ncrypted

io.github.Seidl-FamilyPublished by GitHub account Seidl-Familyv0.2.2Updated Oct 24, 2026

One-time, end-to-end encrypted secrets for agents. 0.005 USDC per secret via x402.

VerifiedStreamable HTTPWeb executableCommunication & CollaborationSecurity & Monitoring

Overview

AI-generated overview

Creates one-time, end-to-end encrypted secret links for passwords, API keys or notes, and lets an assistant read, check or burn them.

What you can do
Create one-time secret links from a password, API key or sensitive note, with a TTL and optional email delivery or passphrase. Read a secret link once, which permanently destroys it. Check whether a secret you created is still pending, read, burned or expired, without consuming it. Permanently burn an unread secret you created so its link stops working.
When to use it
Useful when an assistant must hand a credential or sensitive note to a person or another agent without pasting it into chat, or when it needs to receive a secret and place it into a config file or environment variable. Also handy for confirming delivery or revoking a link sent to the wrong place.
Requirements
Runs as a remote endpoint or as a local npm package (npx) over stdio. Creating secrets beyond the free daily allowance needs a dedicated Base wallet holding USDC, supplied as the NCRYPTED_WALLET_PRIVATE_KEY environment variable or a default key file; the MCP client must support x402 payments. Network access to the ncrypted API, Base and, for email, Resend.
Before you install
Creating more than three secrets per day costs 0.005 USDC each, paid from the wallet whose private key is configured; use a dedicated low-balance wallet. Reading a link destroys the secret permanently, and burning is irreversible. Emailing a link sends the recipient address and the link, which contains the decryption key, through the service and Resend. The hosted endpoint encrypts server-side rather than locally.

Installation

In SourceWeft

  1. Open ncrypted in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/io.github.Seidl-Family%2Fncrypted/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "ncrypted": {
      "type": "http",
      "url": "https://ncrypted.ai/mcp"
    }
  }
}

README

ncrypted

One-time, end-to-end encrypted secrets for AI agents.

An agent encrypts a password, API key or note locally and gets a link that opens exactly once. Share it with a person, email it, or hand it to another agent; reading destroys it. Agents can also request a secret from a user and write it straight into a Vercel env var or .env file without the model ever seeing the value.

The first 3 secrets per day are free; after that each costs 0.005 USDC over x402 on Base. Reads, requests and deliveries are free.

Works with Claude Code, Codex, Cursor, Gemini CLI, any MCP client, the Vercel AI SDK, LangChain and CrewAI (Coinbase AgentKit support is in review). Guides: https://ncrypted.ai/guides

https://ncrypted.ai/s/{id}#{key}                                    └─ decryption key, never sent to the server

Install

You need a dedicated, low-balance Base wallet with some USDC (no ETH needed). Export its key as NCRYPTED_WALLET_PRIVATE_KEY.

Claude Code

/plugin marketplace add Seidl-Family/ncrypted/plugin install ncrypted@ncrypted

Any MCP client (Claude Desktop, Cursor, Codex, …)

json
{ "mcpServers": { "ncrypted": { "command": "npx", "args": ["-y", "@seidl-family/ncrypted-mcp"], "env": { "NCRYPTED_WALLET_PRIVATE_KEY": "0x..." } } } }

Agent Skill: npx skills add Seidl-Family/ncrypted

CLI / SDK

sh
echo "hunter2" | npx ncrypted create --ttl 1h [--email [email protected]] [--passphrase X]npx ncrypted read "https://ncrypted.ai/s/abc#key"
ts
import { Ncrypted } from "ncrypted";const nc = new Ncrypted(); // reads NCRYPTED_WALLET_PRIVATE_KEYconst { link, receiptToken, id } = await nc.create("hunter2", { ttl: 3600 });const value = await nc.read(link); // free, destroys it

How it works

  • Zero-knowledge: AES-256-GCM with a random 256-bit key, derived via HKDF (plus PBKDF2 if you set a passphrase). The server stores ciphertext only.
  • Exactly once: reads use Redis GETDEL, so concurrent readers can't both get it. Unread secrets expire after their TTL (5 min to 7 days).
  • Preview-safe: opening the web page doesn't consume the secret; the recipient has to click Reveal.
  • Pay per secret: x402 exact scheme, USDC on Base, settled only after the secret is stored. The SDK refuses to pay more than $0.01 per request.
  • Email: the creator can email the link once. It passes through the server for that request and isn't stored. Use a passphrase for very sensitive values.

Payments and safety

ncrypted charges a fixed 0.005 USDC per secret created, paid over x402 on Base. Everything else is free: reading, status checks, revoking.

  • Narrow scope: the only payment the plugin can make is ncrypted's own fee for ncrypted_create. It has no tool to send arbitrary amounts, trade, swap, or pay anyone else.
  • Hard cap: the SDK refuses to pay more than 0.01 USDC for a single request, whatever the server asks.
  • Dedicated wallet: payments come from a low-balance wallet the user creates on purpose (npx ncrypted wallet new) and funds themselves. The plugin never asks for, reads or stores the user's main wallet, and the skill tells the agent never to ask for private keys in chat.
  • Visible and explicit: every charge is an explicit ncrypted_create tool call. There are no background or recurring charges.
  • No charge on failure: payment settles through Coinbase's x402 facilitator only after the secret is stored.
  • Zero-knowledge by default: the local MCP server encrypts on the user's machine, so the service stores ciphertext only. The optional hosted endpoint (https://ncrypted.ai/mcp) is clearly labeled as server-side encryption.

Data and services contacted

The plugin's MCP server, the CLI and the skill contact only these services:

ServiceWhat is sentWhen
ncrypted API (https://ncrypted.ai, Vercel + Upstash Redis)Ciphertext, IV, salt, passphrase flag and TTL. Never the key, passphrase or plaintext.Creating, reading, checking status of or burning a secret
Coinbase x402 facilitator / Base networkA signed USDC payment authorization (payer address, amount, payee)Creating a secret (0.005 USDC)
Base public RPC (mainnet.base.org)The payer wallet addressncrypted_wallet / ncrypted wallet balance checks
Resend, via the ncrypted APIRecipient email address, the share link (which includes the key) and an optional note. Relayed once and not stored by ncrypted.Only when the user asks to email a link

Retention: ciphertext is deleted on first read, when burned, or at expiry (at most 7 days). Receipt metadata is deleted 7 days after expiry. No analytics, no cookies. Details: privacy policy.

Repo layout

PathWhat
apps/webNext.js app on Vercel: API, viewer page, llms.txt, openapi.json
packages/sdkncrypted on npm: crypto, client, CLI
packages/mcp@seidl-family/ncrypted-mcp on npm: stdio MCP server
skills/ncryptedAgent Skill (SKILL.md)
plugins/ncryptedClaude Code plugin; .claude-plugin/marketplace.json lists it
server.jsonMCP Registry manifest (published by .github/workflows/mcp-registry.yml)

Development

sh
npm installnpm test                       # crypto unit testscp apps/web/.env.example apps/web/.env.local   # set NCRYPTED_PAY_TOnpm run dev                    # in-memory store when Redis isn't configurednpm run build && npm run e2e   # needs .env.e2e with a funded Base Sepolia wallet

After editing skills/ncrypted/SKILL.md, run npm run sync:skill.

Tool-selection evals: ./scripts/run-evals.sh runs evals/ (14 cases, mocked MCP tools, ~$2.50) against a temporary copy of the plugin. Re-run after changing tool descriptions or the skill, and refresh evals/mocks/ncrypted/_tools.json from tools/list when tools change.

On each MCP release, bump the pinned version in Dockerfile, plugins/ncrypted/.mcp.json, plugins/ncrypted/package.json (then npm install --package-lock-only there) and gemini-extension.json (the Claude directory rejects @latest), then run the "Publish to MCP Registry" workflow.

Source: README.md at commit 613b169

Tools

4

ncrypted_create

Create one-time secret

Store a password, API key or sensitive note as a one-time link that self-destructs after a single read. The first 3 per day are free (TTL up to 24h); after that each costs 0.005 USDC, paid via x402 on Base (your MCP client must support x402). Share the link with a person or another agent; never echo the secret in chat. Returns { link, id, receiptToken, expiresAt }; keep id and receiptToken to check delivery (ncrypted_status) or revoke the link (ncrypted_burn). Hosted mode: this server encrypts the secret for you, so it sees the plaintext briefly over TLS (never stored or logged). For end-to-end, zero-knowledge encryption run the local MCP server `npx -y @seidl-family/ncrypted-mcp` instead.

Parameterssecretrequiredpassphrasettl_seconds

ncrypted_read

Read one-time secret

Open an ncrypted link (https://.../s/{id}#{key}) and return the secret. This destroys it permanently. Free. Only use the value for the task at hand and do not repeat it in chat. To check whether someone opened a link you created, use ncrypted_status instead (it doesn't consume anything). Hosted mode: this server decrypts the secret for you, so it sees the plaintext briefly over TLS (never stored or logged). For end-to-end, zero-knowledge encryption run the local MCP server `npx -y @seidl-family/ncrypted-mcp` instead.

Parameterslinkrequiredpassphrase

ncrypted_status

Check one-time secret status

Check whether a secret you created has been opened yet, without consuming it. Returns { status, expiresAt, readAt? } where status is pending (not opened), read, burned or expired. Use it to confirm delivery, or before deciding to ncrypted_burn a link. Only works for secrets you created (needs their receiptToken); to open a link, use ncrypted_read. Free.

ParametersidrequiredreceiptTokenrequired

ncrypted_burn

Burn one-time secret

Permanently destroy an unread secret you created, so its link stops working (e.g. it was sent to the wrong place or is no longer needed). Irreversible. Returns { burned: true } if it was destroyed, or { burned: false, status } if there was nothing left to destroy because it was already read, burned or expired; if it was already read, the recipient has the value, so rotate the credential. Only works for secrets you created (needs their receiptToken). Free.

ParametersidrequiredreceiptTokenrequired

Version history

2
  1. v0.2.2LatestOct 17, 2026
  2. v0.2.1Oct 16, 2026

Score

100% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts