WebCrypt MCP Server

io.github.putervisionPublished by GitHub account putervisionv1.0.1Updated Oct 24, 2026

Zero-dependency Web Crypto & AI Agent MCP Server (AES-256-GCM, RSA-4096, PQC, Signatures).

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Local MCP server exposing Web Crypto tools so an assistant can encrypt, decrypt, hash, sign and manage keys for agent payloads.

What you can do
  • Encrypt and decrypt text, JSON or files with AES-256-GCM or RSA-4096 hybrid keys
  • Generate JWK keypairs (RSA, ECDH, ECDSA, RSA-PSS) and high-entropy passwords
  • Compute SHA-256, SHA-512 and SHA-3 digests in hex or base64
  • Sign and verify messages, release hashes and evidence packs with ECDSA or HMAC
  • Run post-quantum Kyber KEM encapsulation and Dilithium signatures, including hybrid modes
When to use it
Useful when a coding agent needs to keep secrets or state memory encrypted on disk, prove that artifacts such as test evidence or release hashes are untampered, or exchange keys between agents. It suits local, security-focused agent workflows rather than general development tasks.
Requirements
Runs as a local stdio process installed from the npm package webcrypt (Node.js 18+ or Bun); a global install or npx is used to set up IDE and agent configuration. No accounts, API keys or environment variables are declared.
Before you install
The tools handle plaintext secrets, private keys and passwords that pass through the assistant and its logs; encryption keys and generated keypairs are produced and used locally, so their storage and handling are the user's responsibility. Signing and encryption produce artifacts that may be written to disk or shared. Verify the package source before installing.

Installation

In SourceWeft

  1. Open WebCrypt MCP Server in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

WebCrypt v1.0.1

Zero-dependency Web Crypto & native AI Agent Tooling (MCP) for modern JavaScript.

[npm version] [npm downloads] [Node] [TypeScript] [MCP] [Tests] [Coverage] [PuterVision Triad] [License: MIT]

AES-256-GCM symmetric encryption, RSA-4096 hybrid public keys, ECDH key agreement, ECDSA/HMAC digital signatures, and Post-Quantum KEM (Kyber/Dilithium) — zero runtime dependencies, pure Web Crypto API.

⚡ Quickstart (15 Seconds)

1. Installation

bash
# 📦 Install as project library (Node.js, TypeScript, Browser)npm install webcrypt
# 🌐 Install globally (CLI utilities & global MCP tools)npm install -g webcrypt
javascript
import { WebCrypt, WebCryptAsym } from "webcrypt";
// 🔒 Symmetric AES-256-GCM (600k PBKDF2 iterations)const wc = new WebCrypt();const encrypted = await wc.encryptText("Secret payload", "password");const decrypted = await wc.decryptText(encrypted, "password");
// 🔑 Asymmetric RSA-4096 Hybrid Encryptionconst wca = new WebCryptAsym();const keyPair = await wca.generateKeyPair(4096);const cipher = await wca.encryptText("Secret payload", keyPair.publicKey);const plain = await wca.decryptText(cipher, keyPair.privateKey);

2. Auto-Setup for AI Agents & IDEs (MCP Server)

bash
# Initialize MCP server, agent skills, and rules across your projectnpx webcrypt init  # or `webcrypt init` if installed globally

Supports Google Antigravity, Cursor, Claude Desktop, VS Code / Copilot, Windsurf, Cline, and Zed.

🤖 Why AI Agents Need WebCrypt MCP

Equip autonomous coding agents with an authenticated cryptographic vault directly in their toolbelt:

  • 🔐 Confidential Local Vaulting (encrypt_payload): Encrypt API keys and state memory before writing to disk to prevent prompt log leaks.
  • 🛡️ Tamper-Proof Provenance (sign_verify): Cryptographically sign test evidence packs, release binaries, and code diffs with ECDSA or HMAC.
  • 🤝 Inter-Agent Key Exchange (manage_keys): Ephemeral JWK keypairs (RSA-4096, ECDH P-256/P-384) for private agent-to-agent messaging.
  • ⚛️ Post-Quantum Guardrails (pqc_kem_sign): Built-in Kyber KEM and Dilithium signatures future-proof long-term agent artifacts.
  • ⚡ Zero Dependencies: 100% native crypto.subtle execution across Node.js 18+, Bun, browsers, and Edge runtimes.
┌───────────────────────────────────────────────────────────┐│              Autonomous AI Coding Agent                   ││     (Antigravity / Cursor / Claude / Copilot / Cline)     │└─────────┬───────────────────┬───────────────────┬─────────┘          │                   │                   │          ▼                   ▼                   ▼┌───────────────────┐┌───────────────────┐┌───────────────────┐│ state-memory-mcp  ││ vision-memory-mcp ││     webcrypt      ││  (Workflow State) ││  (Visual Cache)   ││  (Security Vault) ││  • Task Graph DAG ││  • UI Grounding   ││  • AES-256 Vault  ││  • Decisions & SDD││  • Layout Trees   ││  • RSA/ECDH Keys  ││  • Event Ledger   ││  • Visual History ││  • Digital Sigs   │└───────────────────┘└───────────────────┘└───────────────────┘

🛠️ MCP Tools Reference (6 Core Tools)

ToolAction / ModeDescription
encrypt_payloadsymmetric | asymmetric | dataEncrypt text, JSON objects, or files with AES-256-GCM or RSA-4096.
decrypt_payloadsymmetric | asymmetric | dataDecrypt ciphertext back to plaintext or structured JSON.
manage_keysgenerate | generate_random_passwordGenerate JWK keypairs (RSA, ECDH, ECDSA, RSA-PSS) or high-entropy passwords.
crypto_hashSHA-256 | SHA-512 | SHA-3Compute cryptographic hash digests in hex or base64.
sign_verifysign | verifySign and verify messages, release hashes, and evidence packs.
pqc_kem_signkyber_* | dilithium_* | hybrid_*Post-quantum Kyber KEM encapsulation and Dilithium signatures.

📚 Technical Documentation Directory

Explore dedicated guides in docs/ and examples/:

GuideTopic
🚀 Live Interactive PlaygroundTest all crypto features in the browser demo.
💻 CLI Reference GuideScaffolding, global project scanning, and terminal utilities.
⚙️ Multi-IDE MCP Setup GuideStep-by-step MCP JSON configs for all major IDEs.
🔒 Symmetric Encryption API (WebCrypt)AES-256-GCM, streaming files, WebRTC E2EE, PBKDF2.
🔑 Asymmetric Encryption API (WebCryptAsym)RSA-4096 hybrid, ECDH key agreement, ECDSA/RSA-PSS.
⚛️ Post-Quantum Cryptography GuideKyber KEM, Dilithium signatures, and Hybrid KEM.
🏗️ Architecture & MCP SpecificationsStdio JSON-RPC 2.0 protocol and chunk framing specs.
🤖 Agent Skill DefinitionCustom agent skill with automated test runner script.
📋 Project Instructions TemplateMulti-agent rules template (<!-- webcrypt-mcp:start -->).
💡 Code Examples DirectoryReady-to-run Node.js & browser recipes.

🌐 PuterVision Triad Standard

  • 📊 @putervision/state-memory-mcp: Persistent SQLite graph for workflow states, task DAGs, and decision trails.
  • 👁️ @putervision/vision-memory-mcp: Multimodal visual layout cache, AX grounding, and video replay analysis.
  • 🔐 webcrypt: Zero-dependency cryptographic vault, payload encryption, key management, and digital signatures.

🧪 Testing & Diagnostics

bash
# Run unit & integration test matrix (30 suites, 247 tests)npm test
# Run live MCP tool test runner (25 assertions, 100% verified)node .agents/skills/webcrypt-mcp/scripts/exercise_tools.js
# Audit environment & project configuration healthwebcrypt doctor

⚖️ License & Disclaimers

Developed and maintained by PuterVision. Released under the MIT License.

  • 100% Local Execution Guarantee: All cryptographic operations execute locally in memory via standard W3C Web Crypto API (crypto.subtle). Zero external API calls, telemetry, or network transmissions.
  • Trademarks & Non-Affiliation: Product names (Cursor, Claude, Google Antigravity, VS Code, GitHub Copilot, Windsurf, Cline, Zed) are property of their respective owners and used solely for compatibility identification.

Source: README.md at commit 4afe873

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts