zsteg-rs

A Rust port of zsteg — detect steganography in PNG & BMP images.

Built-in MCP (Model Context Protocol) server, allowing AI assistants (Claude, GPT, etc.) to directly analyze images for hidden data.

Features

• LSB/MSB steganography detection in PNG and BMP images
• Multiple bit depths (1-8 bits per channel)
• Multiple iteration orders (xy, yx, XY, YX, etc.)
• Channel combinations (r, g, b, a, rgb, bgr, rgba, etc.)
• WBStego detection (2.x/3.x/4.x)
• Zlib stream detection in extracted data
• SteganographyPNG format detection
• OpenStego format detection
• Camouflage detection (data appended after image)
• Scanline extra data detection
• PNG metadata inspection
• Image block size analysis
• File type detection via magic bytes
• Data extraction mode
• MCP server — expose all capabilities as tools for AI assistants

Installation

cargo install --path .

Or build from source:

cargo build --release

CLI Usage

Basic analysis

zsteg image.png

Try all methods

zsteg -a image.png

Extract specific payload

zsteg -E "1b,rgb,lsb" image.png > output.bin

Shortcut parameter syntax

zsteg image.png 2b,b,lsb,xy
# equivalent to: --bits 2 --channels b --lsb --order xy

CLI Options

-a, --all                Try all known methods
-E, --extract <NAME>     Extract payload (e.g. '1b,rgb,lsb')
-o, --order <ORDER>      Pixel iteration order (default: auto)
-c, --channels <CH>      Channels: r,g,b,a,rgb,bgr,rgba,...
-b, --bits <N>           Number of bits: 1-8, range '1-8', or mask '0x01'
    --lsb                Least significant bit first
    --msb                Most significant bit first
-P, --prime              Only prime bytes/pixels
    --shift <N>          Prepend N zero bits
    --invert             Invert bits (XOR 0xff)
    --pixel-align        Pixel-align hidden data
-l, --limit <N>          Limit bytes checked (default: 256, 0=no limit)
    --no-file            Disable file type detection
    --no-strings         Disable ASCII string finding
-s, --strings <MODE>     String mode: first, all, longest, none
-n, --min-str-len <N>    Min string length (default: 8)
-v, --verbose            Increase verbosity
-q, --quiet              Decrease verbosity
    --mcp                Start as MCP server (stdio transport)

CLI Examples

# Analyze a PNG file
$ zsteg image.png
image               .. SteganographyPNG(bitloss=1, secret_size=13, ...)
b1,rgb,lsb,xy       .. text: "Hello, world!"

# Extract hidden text
$ zsteg -E "1b,rgb,lsb,xy" image.png
Hello, world!

# Analyze a BMP with wbStego
$ zsteg wbsteg_mix.bmp
wbStego(size=23, data="ttSxpuSeer", mix=true)

---

MCP Server

zsteg includes a built-in Model Context Protocol server, allowing AI assistants to analyze images for steganographic content via structured tool calls.

Start the MCP server

zsteg --mcp

This starts a JSON-RPC 2.0 server over stdio (newline-delimited). The server advertises 4 tools:

| Tool | Description | |------|-------------| | analyze | Scan an image for all hidden steganographic data (messages, file signatures, WBStego, OpenStego, Camouflage, etc.) | | extract | Extract hidden data from a specific channel/bit/order combination | | image_info | Get image structure info: dimensions, chunks, metadata, extra data | | list_channels | List all channel/bit combinations that will be scanned |

MCP Configuration

Copy the JSON below into your MCP client configuration to register zsteg as a tool server.

Note: Replace /path/to/zsteg with the actual absolute path to the zsteg executable on your system.

Claude Desktop / Cline / VS Code

Add to your MCP settings JSON (e.g. claude_desktop_config.json, cline_mcp_settings.json, or VS Code settings.json):

{
  "mcpServers": {
    "zsteg": {
      "command": "/path/to/zsteg",
      "args": ["--mcp"],
      "transportType": "stdio"
    }
  }
}

Windows example:

{
  "mcpServers": {
    "zsteg": {
      "command": "C:\\Users\\you\\.cargo\\bin\\zsteg.exe",
      "args": ["--mcp"],
      "transportType": "stdio"
    }
  }
}

macOS / Linux example:

{
  "mcpServers": {
    "zsteg": {
      "command": "/usr/local/bin/zsteg",
      "args": ["--mcp"],
      "transportType": "stdio"
    }
  }
}

MCP Tool Details

analyze

Perform a full steganographic scan on an image.

Parameters: | Name | Type | Required | Description | |------|------|----------|-------------| | file_path | string | ✅ | Absolute path to the image file (PNG or BMP) | | verbose | integer | | Verbosity: 0=important only, 1=all (default), 2=hexdumps | | order | string | | Scan order: "auto" (default), "all", "xy", "yx", "xY", etc. | | bits | string | | Bits to check: "1,2,3,4" (default) or "1,2" |

extract

Extract data from a specific steganographic channel.

Parameters: | Name | Type | Required | Description | |------|------|----------|-------------| | file_path | string | ✅ | Absolute path to the image file | | bits | integer | | Bits per channel (1-8, default: 1) | | channels | string | | Color channels: "r", "g", "rgb", "bgr", etc. | | bit_order | string | | "lsb" (default) or "msb" | | order | string | | Scan order: "xy" (default), "yx", "xY", "bY", etc. | | limit | integer | | Max bytes to extract (default: 1024) | | format | string | | Output format: "text" (default), "hex", "raw" |

image_info

Get structural details about an image file.

Parameters: | Name | Type | Required | Description | |------|------|----------|-------------| | file_path | string | ✅ | Absolute path to the image file |

list_channels

List all channel/bit/order combinations that will be scanned.

Parameters: | Name | Type | Required | Description | |------|------|----------|-------------| | file_path | string | ✅ | Absolute path to the image file |

Example MCP Interaction

User: "Analyze this image for hidden messages: C:\images\secret.png"

AI (via MCP) → calls analyze(file_path="C:\images\secret.png")

Response:
  Found 2 result(s):
  1. [SteganographyPNG] bitloss=1, secret_size=13, type="text/plain.txt"
  2. [PartialText] offset=0: "Hello, world!"

AI (via MCP) → calls extract(file_path="C:\images\secret.png", channels="rgb", bits=1, order="xy", limit=256)

Response:
  Extracted 13 bytes:
  Hello, world!

---

Differences from Ruby version

• Uses Rust's png crate instead of zpng gem
• File type detection via magic bytes instead of the file command
• Prime number generation uses a simple sieve instead of Ruby's Prime library
• Built-in MCP server for AI tool integration
• No zsteg-mask or zsteg-reflow subcommands (yet)

License

MIT