# ncrypted (npm · @seidl-family/ncrypted-mcp)

One-time, end-to-end encrypted secrets for agents. 0.005 USDC per secret via x402.

- Trust score: 69/100 (medium)
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-10-18

## Components

- remote · `ncrypted.ai`: 68/100, [markdown](https://verifymcp.io/servers/seidl-family-ncrypted/ncrypted.md), [page](https://verifymcp.io/servers/seidl-family-ncrypted/ncrypted)
- npm · `@seidl-family/ncrypted-mcp`: 69/100 (this document), [markdown](https://verifymcp.io/servers/seidl-family-ncrypted/seidl-family-ncrypted-mcp.md), [page](https://verifymcp.io/servers/seidl-family-ncrypted/seidl-family-ncrypted-mcp)

## Channel facts

- Registry: `npm`
- Package: `@seidl-family/ncrypted-mcp`
- Version: `0.2.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-10-18.

- **Supply Chain Security**: 99/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 31 of 113 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 1 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 67/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 1768 tokens (~176/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 7/100
  - Stability observed for 2 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 95/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 86% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 10 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 10 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the ncrypted MCP server?

ncrypted runs locally as an npm package, launched with npx -y @seidl-family/ncrypted-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add seidl-family-ncrypted -- npx -y @seidl-family/ncrypted-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "seidl-family-ncrypted": {
      "command": "npx",
      "args": [
        "-y",
        "@seidl-family/ncrypted-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "seidl-family-ncrypted": {
      "command": "npx",
      "args": [
        "-y",
        "@seidl-family/ncrypted-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add seidl-family-ncrypted -- npx -y @seidl-family/ncrypted-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "seidl-family-ncrypted": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@seidl-family/ncrypted-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add seidl-family-ncrypted --command npx --arg -y --arg @seidl-family/ncrypted-mcp
```

### Hermes

```yaml
mcp_servers:
  seidl-family-ncrypted:
    command: "npx"
    args: ["-y", "@seidl-family/ncrypted-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "seidl-family-ncrypted": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@seidl-family/ncrypted-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add seidl-family-ncrypted -t stdio -c npx -a -y @seidl-family/ncrypted-mcp
```

### Other

```json
{
  "mcpServers": {
    "seidl-family-ncrypted": {
      "command": "npx",
      "args": [
        "-y",
        "@seidl-family/ncrypted-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-10-17 (score 69, +11)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Dependency health: unverified → 0.88

### 2026-10-16 (score 58)

First indexed and scored.

## MCP tools (10)

### `ncrypted_create` (~376 tokens)

Create one-time secret

Encrypt a password, API key, or sensitive note locally and store it as a one-time secret. Returns a link that works exactly once, then self-destructs. The first 3 per day are free (TTL up to 24h, no email); after that each costs 0.005 USDC, paid automatically from the configured Base wallet via x402. Share the returned link with a human, email it (emailTo), or hand it to another agent, which reads it with ncrypted_read. Treat the link like the secret itself; never echo the secret value in chat. Returns { link, id, receiptToken, expiresAt }; keep id and receiptToken to check delivery (ncrypted_status) or revoke the link (ncrypted_burn). Use ncrypted_request instead when you need a secret FROM the user, and ncrypted_to_vercel_env / ncrypted_to_dotenv when a value from a link must be installed somewhere.

Input parameters:

- `emailNote` (string): Short context for the email, e.g. 'Staging DB password'. Never include the secret.
- `emailTo` (string): If the user asks you to email it, pass the address here and ncrypted emails the link once. Needs a paid secret (a funded wallet); without one the call fails with instructions, and you can give the us…
- `passphrase` (string): Optional second factor. The recipient needs it in addition to the link; deliver it through a different channel.
- `secret` (string, required): The sensitive value to share. Max 64 KB.
- `ttl_seconds` (integer): Expiry if never read. Default 86400 (24h), max 7 days.

### `ncrypted_read` (~159 tokens)

Read one-time secret

Open an ncrypted link (https://.../s/{id}#{key}), decrypt it locally and return the secret. This destroys the secret: it can never be read again. Free. Use the value only for the task at hand and do not repeat it in chat. If the value just needs to end up in a Vercel env var or .env file, use ncrypted_to_vercel_env or ncrypted_to_dotenv instead so you never see it. To check whether someone opened a link you created, use ncrypted_status (it doesn't consume anything).

Input parameters:

- `link` (string, required): The full ncrypted link including the #key fragment.
- `passphrase` (string): Required only if the sender set a passphrase.

### `ncrypted_status` (~147 tokens)

Check one-time secret status

Check whether a secret you created has been opened yet, without consuming it. Returns { status, expiresAt, readAt? } where status is pending (not opened), read, burned or expired. Use it to confirm delivery, or before deciding to ncrypted_burn a link. Only works for secrets you created (needs their receiptToken); to open a link, use ncrypted_read. Free.

Input parameters:

- `id` (string, required): The secret's id, returned as `id` by ncrypted_create.
- `receiptToken` (string, required): The creator's receipt token, returned as `receiptToken` by ncrypted_create. Only the creator has it; the link alone isn't enough.

### `ncrypted_burn` (~169 tokens)

Burn one-time secret

Permanently destroy an unread secret you created, so its link stops working (e.g. it was sent to the wrong place or is no longer needed). Irreversible. Returns { burned: true } if it was destroyed, or { burned: false, status } if there was nothing left to destroy because it was already read, burned or expired; if it was already read, the recipient has the value, so rotate the credential. Only works for secrets you created (needs their receiptToken). Free.

Input parameters:

- `id` (string, required): The secret's id, returned as `id` by ncrypted_create.
- `receiptToken` (string, required): The creator's receipt token, returned as `receiptToken` by ncrypted_create. Only the creator has it; the link alone isn't enough.

### `ncrypted_to_vercel_env` (~203 tokens)

Save one-time secret to a Vercel env var

Open an ncrypted link and write its value straight into a Vercel project environment variable (type sensitive), so the value never appears in this conversation. Uses the user's `vercel login` session or VERCEL_TOKEN. Checks Vercel access before consuming the link. Prefer this over reading a secret and running `vercel env add`.

Input parameters:

- `cwd` (string): Project directory containing .vercel/project.json. Default: the server's working directory.
- `key` (string, required): Env var name, e.g. STRIPE_SECRET_KEY.
- `link` (string, required)
- `passphrase` (string)
- `project` (string): Vercel project name or id. Default: the project linked in cwd's .vercel/project.json.
- `targets` (array): Default: production and preview.
- `team` (string): Vercel team id (team_...) or slug. Default: the linked project's team.

### `ncrypted_to_dotenv` (~94 tokens)

Save one-time secret to a .env file

Open an ncrypted link and write its value into a local .env file (KEY=value, file mode 600) without showing it to you. Warns if the file isn't git-ignored.

Input parameters:

- `key` (string, required): Variable name.
- `link` (string, required)
- `passphrase` (string)
- `path` (string): Path to the .env file. Default: ./.env

### `ncrypted_request` (~170 tokens)

Ask the user for a secret

When you need a password, API key or token from the user, call this instead of asking them to paste it into chat. Returns a link for the user; they paste the value on that page, where it's encrypted in their browser to a key that only exists on this machine. Give the user the link and END YOUR TURN so they can open it; once they say they've submitted it, call ncrypted_request_fulfill to deliver it (e.g. to a Vercel env var) without ever seeing it. Free.

Input parameters:

- `label` (string, required): What you need and why, shown to the user, e.g. 'Stripe secret key for the billing project (Vercel production)'.
- `ttl_minutes` (integer): How long the request stays open. Default 60.

### `ncrypted_request_fulfill` (~256 tokens)

Receive a requested secret

After the user says they've submitted an ncrypted_request, collect and deliver the value. destination 'vercel_env' or 'dotenv' writes it without showing it to you (preferred). 'return' gives you the value; use it only when you must use it directly, and never repeat it. Returns status 'pending' if the user hasn't answered within wait_seconds; call again later.

Input parameters:

- `cwd` (string): Project directory containing .vercel/project.json. Default: the server's working directory.
- `destination` (string, required)
- `id` (string, required): The request id from ncrypted_request.
- `key` (string): Variable name (required for vercel_env and dotenv).
- `path` (string): dotenv only: path to the .env file. Default ./.env
- `project` (string): Vercel project name or id. Default: the project linked in cwd's .vercel/project.json.
- `targets` (array): Default: production and preview.
- `team` (string): Vercel team id (team_...) or slug. Default: the linked project's team.
- `wait_seconds` (integer): How long to wait for the user. Default 60.

### `ncrypted_wallet_setup` (~159 tokens)

Set up a payer wallet

Create the local wallet that pays for secrets beyond the free tier (0.005 USDC each on Base), if none exists, and get a funding link for its owner. Funding needs only the address; send the user `fundUrl` and ask them to send a little USDC on Base (1 USDC = 200 secrets). The private key stays in a local file and is never shown to you. Set backup_to_owner only if the user wants a copy of the key: it's placed in a one-time link for them.

Input parameters:

- `amount_usdc` (number): Suggested funding amount. Default 1.
- `backup_to_owner` (boolean): Also create a one-time link containing the private key for the owner. Default false.

### `ncrypted_wallet` (~35 tokens)

Show payer wallet

Show today's remaining free secrets, plus the address and USDC balance (Base) of the wallet that pays for more. Free.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/seidl-family-ncrypted/seidl-family-ncrypted-mcp#diagnostics

## Score history

- 2026-10-18: 69
- 2026-10-17: 69
- 2026-10-16: 58

## Common questions

### What is the ncrypted MCP server?

ncrypted is an MCP server listed in the public MCP registry as io.github.Seidl-Family/ncrypted. One-time, end-to-end encrypted secrets for agents. 0.005 USDC per secret via x402. This page covers its npm package (@seidl-family/ncrypted-mcp).

### Is the ncrypted MCP server safe to use?

ncrypted scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 18 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the ncrypted MCP server expose?

ncrypted exposes 10 tools: ncrypted_create, ncrypted_read, ncrypted_status, ncrypted_burn, ncrypted_to_vercel_env, and 5 more. Their descriptions and schemas cost roughly 1,768 tokens of context every time the server is loaded.

### Is the ncrypted MCP server still maintained?

ncrypted is still listed as active in the MCP registry. We last reached this channel on 18 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the ncrypted MCP server under?

ncrypted declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/@seidl-family/ncrypted-mcp
- Socket report: https://socket.dev/npm/package/@seidl-family/ncrypted-mcp
- Repository: https://github.com/Seidl-Family/ncrypted
- Website: https://ncrypted.ai/
- Changelog RSS feed: https://verifymcp.io/servers/seidl-family-ncrypted/seidl-family-ncrypted-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/seidl-family-ncrypted/seidl-family-ncrypted-mcp.json
- HTML version of this page: https://verifymcp.io/servers/seidl-family-ncrypted/seidl-family-ncrypted-mcp