ncrypted

One-time secrets for AI agents.

Your agent encrypts a password, API key or note on its own machine, pays 0.005 USDC, and gets a link that opens exactly once. Share it with a person, email it, or hand it to another agent. After one read it's gone for good.

0.005 USDC per secret reads are free x402 on Base end-to-end encrypted

How it works

1. Encrypt locally

AES-256-GCM with a random key. Our server only ever sees ciphertext.

2. Pay per secret

The agent's wallet pays 0.005 USDC over x402. No accounts, no API keys.

3. Share the link

The key rides in the link's #fragment, which browsers never send to servers.

4. Burn after reading

The first read deletes it atomically. Unread secrets expire (5 minutes to 7 days).

Install

Creating secrets needs a Base wallet holding a little USDC (no ETH). Create a dedicated one with npx ncrypted wallet new, which saves the key to ~/.config/ncrypted/wallet.key and prints an address to fund. Reading secrets is free and needs no wallet.

Claude Code

/plugin marketplace add Seidl-Family/ncrypted
/plugin install ncrypted@ncrypted

Codex

codex plugin marketplace add Seidl-Family/ncrypted

Gemini CLI

gemini extensions install https://github.com/Seidl-Family/ncrypted

Any MCP client (local, zero-knowledge)

{
  "mcpServers": {
    "ncrypted": {
      "command": "npx",
      "args": ["-y", "@seidl-family/ncrypted-mcp"]
    }
  }
}

Hosted MCP

For clients that can't run local servers: https://ncrypted.ai/mcp (Streamable HTTP). Your client must support x402 payments, and the server sees the plaintext briefly while encrypting it. Prefer the local server for anything sensitive.

Agent Skill

npx skills add Seidl-Family/ncrypted

CLI and SDK

echo "hunter2" | npx ncrypted create --ttl 1h --email ops@example.com
npx ncrypted read "https://ncrypted.ai/s/abc#key"

import { Ncrypted } from "ncrypted";
const { link } = await new Ncrypted().create("hunter2", { ttl: 3600 });

API

`POST /api/v1/secrets`	0.005 USDC (x402). Store ciphertext, get id and receipt token.
`POST /api/v1/secrets/:id/reveal`	Free. Returns ciphertext and deletes it.
`GET /api/v1/secrets/:id/status`	Free, creator only. pending, read, burned or expired.
`DELETE /api/v1/secrets/:id`	Free, creator only. Burn before it's read.
`POST /api/v1/secrets/:id/email`	Free, creator only, once. Email the link.

Full details: llms.txt · openapi.json · source · privacy · terms

Security notes

Emailing a link means it passes through our server once on its way to the email provider. We never store it, but for very sensitive values add a passphrase and send that through another channel. Links are single-use, so if a recipient finds theirs already opened, assume it was intercepted and rotate the credential.