee, the remote endpoint enforces a strict 4 KiB request limit and 512-byte header cap: it inspects magic-byte headers and metadata markers only, never full files.

Claude Code CLI

claude mcp add --transport http filesniff https://www.filesniff.dev/mcp

Cursor / Windsurf / Streamable HTTP Clients (`mcp.json`)

{
  "mcpServers": {
    "filesniff": {
      "type": "http",
      "url": "https://www.filesniff.dev/mcp"
    }
  }
}

Remote Tools Exposed

Tool	What it does
`identify_magic_bytes`	Accepts up to 512 leading bytes (`hex` or `base64`) plus an optional `filename`, identifies the true format from magic bytes, flags extension mismatches (such as an `.mp4` named `.pdf` or a `winmail.dat` TNEF stream), and returns matching File Sniff tool URLs.
`lookup_file_format`	Looks up magic-byte signatures, container structures, MIME types, and File Sniff guides for any extension, format name, or hex prefix (`heic`, `winmail.dat`, `docx`, `webp`, `FF D8 FF`).
`explain_provenance_marker`	Explains IPTC `DigitalSourceType` declarations (`trainedAlgorithmicMedia`, `compositeWithTrainedAlgorithmicMedia`, `algorithmicallyEnhanced`, `digitalCapture`) and C2PA Content Credentials verification rules.

Option 2: Local `stdio` MCP (`@filesniff/mcp`) for Full On-Disk Files

When your agent needs to inspect an entire file on your disk or write a cleaned image without uploading bytes over the network, clone Peth-Dev/filesniff-mcp and run the local stdio server (server.mjs, Node.js 22+, zero npm dependencies).

Claude Desktop / Cursor (`mcpServers`)

{
  "mcpServers": {
    "filesniff-local": {
      "command": "node",
      "args": ["/absolute/path/to/filesniff-mcp/server.mjs"]
    }
  }
}

Local Tools Exposed

Tool	What it does
`sniff_file`	Reads up to the first 64 KiB and any ZIP central directory of a local file path to identify its real format, container subtype (`.docx`, `.xlsx`, `.pptx`), and extension match status.
`inspect_office_document`	Inspects local `.docx`, `.xlsx` and `.pptx` files for core/app/custom XML properties, explicit AI or automation clues (`ChatGPT`, `openpyxl`, `python-docx`), hidden worksheets, fonts, and theme colours.
`strip_image_metadata`	Losslessly strips EXIF, GPS, XMP, IPTC, thumbnails, comments, and trailers from a local JPEG, PNG or WebP file by copying allowlisted pixel chunks byte-for-byte.

When to Use Browser Tools vs. MCP

Prefer the browser tools when you want interactive visual inspection—such as the WebGL Byte X-Ray lens on the hex viewer, the pixel-diff loupe on the image converters, or full cryptographic signature validation in the C2PA Content Credentials checker.
Prefer the Remote HTTP MCP (https://www.filesniff.dev/mcp) when an AI assistant in the cloud or IDE needs to identify a magic-byte header or look up format and provenance specifications with zero setup.
Prefer the Local stdio MCP when a local coding agent needs to batch-check files, audit Office workbooks, or strip photo metadata directly on disk.

File Sniff MCP Server: Magic-Byte & AI Provenance Tools for Claude, Cursor & AI Agents

Option 1: Zero-Install Remote HTTP MCP (https://www.filesniff.dev/mcp)