# An MCP server for sharing secrets: local, free, no account

> Run npx -y evergist mcp for a local MCP server for sharing secrets as one-time links. No account, no API key. Config for Claude Code, Codex, and Cursor.

Source: https://evergist.com/blog/mcp-server-for-sharing-secrets/
Published: 2026-09-30

**Short answer:** `npx -y evergist mcp` starts a local MCP server for sharing secrets through encrypted links that expire or burn after one read. It encrypts on the machine that runs it and uploads only ciphertext. It needs no account and no API key, and it's free. In Claude Code, add it with `claude mcp add evergist -- npx -y evergist mcp`.

## How do I add it to Claude Code, Codex, or Cursor?

One command or one JSON block. The server is part of the [`evergist` npm package](https://www.npmjs.com/package/evergist), and `npx` fetches it on first run, so there is nothing to install first. It needs Node.js 20 or newer. The [full setup reference for agents](https://evergist.com/agents/#mcp-server) has the same server next to the skill file and the CLI.

Claude Code:

```sh
claude mcp add evergist -- npx -y evergist mcp
```

Codex CLI:

```sh
codex mcp add evergist -- npx -y evergist mcp
```

Cursor, Claude Desktop, Windsurf, and other clients take the same JSON:

```json
{
  "mcpServers": {
    "evergist": {
      "command": "npx",
      "args": ["-y", "evergist", "mcp"]
    }
  }
}
```

In Cursor that goes in `.cursor/mcp.json` for one project or `~/.cursor/mcp.json` for all of them, per [Cursor's MCP docs](https://cursor.com/docs/context/mcp).

If you'd rather skip the npm registry, evergist.com serves the same package. Replace `evergist` with `https://evergist.com/cli/evergist.tgz` in any command above.

## What are the four tools?

The server exposes tools only. It has no resources and no prompts.

| Tool | Parameters | Returns | Uses a view? |
|---|---|---|---|
| `create_gist` | `text` (required), `expires_in`, `max_views`, `password`, `generate_password` | `url`, `id`, `expiresAt`, `maxViews`, `deleteToken`, `passwordProtected`, and `password` when generated | No |
| `read_gist` | `url` (required), `password` | `text`, `id`, `expiresAt`, `viewsRemaining`, `burned` | Yes |
| `gist_status` | `url` (required) | `expiresAt`, `maxViews`, `viewsRemaining`, `password`, `id` | No |
| `delete_gist` | `url` with optional `password`, or `id` with `delete_token` | `deleted: true` | No |

The parameters in detail:

- `text` is UTF-8, up to 524,288 bytes (512 KiB).
- `expires_in` takes `10m`, `1h`, `1d`, `7d`, `30d`, or a number of seconds. The default is `1d`. The allowed range is 1 minute to 30 days.
- `max_views` is a whole number from 1 to 1000. Leave it out for no limit until expiry. Use 1 for burn after reading.
- `password` adds a password on top of the link. `generate_password: true` makes a strong one and returns it.
- `url` is always the full share link, including the part after `#`. That part is the key.

A credential handoff is one call:

```json
{
  "name": "create_gist",
  "arguments": {
    "text": "DATABASE_URL=postgres://app:example@db.internal/app",
    "max_views": 1,
    "expires_in": "1h"
  }
}
```

`gist_status` carries a read-only hint and `read_gist` a destructive one, because a read can delete the note. A client that honors tool annotations can ask before spending the only view.

## Does the MCP server see my secret in plaintext?

The local process does, because it does the encrypting. evergist.com doesn't. The server generates a 256-bit key, encrypts with AES-256-GCM, and uploads the ciphertext with token hashes. The key stays in the link after `#`, which never gets sent to us. [How the encryption works](https://evergist.com/security/) covers the scheme and four ways to check it.

The agent sees the secret too, and this is the part most tool pages skip. `text` is a tool argument the model writes, so the value is already in the agent's context when it calls `create_gist`. `read_gist` returns the plaintext into that context.

When the value should stay out of the model's view, use the CLI from the same package and point it at a file:

```sh
# Share a file the agent never printed
npx -y evergist create .env --views 1 --expires 1h

# Receive into a file instead of the tool result
npx -y evergist read "https://evergist.com/g/<id>#<key>" > .env.local
```

[Giving Claude Code an API key safely](https://evergist.com/blog/give-claude-code-an-api-key-safely/) walks through the second command and its limits.

## Hosted MCP and ChatGPT

A remote MCP tool that accepted plaintext would receive your text before encrypting it. Evergist's local MCP server encrypts on your machine. The [ChatGPT plugin](https://evergist.com/chatgpt/) takes a different approach. Its hosted endpoint at `https://evergist.com/mcp` only opens an embedded browser editor, where users enter ordinary notes and encrypt them before upload. It does not accept plaintext or keys as tool arguments. Secret-sharing workflows remain in the local tools.

The cost is real. A client needs to be able to start a local process with Node.js. A client that accepts only remote MCP URLs can't use it.

## Do I need an account or API key?

No. There is no signup, no token to put in the config, and no paid tier. The API takes ciphertext from anyone and rate limits by network. One network gets 10 creates per minute and 120 per hour, plus 120 reads and deletes per minute.

Notes hold text only, up to 512 KiB, for 30 days at most.

## What other MCP servers share secrets?

Several exist, and you should compare them. We read one vendor's page closely enough to describe it.

[Vaulted](https://vaulted.fyi/mcp) ships `@vaulted/mcp-server`, which also runs locally through `npx`. Its page says it uses AES-256-GCM with the key in the URL fragment, and lists four tools: `create_secret`, `view_secret`, `check_status`, and `list_secrets`. It also accepts input sources such as `env:VAR_NAME`, `file:/path/to/key`, and `dotenv:.env.local:KEY`, so the server reads the value and the model never sees it. Evergist's MCP server has no equivalent. For that case we point people to the CLI, as shown above.

MCP directories list more servers in this category. We haven't verified their claims, so we won't describe them here.

Whichever you pick, check four things:

- Where encryption runs. A local stdio process can keep plaintext off the vendor's servers. A hosted endpoint receives it.
- Whether the key ever reaches the vendor.
- Whether a status check uses a view.
- Whether the model has to hold the value to share it.

## Questions

### Is there an MCP server for one-time secret links?

Yes. `npx -y evergist mcp` is one. Set `max_views` to 1 in `create_gist` and the first read deletes the note. Others exist, including Vaulted's.

### What is the difference between an MCP server that stores secrets and one that shares them?

A storing server sits in front of a vault or secrets manager and hands the agent credentials it is allowed to use, again and again. A sharing server moves one piece of text from one party to another and then forgets it. Evergist is the second kind and is not a vault. [One-time links vs a vault](https://evergist.com/blog/one-time-links-vs-vault-for-ai-agents/) covers when each fits.

### Can an agent read a secret link without opening a browser?

Yes. `read_gist` takes the full link and returns the decrypted text, and `gist_status` checks expiry and views left without using a view. No browser automation is involved. [How AI agents can share secrets](https://evergist.com/blog/how-ai-agents-share-secrets/) has the rules worth giving the agent.

## Next steps

- Agent instructions, with every command: https://evergist.com/SKILL.md
- MCP server, CLI, and REST API setup: https://evergist.com/agents.md