Run the MCP server on your machine. Create a link, give it to the recipient, then check whether it opened or cancel it.
claude mcp add x-tkn -e X_TKN_API_KEY=your-key -- npx -y @fennecstudio/x-tkn-mcpYou need Node 20 or later. Sign up at x-tkn.com and create a free Developer API key in the account console. Replace your-key with that key. Sandbox keys cannot create secrets.
The command registers the local stdio server with Claude Code. Other MCP clients take the configuration below. Without a key the server starts, but each tool call tells you how to get one.
{
"mcpServers": {
"x-tkn": {
"command": "npx",
"args": [
"-y",
"@fennecstudio/x-tkn-mcp"
],
"env": {
"X_TKN_API_KEY": "your-key"
}
}
}
}{
"secret": "example-credential-for-this-guide",
"expiresIn": {
"hours": 1
}
}Ask your agent to call create_secret with these arguments, using the credential you intend to hand over. The value above is only an example. The server encrypts the secret on your machine with AES-256-GCM before sending anything. X-TKN stores ciphertext; the key travels after the # in the returned link, which browsers never send to a server.
Keep the returned link, code and expiresAt. The link is for the recipient. The code is for check_status and revoke_secret. If you omit expiresIn, expiry defaults to 7 days on Developer or 30 days on Team.
An optional note is stored unencrypted for your own records and never shown to the recipient. Do not put the secret in it. Team and Enterprise can require a passphrase of 8 to 256 characters or a 6-digit code sent to recipientEmail. Set one recipient check, not both. Send a passphrase by a different channel than the link.
Give the full link, including its #fragment, only to the person it is for. Opening it uses it up, so do not open it yourself to test it. The recipient opens the link in their browser and completes any recipient check you set.
After successful decryption the retrieval page removes the key from the address bar. If opening fails, the full link, key included, stays in that browser’s history.
{
"code": "code-returned-by-create_secret"
}Use the code create_secret returned. The status is waiting, opened, expired or revoked. Once it has opened, openedAt tells you when. Checking status does not consume the link and never returns the secret. An opened link no longer works.
{
"code": "code-returned-by-create_secret"
}For the same handoff, pass the same code to revoke_secret if the link is still waiting and the recipient no longer needs it. Revocation stops it working immediately and permanently.
If check_status says opened, the recipient already has the secret. Revoking it cannot take that back, and its status stays opened.
The server exposes only create_secret, check_status and revoke_secret. There is no read_secret tool. The agent creates the handoff; the recipient consumes it. Status and revocation return metadata, never the secret.
This limits what the agent can retrieve through these tools after creation. The agent handles the plaintext when it creates the link, and the full link contains the key. Anyone holding that link can open it.
The server runs locally over stdio because a hosted MCP server would receive the plaintext before encrypting it. X-TKN receives ciphertext, expiry, your unencrypted note and, if you set a recipient check, a passphrase hash or the recipient’s email address. The passphrase gates the link; it is not the encryption key.
The free Developer plan accepts up to 64 KB per secret. Team and Enterprise accept up to 256 KB. This fits a certificate bundle or a .env file as well as a password.
Use the local MCP server for these three tools, or call the API directly.