MCP Server

Agents speak quantum-safe.

Six tools, one stdio server. Encrypt files, send PQ-safe messages, read Quantum Seals, and sign x402 payloads — all from Claude, Cursor, or any MCP-aware client.

Install

Node.js 18 or later runs the server over stdio. Published as elyshield-mcp on npm.

$ npx -y elyshield-mcp

PACKAGE: elyshield-mcp
VERSION: 0.1.4
TRANSPORT: stdio
RUNTIME: Node.js 18+
TOOLS: 6
LICENSE: MIT

View on npm Source

Claude Code

Terminal

claude mcp add elyshield -- npx -y elyshield-mcp

One line adds the server to Claude Code over stdio.

Claude Desktop

claude_desktop_config.json

{
  "mcpServers": {
    "elyshield": {
      "command": "npx",
      "args": ["-y", "elyshield-mcp"]
    }
  }
}

Drop this snippet into your config and restart the client.

Cursor

~/.cursor/mcp.json

{
  "mcpServers": {
    "elyshield": {
      "command": "npx",
      "args": ["-y", "elyshield-mcp"]
    }
  }
}

Same shape, same server.

Any MCP client

stdio command

command: npx
args: -y elyshield-mcp

Works with any client that speaks Model Context Protocol over stdio.

Tools

Six primitives.

TOOL	DESCRIPTION	INPUTS	OUTPUTS
elyshield_encrypt_file	Encrypt bytes under hybrid ML-KEM-768 + X25519 and sign the envelope with ML-DSA-65 (ElyShield .elyshield container). Sign with a keyfile, a wallet signature, or a fresh ephemeral identity.	data_base64, filename, keyfile_json?, passphrase?, signature_hex?, signature_hex_repeat?, address?	container_b64url
elyshield_decrypt_file	Decrypt an ElyShield .elyshield container (base64url). Verifies the ML-DSA-65 signature and returns the original file bytes and filename.	container_b64url, keyfile_json?, passphrase?, signature_hex?, signature_hex_repeat?, address?	filename, original_size, data_b64
elyshield_send_message	Wrap a short plaintext (max 64KB) into a shareable encrypted ElyShield message URL. The ciphertext lives in the URL #fragment. With an ephemeral sender the secret key is embedded so the recipient can decrypt without setup.	text, keyfile_json?, passphrase?, signature_hex?, signature_hex_repeat?, address?	url, embed_secret_key
elyshield_decrypt_message	Read an ElyShield encrypted message URL (like the /m page does). Returns the plaintext and the signer key that sealed it.	url, keyfile_json?, passphrase?, signature_hex?, signature_hex_repeat?, address?	text, signer_mlkem, signer_x25519, signer_mldsa
elyshield_verify_seal	Parse the metadata fields an ElyShield Quantum Seal PNG carries (unsigned) and, given an envelope, compare its sha256 against file_hash.	seal_metadata_json, envelope_sha256?	fields, hash_matches_envelope
elyshield_sign_x402	Sign an x402 payment payload with ML-DSA-65 under context elyshield-v1-x402. Returns the signature (base64url) the server can verify with the provided public key.	payload_base64, keyfile_json?, passphrase?, signature_hex?, signature_hex_repeat?, address?	signature_b64url, public_key_mldsa_b64url, verified

Every tool runs locally over stdio. No network I/O, no telemetry. Keyfiles are unwrapped in-process with Argon2id and never persisted. A wallet signature is root key material: pass it over local stdio only, never a networked transport.

One identity, two doors.

Same envelope everywhere

Seal a file in /app, open it in your agent with the same keyfile or wallet signature. Identical keys, identical .elyshield format.

Public key can be derived from the signature

elyshield_sign_x402 returns public_key_mldsa_b64url alongside the signature, so a verifier can check which key signed without a separate exchange.

Runs on your machine

A local stdio server. No ElyShield server, no network calls, no telemetry.

What it does not do

No key management. Lose the keyfile or the passphrase and the data is gone. There is no recovery path and no backdoor.
No metadata protection. Filenames are encrypted, but container size reveals the approximate plaintext size.
Not independently audited. The primitives are from audited libraries, but this release has not been through a third-party security review.

Read the agent guide →