pyobfus — Python Obfuscator

by zhurong2020

313 downloads

Not rated

GitHub

About

Official MCP server for the pyobfus Python obfuscator — pre-flight risk scan, framework-aware config init, reverse stack-trace mapping

Details

Author: zhurong2020
Downloads: 313
Categories: Developer Tools, Security, Other

- AST-based obfuscation with no phone-home.
- 8 tools including protect_project, check_obfuscation_risks, and unmap_stack_trace.
- All tools return structured JSON with ai_hint and next_tool for deterministic chaining.
- Preflight risk scanning for eval/exec, dynamic attributes, and framework reflection.
- Auto‑generates pyobfus.yaml based on detected framework.
- Open‑source alternative to PyArmor with no API key required.

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

Download and install Highlight from highlightai.com/download
Navigate to the plugins tab and select "Add Custom Plugin"
Configure the plugin with the settings below

Plugin Name pyobfus — Python Obfuscator

Command (node, npx, python, etc.)

Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
Enable "Start Automatically" if you want the plugin to start when Highlight launches

Setting up with Cursor

Open Cursor's settings
Navigate to the MCP section
Click "Add new Global MCP server"
Copy and paste the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

Setting up with Claude Desktop

Open Claude Desktop's settings
Go to the Integrations tab
Click "Add MCP Server"
Use the configuration below based on your operating system

Note: Make sure Claude Desktop is running before attempting to connect.

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

Setting up with Windsurf

Open Windsurf's preferences
Go to the Integrations section
Click "Add MCP Integration"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

Setting up with Cline

Open Cline's settings
Navigate to the Integrations section
Click "Add MCP Server"
Copy and paste the configuration below based on your operating system

Note: Make sure to restart Cline after adding the configuration.

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

Setting up with Goose

Open Goose's preferences
Go to the Integrations tab
Select "MCP Servers"
Click "Add New Server"
Use the configuration below based on your operating system

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

JSON

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

From the repository

Install via uvx pyobfus-mcp or pip install pyobfus-mcp. No API key is required. Once installed, an AI agent can call any of the 8 built-in tools to obfuscate projects, scan risks, generate configs, or reverse obfuscated tracebacks.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "pyobfus \u2014 python obfuscator": {
            "pyobfus": {
                "command": "uvx",
                "args": [
                    "pyobfus-mcp"
                ]
            }
        }
    }
}

McpServers

{
    "pyobfus": {
        "command": "uvx",
        "args": [
            "pyobfus-mcp"
        ]
    }
}

pyobfus(pronounced as "Python obfuscator") is a modern, AST-basedpython-obfuscator / code-obfuscatorwith framework-aware presets, reverse stack-trace mapping for AI-assisted debugging, and a machine-readable JSON CLI designed forClaude Code,Cursor,GitHub Copilot,Codex,CodeBuddy, and any MCP-compatible AI agent. A transparent, open-source alternative to PyArmor.

A Python code obfuscator built with AST-based transformations.Supports Python 3.9 through 3.14. Provides reliable name mangling, string encoding, control-flow flattening, AES-256 string encryption, and — unique to pyobfus — a reverse-mapping workflow that lets you (or your AI coding assistant) debug obfuscated stack traces without giving up the protection.

🔒 Pro Edition available— 6 patent-targeted protection mechanisms (Selective Opacity, forensic watermarking, Runtime String Vault, and more) layered on top of the free AST obfuscator, $45 one-time, no subscription. See Pro Editionbelow.

🔧 What's new in v0.5.14—--provenance-manifestnow records per-input SHA-256 hashes, the containing git commit, and a CycloneDX-compatible component/relationship section;--verify-provenance-manifest FILE --jsonvalidates that manifest's shape, relationships, and local integrity digest;--validate-config FILE --jsongives IDE/MCP callers a stable machine-readable config-validation contract. v0.5.13 fixed--validate-configfalse-warning onpresetand every Pro field added since v0.5.0. Full details in the CHANGELOG; see Pro Editionbelow.

This repository shipstwo installable packages:

The MCP server lives in pyobfus_mcp/and is built on the official Model Context Protocol Python SDK(FastMCP). It registers eight MCP tools soClaude Desktop, Claude Code, Cursor, Windsurf, Zed, and Codexcan call pyobfus directly from agent conversations — no shelling out:

The server is registered in theofficialMCP Registryunderio.github.zhurong2020/pyobfus-mcp. The transport is stdio. See pyobfus_mcp/README.mdfor per-client configuration snippets.

This repo is also aClaude Code plugin marketplace. Thepyobfus-protectskill teaches an agent the full "protect Python before shipping — obfuscateandverify it still runs" workflow (MCP-first, CLI fallback):

/plugin marketplace add zhurong2020/pyobfus /plugin install pyobfus@pyobfus

See skills/for the skill and install details. (This is distinct from templates/ai-integration/, which are copy-in rule files foryourproject.)

pyobfus is also on the VS Code Marketplace(publisherzhurong2020) — thefirstobfuscation-focused extension in this category, since no competitor (PyArmor, Nuitka, Sourcedefender) has one. Inline obfuscation-risk diagnostics (pyobfus --checkfindings rendered via VS Code's nativeDiagnosticCollectionAPI — squiggles + Problems panel, no separate linter to configure), a "Reverse Stack Trace" command, a status bar item showing your current tier with a one-click menu (Check Workspace / Generate Config / Start Trial / Unlock Pro), a "Generate pyobfus.yaml" command, and right-click "Obfuscate with pyobfus" from the Explorer or editor. Source and design rationale in vscode-extension/and docs/VSCODE_EXTENSION_PLAN.md.

- pyobfus --check src/— pre-flight risk scan: detectseval/exec, dynamic attribute access, and framework reflection points before you obfuscate. JSON output with anai_hinttelling your AI assistant what to run next.
- pyobfus --init src/— zero-config onboarding: scans the project, detects FastAPI/Django/Pydantic/Click/SQLAlchemy, and writes a ready-to-usepyobfus.yaml.
- pyobfus --unmap --trace error.log --mapping mapping.json— reverse obfuscated identifiers in a production stack trace so you can debug (or hand the trace to an AI assistant) without reversing the obfuscation itself.
- pyobfus … --save-mapping mapping.json --trace-marker— stamp each obfuscated file with a# pyobfus:obfuscatedheader (id + mapping filename + the exact--unmapcommand) so an AI agent that lands in an obfuscated file from a traceback immediately knows it's pyobfus output and how to reverse the names.
- pyobfus … --provenance-manifest provenance.json— write a local JSON manifest (input/output hashes, config hash, pyobfus version, git commit when available, mapping digest, CycloneDX-compatible component relationships, and a self-consistency integrity digest — not a cryptographic signature) for offline build provenance. See docs/PROVENANCE_MANIFEST.md.
- pyobfus --verify-provenance-manifest provenance.json --json— validate the manifest structure, CycloneDX-compatible relationships, and local integrity digest before archiving or shipping it.
- Release provenance— pyobfus and pyobfus-mcp are published through PyPI Trusted Publishing with PEP 740 attestations; see docs/RELEASE_PROVENANCE_VERIFICATION.mdfor verification commands and the current snapshot.
- Framework-aware presets—--preset fastapi | django | flask | pydantic | click | sqlalchemy | mlwith built-in exclusions for dispatch methods, decorators, ORM fields, migrations, model-serving wrappers, and dependency-injection parameters.
- Compatibility cookbooks— pair pyobfus with real delivery pipelines: import-hook / encrypted-file (SOURCEdefender.pye), compiled packaging (Nuitka / Cython), and ML model-serving.pyobfus --checkalso emitscompatibility_advisoryfindings for these. See docs/IMPORT_HOOK_COOKBOOK.md,docs/COMPILED_PACKAGING_COOKBOOK.md, and[docs/MODEL_SERVING_COOKBOOK.md.
- Global--json— every CLI mode (obfuscate,--check,--unmap,--init) emits the same structured schema with anai_hintfield, ready for Claude Code, Cursor, Windsurf, and MCP servers to consume.

The following features arefully implemented and availablein the current version:

Cross-File Obfuscation: Consistent name obfuscation across multiple files

- Automatic import statement rewriting
- __all__list updates with obfuscated names
- Global symbol table with collision detection
- Two-phase obfuscation pipeline (Scan → Transform)
- Preview mode with--dry-runflag

Name Mangling: Rename variables, functions, classes, and class attributes to obfuscated names (I0, I1, I2...)

Comment Removal: Strip comments and docstrings

String Encoding: Base64 encoding for string literals with automatic decoder injection

Parameter Preservation: Preserve function parameter names for keyword argument compatibility (--preserve-param-names)

Multi-file Support: Obfuscate entire projects with preserved import relationships

File Filtering: Exclude files using glob patterns (test files, config files, etc.)

Configuration Files: YAML-based configuration for repeatable builds

…

No reviews yet — be the first

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.

About

Details

Jump to

Setting up with Highlight

From the repository

Claude Desktop / Cursor

McpServers

Install

More like this

Sequential Thinking

Sentry

Github

Filesystem

EverArt

Google Drive