[Feature] Data transform / decode workbench for analyst investigations (CyberChef)

[seth-goodwin]

Problem

During alert triage and investigation, analysts frequently need to decode or transform suspicious strings — base64, hex, compressed blobs, defanged URLs, nested encodings, and similar. Today this usually means copying data to an external tool (often CyberChef) and copying results back into chat or Kibana.

We want this workflow available inside the Security MCP App, without sending customer data to third-party sites.

Goal

Analysts and agents working in Cursor, Claude Desktop, or other MCP hosts should be able to transform investigation data inline as part of the existing Security MCP workflow.

This likely needs two complementary paths, but the exact shape is up to the implementer:

• Agent path — the agent can decode/transform common formats programmatically during triage (e.g. from alert fields, process command lines, network payloads).
• Analyst path — a richer interactive UI for building and tweaking transform pipelines when the agent's output isn't enough.

Both paths should keep data local/self-hosted.

Context

• Other MCP App views (alert triage, threat hunt, correlation) already follow the tool + optional inline UI pattern in this repo.
• Agent skills for other workflows already live under skills/ in this repo.
• Elastic has prior internal interest in self-hosted CyberChef-style tooling (elastic/data-chef, protections-cloud#6898). Worth checking whether anything there can be reused before building from scratch.

Acceptance criteria

• Agent can transform representative SOC inputs (at minimum: base64, hex, URL encoding, gzip/zlib) and return readable output in chat.
• Analyst can open an interactive transform UI from the MCP App with input prefilled from context (alert field, pasted blob, etc.).
• No dependency on public third-party transform sites for core functionality.
• Documented in repo (setup, supported transforms, any limitations).
• Agent skill added under skills/ if appropriate, consistent with existing skills in this repo.

Out of scope (for now)

• Full parity with every CyberChef operation.
• Kibana plugin / standalone hosted portal (unless someone strongly prefers that and can justify it).
• Automatic write-back to Elasticsearch or Cases (manual copy is fine for v1).

Open questions

• Build vs embed vs wrap existing tooling (CyberChef, data-chef, custom op library)?
• Which transforms matter most for v1?
• How should results get back to the agent from the interactive UI, if at all?
• Any ops that call external services (HTTP request, DNS-over-HTTPS, etc.) should probably be disabled or gated — confirm with prodsec if shipping to customers.

Related

• Parent initiative (optional link): security-team#17827
• Prior art: protections-cloud#6898