Server data from the Official MCP Registry
Hand a secret to another agent as an encrypted, pay-per-read token, delivered exactly once.
About
Hand a secret to another agent as an encrypted, pay-per-read token, delivered exactly once.
Security Report
Valid MCP server (3 strong, 3 medium validity signals). 1 known CVE in dependencies (0 critical, 1 high severity) Package registry verified. Imported from the Official MCP Registry.
5 files analyzed · 2 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
Permissions Required
This plugin requests these system permissions. Most are normal for its category.
What You'll Need
Set these up before or after installing:
Environment variable: SLIDINGBOX_API_KEY
Environment variable: SLIDINGBOX_PRIVATE_KEY
Environment variable: SLIDINGBOX_URL
Environment variable: SLIDINGBOX_NETWORK
How to Install
Add this to your MCP configuration file:
{
"mcpServers": {
"ai-slidingbox-hydrate-dehydrate": {
"env": {
"SLIDINGBOX_URL": "your-slidingbox-url-here",
"SLIDINGBOX_API_KEY": "your-slidingbox-api-key-here",
"SLIDINGBOX_NETWORK": "your-slidingbox-network-here",
"SLIDINGBOX_PRIVATE_KEY": "your-slidingbox-private-key-here"
},
"args": [
"-y",
"@slidingbox/hydrate-dehydrate-mcp"
],
"command": "npx"
}
}
}Documentation
View on GitHubFrom the project's GitHub README.
@slidingbox/hydrate-dehydrate-mcp
An MCP server for handing a secret from one agent, machine, or person to another without leaving a copy behind.
store_secret encrypts on your machine and returns one token. Whoever holds the
token gets the secret exactly once — the first successful read delivers it and
destroys it, and a second read returns nothing. Slidingbox stores only
ciphertext: the key travels in the token and is never sent to the server.
store_secret("sk-live-...") -> sb_PApm-Ui...#0zgYgq2d...
^ pointer, on the server ^ key, never sent
retrieve_secret("sb_PApm-Ui...#0zgYgq2d...") -> sk-live-... (and it's gone)
Install
{
"mcpServers": {
"hydrate-dehydrate": {
"command": "npx",
"args": ["-y", "@slidingbox/hydrate-dehydrate-mcp"],
"env": { "SLIDINGBOX_API_KEY": "sbk_..." }
}
}
}
That block goes in your MCP client's config — claude_desktop_config.json for
Claude Desktop, or claude mcp add for Claude Code.
Paying for reads
Storing is free. Reading costs $0.02, and there are two ways to cover it:
| Variable | What it does |
|---|---|
SLIDINGBOX_API_KEY | An issued evaluation key (sbk_<id>.<hmac>). Covers a fixed number of reads for free. Ask support@slidingbox.ai. |
SLIDINGBOX_PRIVATE_KEY | A Base wallet holding USDC. Reads are paid per call over x402 — no account, no invoice, no subscription. |
SLIDINGBOX_URL | Defaults to https://slidingbox.ai. |
SLIDINGBOX_NETWORK | Defaults to eip155:8453 (Base mainnet). |
With neither set, store_secret still works and retrieve_secret tells you
which one to configure. SLIDINGBOX_PRIVATE_KEY signs payments: give it a
wallet funded for this purpose and nothing else.
What it is good for
- Passing a credential between two agents that share no store and no account.
- Sending a secret through a channel you would rather it not persist in — the token in the chat log is inert the moment it is read.
- Proving a handoff happened once. A replayed token fails visibly instead of quietly serving a second copy.
What it is not
Not storage, backup, messaging, or key management. Secrets live 60–900 seconds and then expire. Not for protected health information or payment-card data.
How it works
Encryption is AES-256-GCM, done in this process before anything is sent. The
server receives {ciphertext, iv} and a time-to-live, and returns an opaque
pointer. That is the whole reason this is a local stdio server rather than a
route on the API: a remote MCP server would have to receive your plaintext in
order to encrypt it.
Payment, when a wallet is configured, is x402 — the read returns 402, the
client signs an EIP-3009 authorization for $0.02 USDC, and retries. Paying
wallets are screened against the OFAC SDN list before settlement; see
https://slidingbox.ai/compliance.
- API: https://slidingbox.ai/developers
- Agent-readable: https://slidingbox.ai/llms.txt, https://slidingbox.ai/.well-known/slidingbox.json
Development
npm install
npm test # offline: crypto round-trip and token parsing
node server.mjs # speaks MCP over stdio
If this stops working
Slidingbox is a small product and may be retired. This server is built to say so
rather than fail opaquely: a retired service answers 410, and a domain that no
longer resolves is reported as a retirement, not as a stack trace. Nothing you
store is ever held longer than 900 seconds, so a shutdown cannot strand data.
ISC © SLIDINGBOX LLC
Reviews
No reviews yet
Be the first to review this server!
More Developer Tools MCP Servers
Fetch
Freeby Modelcontextprotocol · Developer Tools
Web content fetching and conversion for efficient LLM usage
Git
Freeby Modelcontextprotocol · Developer Tools
Read, search, and manipulate Git repositories programmatically
Toleno
Freeby Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
mcp-creator-python
Freeby mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
MCP Marketplace
Freeby mcp-marketplace · Developer Tools
Search and install MCP servers from inside your AI client.
MarkItDown
Freeby Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption