dazai — burn-after-reading secret (motokano) MCP server

ningen-shikkaku

Burn-after-reading secrets for AI agents.

ningen-shikkaku ships two small Rust binaries — dazai (the session-bound daemon) and motokano (a self-immolating one-shot MCP server).

Your MCP configs are full of plaintext API keys, and every agent you run can read all of them — and they keep working long after the agent is done. dazai inverts that: secrets live in locked, non-swappable RAM, are served to agents over MCP, and are destroyed after N reads — or the instant your session dies.

motokano --calls 1 --tool 'name=get_key,kind=static,value=s3cr3t' --arm

Point any MCP client at it and call getkey once** → you receive s3cr3t → the server wipes the value out of locked memory and SIGKILLs itself. Call again → the process is gone.

Install

# prebuilt binaries (macOS arm64/x86_64, Linux x86_64/arm64)
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/New1Direction/ningen-shikkaku/releases/latest/download/dazai-installer.sh | sh

# or homebrew
brew install New1Direction/tap/dazai New1Direction/tap/motokano

# or from source (required for the Linux seccomp build)
git clone https://github.com/New1Direction/ningen-shikkaku
cd ningen-shikkaku/rs
cargo build --release                       # -> target/release/{dazai, motokano}
cargo build --release --features seccomp    # Linux: seccomp syscall allowlist

Prebuilt binaries are built with default features; the seccomp-confined daemon is a from-source build (it links libseccomp — install libseccomp-dev + pkg-config first).

Use it with Claude Code

# a one-shot secret an agent can read exactly once:
claude mcp add burn-once -- motokano --calls 1 --arm \
  --tool 'name=get_key,kind=static,value=YOUR-SECRET'

# or the session-bound daemon: agents register their PID and get SIGKILLed
# the moment your session dies
dazai daemon --arm --grace 5 &
claude mcp add dazai -- dazai mcp

Any MCP client works the same way — the transport is plain stdio.

And the second act: a dead-man's switch for your agents

The same daemon is a session kill-switch. Any MCP client registers its PID; when your shell/SSH session dies, your heartbeat stops, or a panic signal arrives, dazai SIGKILLs every registered process, overwrites its secrets with a wipe the compiler can't optimize away, and exits. Walk away: agents die, secrets burn.

dazai daemon --ping-timeout 15        # terminal A  (dry-run by default; --arm makes it real)
dazai client --interval 5             # terminal B
# close terminal B  ->  the daemon wipes its secrets and exits

It runs only on your own machine, on your own secrets and your own configured tools. It never touches another process, file, or host.

What's in the box

It ships in two layers:

madvise(MADVDONTDUMP) + prctl(PRSETDUMPABLE, 0) (no core dumps / no ptrace), a seccomp syscall allowlist (no execve/open/connect/…), and a non-elidable explicitbzero / memset_s wipe; and

• a hardened Rust daemon + tooling — the real thing: mlock (no swap),

established the mechanism (see python-reference.md).

• a Python reference implementation — the original proof-of-concept that

Shortened. The full README is on GitHub.