Encrypt a password, API key, or sensitive note locally and store it as a one-time secret. Returns a link that works exactly once, then self-destructs. The first 3 per day are free (TTL up to 24h, no email); after that each costs 0.005 USDC, paid automatically from the configured Base wallet via x402. Share the returned link with a human, email it (emailTo), or hand it to another agent, which reads it with ncrypted_read. Treat the link like the secret itself; never echo the secret value in chat. Returns { link, id, receiptToken, expiresAt }; keep id and receiptToken to check delivery (ncrypted_status) or revoke the link (ncrypted_burn). Use ncrypted_request instead when you need a secret FROM the user, and ncrypted_to_vercel_env / ncrypted_to_dotenv when a value from a link must be installed somewhere.

Open an ncrypted link (https://.../s/{id}#{key}), decrypt it locally and return the secret. This destroys the secret: it can never be read again. Free. Use the value only for the task at hand and do not repeat it in chat. If the value just needs to end up in a Vercel env var or .env file, use ncrypted_to_vercel_env or ncrypted_to_dotenv instead so you never see it. To check whether someone opened a link you created, use ncrypted_status (it doesn't consume anything).

Check whether a secret you created has been opened yet, without consuming it. Returns { status, expiresAt, readAt? } where status is pending (not opened), read, burned or expired. Use it to confirm delivery, or before deciding to ncrypted_burn a link. Only works for secrets you created (needs their receiptToken); to open a link, use ncrypted_read. Free.

Permanently destroy an unread secret you created, so its link stops working (e.g. it was sent to the wrong place or is no longer needed). Irreversible. Returns { burned: true } if it was destroyed, or { burned: false, status } if there was nothing left to destroy because it was already read, burned or expired; if it was already read, the recipient has the value, so rotate the credential. Only works for secrets you created (needs their receiptToken). Free.

Open an ncrypted link and write its value straight into a Vercel project environment variable (type sensitive), so the value never appears in this conversation. Uses the user's vercel login session or VERCEL_TOKEN. Checks Vercel access before consuming the link. Prefer this over reading a secret and running vercel env add.

Open an ncrypted link and write its value into a local .env file (KEY=value, file mode 600) without showing it to you. Warns if the file isn't git-ignored.

When you need a password, API key or token from the user, call this instead of asking them to paste it into chat. Returns a link for the user; they paste the value on that page, where it's encrypted in their browser to a key that only exists on this machine. Give the user the link and END YOUR TURN so they can open it; once they say they've submitted it, call ncrypted_request_fulfill to deliver it (e.g. to a Vercel env var) without ever seeing it. Free.

After the user says they've submitted an ncrypted_request, collect and deliver the value. destination 'vercel_env' or 'dotenv' writes it without showing it to you (preferred). 'return' gives you the value; use it only when you must use it directly, and never repeat it. Returns status 'pending' if the user hasn't answered within wait_seconds; call again later.

Create the local wallet that pays for secrets beyond the free tier (0.005 USDC each on Base), if none exists, and get a funding link for its owner. Funding needs only the address; send the user fundUrl and ask them to send a little USDC on Base (1 USDC = 200 secrets). The private key stays in a local file and is never shown to you. Set backup_to_owner only if the user wants a copy of the key: it's placed in a one-time link for them.

Show today's remaining free secrets, plus the address and USDC balance (Base) of the wallet that pays for more. Free.