SEAL MCP (sealnet-mcp)

Install

npx -y sealnet-mcp

No setup: the first start creates the agent’s key

Register it with your MCP host, whether that is Claude Desktop, Claude Code, Cursor, Cline or anything MCP-compatible:

{
  "seal": {
    "command": "npx",
    "args": ["-y", "sealnet-mcp"]
  }
}

Production defaults are baked in (backend api.seal.net, links on seal.net), so no environment variables are needed. Self-hosted deployments set SEAL_MCP_BACKEND_URL and SEAL_MCP_PUBLIC_HOST.

Tools

Tool	Purpose
seal_share(path, mode?, expire?, to?, tier?)	Give the user or another agent a file or a folder: free up to 1 GB per seal, more after one payment. Default mode: the user’s inbox after seal_pair, handoff before it.
seal_request(what, kind?, where_url?, wait?, from?)	Ask the user for a file or a secret: a system dialog on their computer, a card in their inbox, or a seal.net page. Returns a file path, never the value.
seal_pair(name?, wait?)	Connect the agent to the user’s SEAL inbox, once: a seal.net page with three pictures the user compares with the chat. After it, seal_share sends to the inbox by default and seal_request can ask there.
seal_open(url|item, mode?, dir?)	Read metadata (the default: nothing downloaded, no counter used), save to disk (file), or return small text inline. Takes a link, or an inbox handle as item.
seal_inbox(wait?)	Seals other agents or people sent to this server’s address: handles and who sent them, never a link. wait waits up to 300 seconds for something new.
seal_run(command, secrets, cwd?, timeout?)	Run a program with secrets from links or inbox items in its environment, through the seal CLI: every value is replaced in the output that comes back. Not a sandbox: a program that prints a value transformed escapes the replacement.
seal_list()	List seals created by this MCP server only.
seal_revoke(handle)	Revoke by opaque handle. The model never learns the raw seal id.

Inbox, handoff, forward, request

Inbox (default after seal_pair): seal_pair connects the agent to the user’s SEAL inbox once: a seal.net page shows three pictures, the user compares them with the chat and connects. From then on seal_share sends every file to that inbox: the model gets a handle, never a link, and nothing is written to the clipboard or to a file. Every seal the server makes also appears in the inbox, where the user opens its page or revokes it. In a cloud session with no page to open, set SEAL_OWNER to the inbox address instead.

Handoff (default without an inbox): the share link goes to your system clipboard. On a machine without one (a container, a cloud session) it is written to a 0600 file and the tool result names that file. The key is inside the link, there is no separate password. The link is never written into the conversation, but an agent that can read files on that machine can read the file: in a cloud session, forward the file to another agent’s key, or reverse the direction with seal_request.

Forward (explicit opt-in): the model receives a link that only the holder of the given X25519 key can open (another agent prints its key with sealnet-mcp pubkey or seal keygen). Guard-railed: TTL ≤ 30 minutes, single read, recipient key required. Every forward is written to the encrypted audit log. The link also lands in the recipient’s inbox (seal_inbox, seal inbox), so it need not be passed on at all.

Request: the model asks you for a file or a secret with seal_request. On your computer a system dialog opens; elsewhere you get a seal.net page showing the same three emoji as the chat. The answer lands in a 0600 file, and the model gets its path, never the value.

Over 1 GB: a seal holds 1 GB for free. For a larger file seal_share returns a payment link for one tier (from $9); you pay once by card and the upload continues into the same seal.

State & subcommands

The agent’s key comes from SEAL_SEED, the OS keychain, or a 0600 seed file in your config directory (macOS ~/Library/Application Support/seal-mcp, Linux ~/.config/seal-mcp, Windows %APPDATA%\seal-mcp, or SEAL_MCP_CONFIG_DIR), in that order. State lives in state.json next to it, encrypted with a key derived from the agent’s key: seal handles with owner tokens, the connected inbox and the audit log.

sealnet-mcp serve              # default: stdio MCP server (what hosts run)
sealnet-mcp serve --ephemeral  # a new key each start, nothing on disk
sealnet-mcp init               # optional: create the key and state without serving
sealnet-mcp pubkey             # print the agent's address (X25519 public key)
sealnet-mcp seed --force       # print the agent's key, to set SEAL_SEED elsewhere
sealnet-mcp doctor             # diagnose key source / keychain / file perms / backend
sealnet-mcp reset --force      # wipe state and key: the address is gone for good

Several MCP hosts on one machine share the agent’s key and state. serve --ephemeral (or SEAL_MCP_EPHEMERAL=1) keeps nothing on disk and makes a new key each start. SEAL_MCP_PASSPHRASE is read only once, to move a state from version 0.2.