Deaddrop
About
MCP server: AI agents share self-destructing one-time secrets via DeadDrop - zero-knowledge, paid per call in USDC over x402 on Base
Details
- Author
- jerrywrongalot-byte
- Downloads
- 274
- Categories
- Developer Tools, Security
Jump to
- deaddrop_create_secret - encrypts the secret locally (AES-256-GCM)
- deaddrop_reveal_secret - consumes a one-time link and decrypts
- Use a dedicated key with a small USDC balance (a few dollars covers
- Payments are gasless for the payer (EIP-3009): the key needs USDC
- x402-fetch enforces a max-payment cap (default 0.10 USDC per call), so a
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
DeaddropCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
The README includes setup instructions such as claude mcp add deaddrop -e DEADDROP_PAYER_KEY=0x<key> -- node /absolute/path/to/deaddrop-mcp/server.mjs.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"deaddrop": {
"deaddrop": {
"command": "node",
"args": [
"/absolute/path/to/deaddrop-mcp/server.mjs"
],
"env": {
"DEADDROP_PAYER_KEY": "0x<key>"
}
}
}
}
}
McpServers
{
"deaddrop": {
"command": "node",
"args": [
"/absolute/path/to/deaddrop-mcp/server.mjs"
],
"env": {
"DEADDROP_PAYER_KEY": "0x<key>"
}
}
}
deaddrop-mcp
MCP server that lets AI agents (Claude Code, Claude Desktop, anything
MCP-capable) share secrets through DeadDrop -
self-destructing one-time links, paid per call with USDC over
x402.
Two tools:
- deaddrop_create_secret - encrypts the secret locally (AES-256-GCM),
pays $0.01 in USDC via x402, returns a one-time link. The link works
exactly once, then the secret is destroyed.
- deaddrop_reveal_secret - consumes a one-time link and decrypts
locally. Free, no wallet needed.
Zero-knowledge end to end: the AES key is generated in this process and
travels only in the link fragment (#...); the payer wallet key also stays
here. The DeadDrop server only ever sees ciphertext and an x402 payment.
Install
git clone https://github.com/jerrywrongalot-byte/deaddrop-mcp
cd deaddrop-mcp
npm install
Configure
Claude Code:
claude mcp add deaddrop -e DEADDROP_PAYER_KEY=0x<key> -- node /absolute/path/to/deaddrop-mcp/server.mjs
Claude Desktop / any MCP client (.mcp.json / claude_desktop_config.json):
{
"mcpServers": {
"deaddrop": {
"command": "node",
"args": ["/absolute/path/to/deaddrop-mcp/server.mjs"],
"env": { "DEADDROP_PAYER_KEY": "0x<key>" }
}
}
}
Environment
| Variable | Meaning |
|---|---|
| DEADDROP_PAYER_KEY | EVM private key holding USDC on Base. Needed only for CREATE (it pays $0.01/secret); reveal works without it. |
| DEADDROP_NETWORK | base (default) or base-sepolia for testing. |
| DEADDROP_BASE_URL | Override the service URL (defaults to the live service). |
Wallet safety (read this)
- Use a dedicated key with a small USDC balance (a few dollars covers
hundreds of secrets), not a main wallet. The key signs real payments.
- Payments are gasless for the payer (EIP-3009): the key needs USDC
only, no ETH.
- x402-fetch enforces a max-payment cap (default 0.10 USDC per call), so a
rogue or mistyped server URL cannot drain the key.
- The service never receives the key OR the plaintext - see the API's
agent-facing spec at
/llms.txt.
Example
> "Drop this API key for my coworker: sk-live-... - 1 day expiry"
The agent calls deaddrop_create_secret, pays a cent, and hands back
https://deaddrop.../s/<id>#<key>. First open reveals and destroys it;
link previewers can't burn it (reveal is an explicit action).
License
MIT
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.





