LinkPilot MCP server

LinkPilot MCP server

Give an AI assistant a safe way to hand someone a credential.

LinkPilot secret links open once and then destroy themselves, and the text is encrypted before it leaves this process. This is an MCP server that exposes them as tools, alongside short links.

npx -y @uselinkpilot/mcp

The problem it solves

Assistants hand people credentials constantly: a generated password, an API key, a database connection string. Every ordinary way of delivering one is bad. Pasted into chat, it lives in the history. Emailed, it lives forever. Dropped in a ticket, it is indexed.

createsecretlink returns a URL that works exactly once:

Here is the database password: https://shrd.link/s/p8mcaiitig#k=0hoNIO96aDJFoLsxaYPsP3FeqUjb6tw5lnSTcxkO0

It opens once and then it is gone.

Read this before you install it

The plaintext passes through the assistant's context. For the model to create the secret, it has to see the secret.

This server protects the credential in transit, at rest, and over time — it is encrypted before it is sent, LinkPilot cannot read it, and it survives a single view. It does not hide the value from the model that is calling the tool, and nothing built this way could.

So: use it to deliver a credential the assistant is already handling — one it just generated, or one you have pasted in deliberately. If a secret must never be seen by the assistant at all, create it yourself at uselinkpilot.com or with the linkpilot CLI instead.

A security tool that oversells itself is worse than no tool, so that is stated up front rather than in a footnote.

What the encryption actually means

The API will not accept a plaintext secret. POST /secrets takes ciphertext and an enc_version, and rejects a payload field outright.

Encryption happens in this process, via @uselinkpilot/sdk: AES-GCM-256, with the key generated locally. The key travels in the URL's # fragment, which browsers never send to a server. LinkPilot stores a blob it holds no key for, and so cannot read it — nor can anyone who reaches its database or its edge.

The corollary is not a caveat, it is the guarantee working: there is no recovery. Lose the share URL and the secret is gone, including to us.

Setup

Create an API key at uselinkpilot.com/app/api-keys. Keys begin with lplive. API access is available on every plan, including Free.

Claude Code

claude mcp add linkpilot --env LINKPILOT_API_KEY=lp_live_your_key -- npx -y @uselinkpilot/mcp

Claude Desktop, and other MCP clients

In claudedesktopconfig.json (or your client's equivalent):

{
  "mcpServers": {
    "linkpilot": {
      "command": "npx",
      "args": ["-y", "@uselinkpilot/mcp"],
      "env": { "LINKPILOT_API_KEY": "lp_live_your_key" }
    }
  }
}

The key is read from the environment only. It is never written to disk by this server, and never echoed — not in a log line, not in an error, not truncated.

Tools

list_secrets cannot return a secret's contents. No API route can — there is no route that returns a payload or a key, which is what makes the guarantee above structural rather than a promise.

Shortened. The full README is on GitHub.