Little Eye as an MCP server

Decoding never touches the network

The core promise is unchanged and still true by construction: decode and list_detectors only run Little Eye’s offline detectors — JWTs, JSON, base64, URLs, hex colors, IPs and the rest — and cannot make a network request. The network tools below are a separate, explicit surface: each one is its own tool an agent must call by name, each requires a Little Eye license, and none of them ever fires as a side effect of decoding. Ping and traceroute stay app-only. The CLI has no telemetry, no phone-home, and no account.

Install

Open Little Eye’s Settings → MCP Server tab — it resolves the exact path for your install and gives you copy buttons for the steps below. The instructions here are the detail behind those buttons, and are kept up to date independently of app releases if a client changes how it wants servers registered.

Claude Code

One command, no files to edit:

claude mcp add little-eye --scope user -- "/Applications/Little Eye.app/Contents/Helpers/little-eye" mcpCopy

--scope user makes it available in every project. Run claude mcp list afterward to confirm it registered.

Gemini CLI

One command, no files to edit:

gemini mcp add -s user little-eye "/Applications/Little Eye.app/Contents/Helpers/little-eye" mcpCopy

-s user is Gemini CLI’s scope flag — without it, servers register per-project instead of everywhere. Run /mcp list inside Gemini CLI afterward to confirm.

Codex CLI

One command, no files to edit:

codex mcp add little-eye -- "/Applications/Little Eye.app/Contents/Helpers/little-eye" mcpCopy

Run /mcp inside the Codex CLI TUI afterward to confirm it connected.

Cursor

Add the block below to ~/.cursor/mcp.json (available in every project) or .cursor/mcp.json in a specific project’s root (project config wins if both exist). You can also paste it into Settings → Features → MCP → Add new MCP server.

{
  "mcpServers": {
    "little-eye": {
      "command": "/Applications/Little Eye.app/Contents/Helpers/little-eye",
      "args": ["mcp"]
    }
  }
}Copy

Claude Desktop

Desktop’s local-server setup has changed across versions, so treat this as a starting point rather than a guarantee. The traditional method: open Settings → Developer → Edit Config (or find claude_desktop_config.json directly — on macOS that’s in ~/Library/Application Support/Claude/), and add the same mcpServers block shown above under Cursor. Fully quit and reopen Claude Desktop afterward. If your config file doesn’t look like that, or the option isn’t where this describes, check Claude Desktop’s own Settings for a Connectors or MCP section, or the Model Context Protocol project’s current documentation.

Other MCP clients

Most local MCP clients take the same shape — a command and args under an mcpServers key, as shown above under Cursor. Check your client’s documentation for exactly where that block goes.

Access log

The MCP server keeps a log of what agents asked it to do, on your Mac only, at ~/Library/Logs/Little Eye/. Each entry records which tool was called, which client called it, how many bytes came in, and which detectors recognised something — kept for 30 days.

It never records the text you decoded, any part of it, or a hash of it. Two things it does reveal, by necessity: the length of what was decoded, and the kind of thing it was. Nothing is uploaded. Run little-eye mcp --no-log to turn it off, or set LITTLE_EYE_MCP_LOG=0 in the server's environment if your MCP client makes that easier to configure than the flag.

Tools

Two decoding tools work without a license:

• decode(text) — runs the full detector pipeline against a string and returns every detector that fired, each with its structured fields.
• list_detectors() — returns the full detector taxonomy, so an agent can decide up front whether calling decode is worth it.

Eight network tools require a Little Eye license (entered once in the app’s License settings — the command-line tool picks it up automatically):

• dns_lookup(hostname) — A, AAAA, MX, NS, CNAME and TXT records with TTLs.
• reverse_dns(ip) — PTR lookup, forward chase, and a verified/mismatch verdict.
• whois(domain) — registration data via RDAP, with the port-43 WHOIS fallback for ccTLDs.
• fetch_url(url) — fetch plus Little Eye’s response audit: security headers, cookies, body-vs-Content-Type, TLS version.
• tls_check(url) — certificate, chain, negotiated version and a trust verdict.
• dns_compare(hostname) — the same lookup across several resolvers, with per-record agreement.
• email_auth_check(message) — DKIM re-verification and DMARC policy for a raw email.
• isbn_lookup(isbn) — book metadata from Open Library.

A real, trimmed response from little-eye --json on a JWT:

{
  "results": [
    {
      "confidence": "certain",
      "fields": [
        { "key": "algorithm", "label": "algorithm", "value": "HS256" },
        { "key": "tokenType", "label": "tokenType", "value": "JWT" },
        { "key": "subject", "label": "subject", "value": "1" }
      ],
      "payload": null,
      "rawValue": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIn0.sig",
      "type": "jwt"
    }
  ],
  "schemaVersion": 1
}Copy

It’s also just a CLI

No agent required — little-eye works from any shell:

pbpaste | little-eye
little-eye --json 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIn0.sig'Copy