SEAL MCP (sealnet-mcp)

Install

npx -y sealnet-mcp

No setup: the first start creates its own identity

Register it with your MCP host, whether that is Claude Desktop, Claude Code, Cursor, Cline or anything MCP-compatible:

{
  "seal": {
    "command": "npx",
    "args": ["-y", "sealnet-mcp"]
  }
}

Production defaults are baked in (backend api.seal.net, links on seal.net), so no environment variables are needed. Self-hosted deployments set SEAL_MCP_BACKEND_URL and SEAL_MCP_PUBLIC_HOST.

Tools

Tool	Purpose
seal_share(path, mode?, expire?, to?, tier?)	Give the user or another agent a file or a folder of any size. Default mode: handoff.
seal_request(what, kind?, where_url?, wait?)	Ask the user for a file or a secret: a system dialog on their computer, or a seal.net page. Returns a file path, never the value.
seal_open(url, mode?, dir?)	Read metadata (the default: nothing downloaded, no counter used), save to disk (file), or return small text inline.
seal_list()	List seals created by this MCP server only.
seal_revoke(handle)	Revoke by opaque handle. The model never learns the raw seal id.

Handoff, forward, request

Handoff (default): the share link is delivered to you via the system clipboard (or a 0600 local file on headless machines); the key is inside the link, there is no separate password. The tool result the model sees contains only an opaque handle and a receipt, so it cannot exfiltrate a link it never received.

Forward (explicit opt-in): the model receives a link that only the holder of the given X25519 key can open (another agent prints its key with sealnet-mcp pubkey or seal keygen). Guard-railed: TTL ≤ 30 minutes, single read, recipient key required. Every forward is written to the encrypted audit log.

Request: the model asks you for a file or a secret with seal_request. On your computer a system dialog opens; elsewhere you get a seal.net page showing the same three emoji as the chat. The answer lands in a 0600 file, and the model gets its path, never the value.

Over 1 GB: a seal holds 1 GB for free. For a larger file seal_share returns a payment link for one tier (from $9); you pay once by card and the upload continues into the same seal.

State & subcommands

All state lives encrypted (Argon2id → AES-256-GCM) at ~/.config/seal-mcp/state.json: your X25519 identity, seal handles with owner tokens, and the audit log.

sealnet-mcp serve              # default — stdio MCP server (what hosts run)
sealnet-mcp serve --ephemeral  # keep nothing on disk
sealnet-mcp init               # optional: set it up with a passphrase you choose
sealnet-mcp pubkey             # print this server's X25519 public key
sealnet-mcp doctor             # diagnose keychain / state perms / backend reachability
sealnet-mcp reset --force      # wipe state + keychain entry

No keychain (a container, CI): the server runs ephemeral, handles live until it restarts, and seal expiry does not depend on it. SEAL_MCP_PASSPHRASE keeps the state on disk instead, an explicit opt-in that logs a warning. Cleartext passphrase files are refused by design.