Encryptor MCP

https://github.com/user-attachments/assets/a682dbe5-bec8-4c03-af99-07ef7fa1f529

Your private files stay encrypted, the way Cryptomator keeps them. When you want your AI to help with them, you unlock a vault yourself: your AI can then find, read and update the files in it, and everything locks again on its own.

You: Sum up my 2025 receipts and add the total to my tax notes.
AI:  Asks to open the vault "Taxes". You type the password on a page in your browser.
     Reads 31 receipts, writes the total into tax-notes.md. Says how to undo it.

You: Tidy my Work notes: put last year's meeting notes in a folder.
AI:  Makes the folder "Meetings 2025" and moves 48 notes into it. Every move goes in
     the vault's record, and each one can be undone.

You: I'm done for today.
AI:  Locks the vault. The keys are wiped from memory.

Safety and privacy

• Your password never goes through the chat. The AI asks; you type the password on a page in your own browser (or a password box on a Mac). It stays on your computer or your server.

• Keys live only in memory, for as long as you choose (15 minutes, 1 hour, until you lock it). Vaults lock by themselves after a few minutes without use.

• Every change your AI makes can be undone. Each one keeps what it replaced. Deleted things go to a trash inside the vault. Deleting for good asks you outside the chat. See what can't be undone.

• You see everything. Each vault's page shows what changed and which files were opened, by which app and why. Those logs are private to you: your AI can't see them.

• Stays a normal Cryptomator vault. Same format, same encryption. Cryptomator opens it as before.

• Encrypted the whole way. The vault stays encrypted on disk. The read log and fingerprint list are encrypted with keys from the vault's own key. A server passphrase is kept only as a hash, and app login keys only as fingerprints. Encryption at a glance.

• Nothing collected. No account, no cloud service of ours, no tracking. Your AI app's company sees only what the AI reads for you: the names and files it looks at. The optional update check asks GitHub for the newest version number and nothing else.

• A mode for each vault. Read and change, read only, or hidden from AI, enforced by Encryptor itself. On a server, the login page shows which app is asking, and you tick the vaults it may use and whether it may change files.

• More checks than Cryptomator alone: a health check, and a private fingerprint list that catches files cut short or swapped (something the vault format can't notice by itself).

More in docs/safety.md (risks and good settings), docs/privacy.md (what is kept, where, and who can see it) and docs/threat-model.md.

Related MCP server: amem

How it works, in one picture

Encryptor MCP is a small program you run yourself. Your AI app talks to it through MCP (Model Context Protocol), the standard way AI apps use tools. It opens your vault folders with the vault's own keys: no account, no cloud service of ours, no tracking.

More in docs/how-it-works.md.

Words you'll see

Choose how to run it

On a computer, vaults can be in any folder it can reach. On a server, the vault folders must be on that server, or reached through rclone. On a hosting company, they live on its disk (where-your-vaults-live.md).

What it can do

Find and read. List folders, find files by name, see a file's size and last change, and read text files, long ones in parts. Every file the AI opens goes in the vault's read log, with which app and why.

Change. Write a new file or replace one, add text to the end of a file, make folders, move, rename and copy, and put things in the trash. A move never overwrites anything.

Undo, versions and trash. Every change your AI makes keeps what it replaced. Ask "what did you change today?" or "undo that", or press Undo on the vault's page. Earlier versions of a file can be put back. Things in the trash come back with undo, until you empty it.

Health check. The same checks as Cryptomator's own health check, plus a few more: files cut short or swapped, sync conflict copies, leftovers from an interrupted save. Safe repairs are one button on the vault's page.

Vault tools. Create a new vault, change a vault's password, show its recovery key, or set a new password with the recovery key. All of these happen on the control center only, never in the chat.

Show in Finder. On a Mac, an open vault can show up as a drive in Finder. Changes made there are logged and can be undone, like the AI's.

Approvals. Deleting for good (emptying the trash) always needs your OK outside the chat: a box on your Mac, your AI app's own question, or the Delete for good button on the vault's page. You can ask for an OK before replacing, trashing or moving too (settings.md).

In your language. The control center and the unlock pages come in 20 languages, and your AI answers in yours (languages.md).

On your phone. Through your own server, a hosting company, or your computer with a free tunnel (how).

All 23 tools: docs/tools.md. Ideas for what to ask: docs/examples.md.

Quick start (about 5 minutes)

1. Install uv, a small free tool that installs Python programs. Then install Encryptor MCP:

   uv tool install git+https://github.com/s17sh70x2jfl031ag/Encryptor-MCP

2. Add it to your AI app. For example Claude Code:

   claude mcp add encryptor -s user -- encryptor-mcp stdio

   Or install the Claude Code plugin instead of steps 1 and 2 (it needs uv):

   /plugin marketplace add s17sh70x2jfl031ag/Encryptor-MCP

   /plugin install encryptor-mcp@encryptor

   Claude Desktop, Cursor, Codex and 23 more apps: docs/connect-your-ai.md. Most apps want:

   { "mcpServers": { "encryptor": { "command": "encryptor-mcp", "args": ["stdio"] } } }

3. Ask your AI app: "Open my Encryptor control center." It opens in your browser. Add your vaults on Settings, under Add a vault, or create a new one. Or add them in the terminal with encryptor-mcp setup, and check everything with encryptor-mcp check.

4. Ask your AI about your files. When it needs a vault, you unlock it in your browser.

Step by step, with what you should see: docs/setup-computer.md.

The control center

Your own page for your vaults: unlock and lock, browse files, the record of changes with Undo, the trash, the health check, the read log, settings, and creating vaults, passwords and recovery keys. See docs/control-center.md.

All the guides

Not supported yet

• Older vaults (format 6 and 7, from Cryptomator before 1.6). A current Cryptomator can upgrade them.

• Cryptomator Hub vaults, and vaults whose key file is kept outside the vault folder. Encryptor opens a vault with the masterkey.cryptomator file inside it and your vault password.

• Show in Finder on Windows and Linux. It's a Mac feature for now.

• Your cloud vaults on a hosting company. There, vaults live on the hosting company's disk. To reach vaults in Nextcloud, Dropbox and the like from a server, use your own server with rclone.

• Pictures and PDFs in the chat. The AI reads text files. You can view pictures and download PDFs on the control center.

Help and feedback

Issues are public, so leave out passwords, recovery keys and file names.

Credits

Encryptor MCP was made by s17sh70x2jfl031ag. Cryptomator is a trademark of Skymatic GmbH; this project isn't made by or affiliated with them.

You're welcome to use, fork, change and build on it under the GNU Affero General Public License v3.0 (AGPL-3.0-only) and the notices in NOTICE. In short:

• Keep LICENSE, NOTICE and the copyright lines.

• If you share a changed version, or run one that other people use over the internet, offer them its source code under the same license.

• Mark your version as changed.

GitHub's "Cite this repository" button uses CITATION.cff.

No warranty

Encryptor MCP is free software you run yourself. It comes as is, with no warranty: you use it at your own risk, and no author is responsible for lost or damaged files (sections 15 and 16 of the license say so in full). Every change can be undone and deleting for good asks you first, but keep a backup of your vaults and your recovery keys anyway. See undo-and-backups.md.

License

GNU Affero General Public License v3.0 (AGPL-3.0-only), with the notices in NOTICE. Copyright (C) 2026 s17sh70x2jfl031ag and Encryptor-MCP contributors.