Evergist

An MCP server for sharing secrets: local, free, no account

Run npx -y evergist mcp for a local MCP server for sharing secrets as one-time links. No account, no API key. Config for Claude Code, Codex, and Cursor.

The Evergist team · · 5 min read

Short answer: npx -y evergist mcp starts a local MCP server for sharing secrets through encrypted links that expire or burn after one read. It encrypts on the machine that runs it and uploads only ciphertext. It needs no account and no API key, and it's free. In Claude Code, add it with claude mcp add evergist -- npx -y evergist mcp.

How do I add it to Claude Code, Codex, or Cursor?

One command or one JSON block. The server is part of the evergist npm package, and npx fetches it on first run, so there is nothing to install first. It needs Node.js 20 or newer. The full setup reference for agents has the same server next to the skill file and the CLI.

Claude Code:

claude mcp add evergist -- npx -y evergist mcp

Codex CLI:

codex mcp add evergist -- npx -y evergist mcp

Cursor, Claude Desktop, Windsurf, and other clients take the same JSON:

{
  "mcpServers": {
    "evergist": {
      "command": "npx",
      "args": ["-y", "evergist", "mcp"]
    }
  }
}

In Cursor that goes in .cursor/mcp.json for one project or ~/.cursor/mcp.json for all of them, per Cursor's MCP docs.

If you'd rather skip the npm registry, evergist.com serves the same package. Replace evergist with https://evergist.com/cli/evergist.tgz in any command above.

What are the four tools?

The server exposes tools only. It has no resources and no prompts.

Tool Parameters Returns Uses a view?
create_gist text (required), expires_in, max_views, password, generate_password url, id, expiresAt, maxViews, deleteToken, passwordProtected, and password when generated No
read_gist url (required), password text, id, expiresAt, viewsRemaining, burned Yes
gist_status url (required) expiresAt, maxViews, viewsRemaining, password, id No
delete_gist url with optional password, or id with delete_token deleted: true No

The parameters in detail:

  • text is UTF-8, up to 524,288 bytes (512 KiB).
  • expires_in takes 10m, 1h, 1d, 7d, 30d, or a number of seconds. The default is 1d. The allowed range is 1 minute to 30 days.
  • max_views is a whole number from 1 to 1000. Leave it out for no limit until expiry. Use 1 for burn after reading.
  • password adds a password on top of the link. generate_password: true makes a strong one and returns it.
  • url is always the full share link, including the part after #. That part is the key.

A credential handoff is one call:

{
  "name": "create_gist",
  "arguments": {
    "text": "DATABASE_URL=postgres://app:example@db.internal/app",
    "max_views": 1,
    "expires_in": "1h"
  }
}

gist_status carries a read-only hint and read_gist a destructive one, because a read can delete the note. A client that honors tool annotations can ask before spending the only view.

Does the MCP server see my secret in plaintext?

The local process does, because it does the encrypting. evergist.com doesn't. The server generates a 256-bit key, encrypts with AES-256-GCM, and uploads the ciphertext with token hashes. The key stays in the link after #, which never gets sent to us. How the encryption works covers the scheme and four ways to check it.

The agent sees the secret too, and this is the part most tool pages skip. text is a tool argument the model writes, so the value is already in the agent's context when it calls create_gist. read_gist returns the plaintext into that context.

When the value should stay out of the model's view, use the CLI from the same package and point it at a file:

# Share a file the agent never printed
npx -y evergist create .env --views 1 --expires 1h

# Receive into a file instead of the tool result
npx -y evergist read "https://evergist.com/g/<id>#<key>" > .env.local

Giving Claude Code an API key safely walks through the second command and its limits.

Hosted MCP and ChatGPT

A remote MCP tool that accepted plaintext would receive your text before encrypting it. Evergist's local MCP server encrypts on your machine. The ChatGPT plugin takes a different approach. Its hosted endpoint at https://evergist.com/mcp only opens an embedded browser editor, where users enter ordinary notes and encrypt them before upload. It does not accept plaintext or keys as tool arguments. Secret-sharing workflows remain in the local tools.

The cost is real. A client needs to be able to start a local process with Node.js. A client that accepts only remote MCP URLs can't use it.

Do I need an account or API key?

No. There is no signup, no token to put in the config, and no paid tier. The API takes ciphertext from anyone and rate limits by network. One network gets 10 creates per minute and 120 per hour, plus 120 reads and deletes per minute.

Notes hold text only, up to 512 KiB, for 30 days at most.

What other MCP servers share secrets?

Several exist, and you should compare them. We read one vendor's page closely enough to describe it.

Vaulted ships @vaulted/mcp-server, which also runs locally through npx. Its page says it uses AES-256-GCM with the key in the URL fragment, and lists four tools: create_secret, view_secret, check_status, and list_secrets. It also accepts input sources such as env:VAR_NAME, file:/path/to/key, and dotenv:.env.local:KEY, so the server reads the value and the model never sees it. Evergist's MCP server has no equivalent. For that case we point people to the CLI, as shown above.

MCP directories list more servers in this category. We haven't verified their claims, so we won't describe them here.

Whichever you pick, check four things:

  • Where encryption runs. A local stdio process can keep plaintext off the vendor's servers. A hosted endpoint receives it.
  • Whether the key ever reaches the vendor.
  • Whether a status check uses a view.
  • Whether the model has to hold the value to share it.

Questions

Yes. npx -y evergist mcp is one. Set max_views to 1 in create_gist and the first read deletes the note. Others exist, including Vaulted's.

What is the difference between an MCP server that stores secrets and one that shares them?

A storing server sits in front of a vault or secrets manager and hands the agent credentials it is allowed to use, again and again. A sharing server moves one piece of text from one party to another and then forgets it. Evergist is the second kind and is not a vault. One-time links vs a vault covers when each fits.

Yes. read_gist takes the full link and returns the decrypted text, and gist_status checks expiry and views left without using a view. No browser automation is involved. How AI agents can share secrets has the rules worth giving the agent.