{
  "markdown": "# @slidingbox/hydrate-dehydrate-mcp\n\nAn MCP server for handing a secret from one agent, machine, or person to another\nwithout leaving a copy behind.\n\n`store_secret` encrypts on your machine and returns one token. Whoever holds the\ntoken gets the secret exactly once — the first successful read delivers it and\ndestroys it, and a second read returns nothing. Slidingbox stores only\nciphertext: the key travels in the token and is never sent to the server.\n\n```\nstore_secret(\"sk-live-...\")  ->  sb_PApm-Ui...#0zgYgq2d...\n                                 ^ pointer, on the server   ^ key, never sent\n\nretrieve_secret(\"sb_PApm-Ui...#0zgYgq2d...\")  ->  sk-live-...   (and it's gone)\n```\n\n## Install\n\n```json\n{\n  \"mcpServers\": {\n    \"hydrate-dehydrate\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@slidingbox/hydrate-dehydrate-mcp\"],\n      \"env\": { \"SLIDINGBOX_API_KEY\": \"sbk_...\" }\n    }\n  }\n}\n```\n\nThat block goes in your MCP client's config — `claude_desktop_config.json` for\nClaude Desktop, or `claude mcp add` for Claude Code.\n\n## Paying for reads\n\nStoring is free. Reading costs $0.02, and there are two ways to cover it:\n\n| Variable | What it does |\n| --- | --- |\n| `SLIDINGBOX_API_KEY` | An evaluation key (`sbk_<id>.<hmac>`). Covers a fixed number of reads for free. Get one instantly: `curl -X POST https://slidingbox.ai/v1/key` — no account, no email. |\n| `SLIDINGBOX_PRIVATE_KEY` | A Base wallet holding USDC. Reads are paid per call over [x402](https://x402.org) — no account, no invoice, no subscription. |\n| `SLIDINGBOX_URL` | Defaults to `https://slidingbox.ai`. |\n| `SLIDINGBOX_NETWORK` | Defaults to `eip155:8453` (Base mainnet). |\n\nWith neither set, `store_secret` still works and `retrieve_secret` tells you\nwhich one to configure. `SLIDINGBOX_PRIVATE_KEY` signs payments: give it a\nwallet funded for this purpose and nothing else.\n\n## What it is good for\n\n- Passing a credential between two agents that share no store and no account.\n- Sending a secret through a channel you would rather it not persist in — the\n  token in the chat log is inert the moment it is read.\n- Proving a handoff happened once. A replayed token fails visibly instead of\n  quietly serving a second copy.\n\n## What it is not\n\nNot storage, backup, messaging, or key management. Secrets live 60–900 seconds\nand then expire. Not for protected health information or payment-card data.\n\n## How it works\n\nEncryption is AES-256-GCM, done in this process before anything is sent. The\nserver receives `{ciphertext, iv}` and a time-to-live, and returns an opaque\npointer. That is the whole reason this is a local stdio server rather than a\nroute on the API: a remote MCP server would have to receive your plaintext in\norder to encrypt it.\n\nPayment, when a wallet is configured, is x402 — the read returns `402`, the\nclient signs an EIP-3009 authorization for $0.02 USDC, and retries. Paying\nwallets are screened against the OFAC SDN list before settlement; see\n<https://slidingbox.ai/compliance>.\n\n- API: <https://slidingbox.ai/developers>\n- Agent-readable: <https://slidingbox.ai/llms.txt>, <https://slidingbox.ai/.well-known/slidingbox.json>\n\n## Development\n\n```bash\nnpm install\nnpm test        # offline: crypto round-trip and token parsing\nnode server.mjs # speaks MCP over stdio\n```\n\n## If this stops working\n\nSlidingbox is a small product and may be retired. This server is built to say so\nrather than fail opaquely: a retired service answers `410`, and a domain that no\nlonger resolves is reported as a retirement, not as a stack trace. Nothing you\nstore is ever held longer than 900 seconds, so a shutdown cannot strand data.\n\nISC © SLIDINGBOX LLC\n",
  "bytes": 3638,
  "sha": "47695099a0afa1a85ac97b1aee813ae415be77e1831967cfa70e29a009b33140",
  "repo_slug": "slidingbox/hydrate-dehydrate-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_ai_slidingbox_hydrate_dehydrate_d93fc179/readme"
}