ncrypted
Server Details
One-time, end-to-end encrypted secrets for agents. 0.005 USDC per secret via x402.
- Status
- Healthy
- Uptime
- 100.0% over 22 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- Repository
- Seidl-Family/ncrypted
- GitHub Stars
- 0
- Server Listing
- ncrypted-mcp
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 4 tools
Each tool maps to a distinct verb on the secret lifecycle: create, read (consume), burn (destroy), status (inspect). Descriptions explicitly cross-reference each other to steer selection (e.g. use status instead of read to check delivery).
All four tools follow a single, predictable pattern: the ncrypted_ prefix plus a concise verb (create, read, burn, status). No mixing of conventions.
Four tools is well-scoped for a one-time-secret service; each tool earns its place with no redundant or filler operations.
The full lifecycle (create, consume, inspect, revoke) is covered, including a non-destructive status check. The only minor gap is no way to enumerate/list secrets you created, but callers can track receiptTokens themselves.
Available Tools
4 toolsncrypted_burnBurn one-time secretADestructiveInspect
Permanently destroy an unread secret you created, so its link stops working (e.g. it was sent to the wrong place or is no longer needed). Irreversible. Returns { burned: true } if it was destroyed, or { burned: false, status } if there was nothing left to destroy because it was already read, burned or expired; if it was already read, the recipient has the value, so rotate the credential. Only works for secrets you created (needs their receiptToken). Free.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The secret's id, returned as `id` by ncrypted_create. | |
| receiptToken | Yes | The creator's receipt token, returned as `receiptToken` by ncrypted_create. Only the creator has it; the link alone isn't enough. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only carry destructiveHint=true; the description goes well beyond that by flagging irreversibility, the exact response shapes for both success and no-op cases, the post-hoc remediation ('if it was already read, the recipient has the value, so rotate the credential'), the creator-only auth requirement, and that the call is free.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the verb and consequence, and every clause earns its place given the absence of an output schema. The no-op return path is a dense run-on sentence, but it carries genuinely necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and minimal annotations, the description compensates fully: it documents both success and no-op responses, states the irreversible mutation, and identifies the required credential source, leaving nothing an agent needs before calling it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented. The description restates the receiptToken constraint ('only works for secrets you created (needs their receiptToken)') but adds no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Permanently destroy an unread secret you created') plus the observable effect ('its link stops working'), which cleanly separates it from ncrypted_create, ncrypted_read, and ncrypted_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete situations for invocation ('sent to the wrong place or is no longer needed') and a hard restriction ('Only works for secrets you created'), but never names the sibling tools an agent might otherwise reach for, so the when-not is implied rather than routed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ncrypted_createCreate one-time secretAInspect
Store a password, API key or sensitive note as a one-time link that self-destructs after a single read. The first 3 per day are free (TTL up to 24h); after that each costs 0.005 USDC, paid via x402 on Base (your MCP client must support x402). Share the link with a person or another agent; never echo the secret in chat. Returns { link, id, receiptToken, expiresAt }; keep id and receiptToken to check delivery (ncrypted_status) or revoke the link (ncrypted_burn). Hosted mode: this server encrypts the secret for you, so it sees the plaintext briefly over TLS (never stored or logged). For end-to-end, zero-knowledge encryption run the local MCP server npx -y @seidl-family/ncrypted-mcp instead.
| Name | Required | Description | Default |
|---|---|---|---|
| secret | Yes | The sensitive value to share. Max 64 KB. | |
| passphrase | No | Optional second factor the recipient also needs. Share it through a different channel. | |
| ttl_seconds | No | Expiry if never read. Default 86400 (24h), max 7 days. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does so richly: pricing tiers (3 free/day, then 0.005 USDC via x402 on Base), the client-support requirement, TTL semantics, and the security caveat that hosted mode briefly sees plaintext over TLS while the local server is zero-knowledge. This is exactly the behavioral context an agent needs before calling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded and the sentences are dense with non-redundant information (pricing, security model, return values, sibling routing, server alternative). It is lengthy, but nearly every clause earns its place; minor trimming is possible in the security paragraph.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description specifies the return shape ({ link, id, receiptToken, expiresAt }) and what to do with the returned id and receiptToken. Combined with the usage, pricing, and security notes, nothing essential for calling the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by tying ttl_seconds to pricing tiers ('first 3 per day are free (TTL up to 24h)') and by framing passphrase as a second factor shared through a different channel, which constrains how the agent should supply it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Store a password, API key or sensitive note as a one-time link that self-destructs after a single read.' It distinguishes itself from siblings by naming ncrypted_status and ncrypted_burn as the follow-up tools for delivery checks and revocation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly covers when to use it (share one-time secrets with a person or agent), after-use guidance ('never echo the secret in chat'), and a named alternative for the zero-knowledge case (the local MCP server via npx). It also routes the agent to ncrypted_status/ncrypted_burn for post-creation actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ncrypted_readRead one-time secretADestructiveInspect
Open an ncrypted link (https://.../s/{id}#{key}) and return the secret. This destroys it permanently. Free. Only use the value for the task at hand and do not repeat it in chat. To check whether someone opened a link you created, use ncrypted_status instead (it doesn't consume anything). Hosted mode: this server decrypts the secret for you, so it sees the plaintext briefly over TLS (never stored or logged). For end-to-end, zero-knowledge encryption run the local MCP server npx -y @seidl-family/ncrypted-mcp instead.
| Name | Required | Description | Default |
|---|---|---|---|
| link | Yes | The full ncrypted link including the #key fragment. | |
| passphrase | No | Required only if the sender set a passphrase. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=true and idempotentHint=false, and the description reinforces and extends this: 'This destroys it permanently', 'Free', plus a security disclosure that hosted mode decrypts the plaintext over TLS and a pointer to a zero-knowledge local server alternative. This goes well beyond what the annotations convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action and the destructive consequence, then routing, then security context. Every sentence carries functional information, though the hosted-vs-local-mode paragraph makes it longer than strictly needed for a two-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the irreversible consumption of the link, the return value ('return the secret'), privacy handling of the plaintext, and an alternative deployment for zero-knowledge use. Despite no output schema, nothing material is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, including the #key fragment and conditional passphrase. The description explains the link format inline but adds no syntax or semantics beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource ('Open an ncrypted link ... and return the secret') and names the exact sibling it is not (ncrypted_status). An agent can distinguish it from ncrypted_burn/create/status without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing: use this to consume a link, use ncrypted_status instead when only checking whether a link was opened, and it notes status 'doesn't consume anything'. It also gives a usage constraint on the result ('only use the value for the task at hand').
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ncrypted_statusCheck one-time secret statusARead-onlyInspect
Check whether a secret you created has been opened yet, without consuming it. Returns { status, expiresAt, readAt? } where status is pending (not opened), read, burned or expired. Use it to confirm delivery, or before deciding to ncrypted_burn a link. Only works for secrets you created (needs their receiptToken); to open a link, use ncrypted_read. Free.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | The secret's id, returned as `id` by ncrypted_create. | |
| receiptToken | Yes | The creator's receipt token, returned as `receiptToken` by ncrypted_create. Only the creator has it; the link alone isn't enough. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true; the description adds substantial context beyond that: the operation is non-consuming, it requires creator credentials (receiptToken, not just the link), it enumerates the possible status outcomes and their meanings, and it notes the call is free. This is rich behavioral disclosure for a read-only tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and its key non-destructive property, followed by return shape, then usage routing, then the constraint, then a one-word cost note. Every clause earns its place; no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema present, the description compensates by documenting the return payload shape ({ status, expiresAt, readAt? }) and the meaning of each status value. Combined with the precondition and sibling routing, an agent has everything needed to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, but the description adds semantic meaning the schema repeats only implicitly ('only works for secrets you created (needs their receiptToken)'), clarifying why the token is required and who holds it. That is a genuine increment over the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Check whether a secret ... has been opened') with the critical qualifier 'without consuming it'. It explicitly distinguishes itself from ncrypted_read (opening a link) and ncrypted_burn, so an agent can route correctly without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use guidance ('confirm delivery, or before deciding to ncrypted_burn a link'), an explicit precondition ('Only works for secrets you created (needs their receiptToken)'), and names the alternative tool for the other use case (ncrypted_read). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- Changed
ncrypted_burn2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"The secret's id, returned as `id` by ncrypted_create." - added
Input schema / properties / receiptToken / descriptionAdded value: +"The creator's receipt token, returned as `receiptToken` by ncrypted_create. Only the creator has it; the link alone isn't enough."
- Changed
ncrypted_status2 fields changed- added
Input schema / properties / id / descriptionAdded value: +"The secret's id, returned as `id` by ncrypted_create." - added
Input schema / properties / receiptToken / descriptionAdded value: +"The creator's receipt token, returned as `receiptToken` by ncrypted_create. Only the creator has it; the link alone isn't enough."
4 tool updates
- First observed
ncrypted_burn - First observed
ncrypted_create - First observed
ncrypted_read - First observed
ncrypted_status
Related MCP Connectors
Private, permanent encrypted storage for AI agents. Paid per call in USDC via x402.
Encrypted, pay-per-use persistent memory storage for AI agents, gated by x402 payments on Base.
Persistent agent memory paid per call via x402 USDC. Your wallet is your private memory namespace.
Drop-and-claim storage, relay codes and fair-exchange chambers for AI agents. Pay per use in USDC.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEncrypted secret store for the A2A network — Hive Civilization. Agents can store and retrieve secrets encrypted with AES-256-GCM, scoped to their DID, with USDC payment via x402.MIT
- AlicenseAqualityAmaintenanceShare encrypted, self-destructing secrets from your AI agent. Zero-knowledge E2E encryption. Agent-blind input sources (env:, file:, dotenv:) keep secrets out of LLM context.413 npm1MIT
- AlicenseNot gradedqualityBmaintenanceSelf-hosted, zero-knowledge encrypted, self-destructing secrets for secure agent-to-agent coordination3AGPL 3.0
- AlicenseAqualityFmaintenanceHand a secret to another agent as an encrypted, pay-per-read token delivered exactly once, leaving no copy behind. Also pre-flights an x402 endpoint before your agent pays it. Runs locally over stdio and encrypts in your own process, so there is no hosted version to hand your plaintext to.3137 npmISC
Glama MCP Gateway
Add one secure layer between your agents and this server.