Deaddrop

by jerrywrongalot-byte

274 downloads
Not rated
GitHub Website

About

MCP server: AI agents share self-destructing one-time secrets via DeadDrop - zero-knowledge, paid per call in USDC over x402 on Base

Details

Author
jerrywrongalot-byte
Downloads
274
Categories
Developer Tools, Security

- deaddrop_create_secret - encrypts the secret locally (AES-256-GCM)
- deaddrop_reveal_secret - consumes a one-time link and decrypts
- Use a dedicated key with a small USDC balance (a few dollars covers
- Payments are gasless for the payer (EIP-3009): the key needs USDC
- x402-fetch enforces a max-payment cap (default 0.10 USDC per call), so a

Setting up with Highlight

This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:

  1. Download and install Highlight from highlightai.com/download
  2. Navigate to the plugins tab and select "Add Custom Plugin"
  3. Configure the plugin with the settings below
    Plugin Name Deaddrop
    Command (node, npx, python, etc.)

    Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.

  4. Enable "Start Automatically" if you want the plugin to start when Highlight launches

From the repository

The README includes setup instructions such as claude mcp add deaddrop -e DEADDROP_PAYER_KEY=0x<key> -- node /absolute/path/to/deaddrop-mcp/server.mjs.

Claude Desktop / Cursor

Paste into your MCP client config file to install this server.

{
    "mcpServers": {
        "deaddrop": {
            "deaddrop": {
                "command": "node",
                "args": [
                    "/absolute/path/to/deaddrop-mcp/server.mjs"
                ],
                "env": {
                    "DEADDROP_PAYER_KEY": "0x<key>"
                }
            }
        }
    }
}

McpServers

{
    "deaddrop": {
        "command": "node",
        "args": [
            "/absolute/path/to/deaddrop-mcp/server.mjs"
        ],
        "env": {
            "DEADDROP_PAYER_KEY": "0x<key>"
        }
    }
}

deaddrop-mcp

MCP server that lets AI agents (Claude Code, Claude Desktop, anything
MCP-capable) share secrets through DeadDrop -
self-destructing one-time links, paid per call with USDC over
x402.

Two tools:

- deaddrop_create_secret - encrypts the secret locally (AES-256-GCM),
pays $0.01 in USDC via x402, returns a one-time link. The link works
exactly once, then the secret is destroyed.
- deaddrop_reveal_secret - consumes a one-time link and decrypts
locally. Free, no wallet needed.

Zero-knowledge end to end: the AES key is generated in this process and
travels only in the link fragment (#...); the payer wallet key also stays
here. The DeadDrop server only ever sees ciphertext and an x402 payment.

Install

git clone https://github.com/jerrywrongalot-byte/deaddrop-mcp
cd deaddrop-mcp
npm install

Configure

Claude Code:

claude mcp add deaddrop -e DEADDROP_PAYER_KEY=0x<key> -- node /absolute/path/to/deaddrop-mcp/server.mjs

Claude Desktop / any MCP client (.mcp.json / claude_desktop_config.json):

{
  "mcpServers": {
    "deaddrop": {
      "command": "node",
      "args": ["/absolute/path/to/deaddrop-mcp/server.mjs"],
      "env": { "DEADDROP_PAYER_KEY": "0x<key>" }
    }
  }
}

Environment

| Variable | Meaning |
|---|---|
| DEADDROP_PAYER_KEY | EVM private key holding USDC on Base. Needed only for CREATE (it pays $0.01/secret); reveal works without it. |
| DEADDROP_NETWORK | base (default) or base-sepolia for testing. |
| DEADDROP_BASE_URL | Override the service URL (defaults to the live service). |

Wallet safety (read this)

- Use a dedicated key with a small USDC balance (a few dollars covers
hundreds of secrets), not a main wallet. The key signs real payments.
- Payments are gasless for the payer (EIP-3009): the key needs USDC
only, no ETH.
- x402-fetch enforces a max-payment cap (default 0.10 USDC per call), so a
rogue or mistyped server URL cannot drain the key.
- The service never receives the key OR the plaintext - see the API's
agent-facing spec at
/llms.txt.

Example

> "Drop this API key for my coworker: sk-live-... - 1 day expiry"

The agent calls deaddrop_create_secret, pays a cent, and hands back
https://deaddrop.../s/<id>#<key>. First open reveals and destroys it;
link previewers can't burn it (reveal is an explicit action).

License

MIT

No reviews yet — be the first

Sign in to leave a review

Use Google, GitHub, or an email account so ratings stay tied to real people.

Email sign in

No reviews posted yet.