Use ProtectedShare from Claude
Ask Claude to turn a password, API key or .env file into a link that burns after reading, to request a secret from someone, or to check whether a link was opened. Add the remote connector in a minute, or run the server on your own machine so encryption happens there.
https://mcp.protectedshare.me/mcpWhat you can ask
Claude picks the tool. Tools that delete something ask you first.
- “Turn this API key into a link that works once.”create_secret_link
- “Share my .env with Sam. Two reads, gone in a week.”share_env_file
- “Ask Priya to send me the staging database password.”request_secret
- “Has the link I sent this morning been opened?”check_link_status
- “Revoke that link, I sent it to the wrong person.”revoke_link
- “Open the link Sam sent and put the values in .env.local.”open_secret_link (local)
Add it to Claude
claude.ai, Claude Desktop and Cowork. Works on every plan; the Free plan allows one custom connector.
Open your connectors
In Claude, go to Customize > Connectors, click + Add, then Add custom connector.
Name it and paste the URL
Call it ProtectedShare and use this URL, then click Continue.
https://mcp.protectedshare.me/mcpChoose No sign in
Under Authentication, pick No sign in and click Add. There is no account to connect.
Turn it on in a chat
Click + at the lower left of the chat box, open Connectors and switch ProtectedShare on.
On Team and Enterprise plans an owner adds it first, under Organization settings > Connectors (Add, Custom, Web). Members then find it in Customize > Connectors.
In Claude Code, one command adds the same server:
claude mcp add --transport http protectedshare https://mcp.protectedshare.me/mcpOther MCP clients can connect to the same URL: Streamable HTTP, no authentication.
Run it on your machine
Claude Code and Claude Desktop. Needs Node.js 20 or later.
The local server encrypts and opens links on your computer, so the text never reaches us unencrypted. It also adds passwords to links, opens links people send you, and checks passwords against known breaches.
Claude Code:
claude mcp add protectedshare -- npx -y protectedshare-mcpClaude Desktop: open Settings, then Developer, and choose Edit Config. Add this to claude_desktop_config.json and restart Claude.
{
"mcpServers": {
"protectedshare": {
"command": "npx",
"args": ["-y", "protectedshare-mcp"]
}
}
}Servers set up this way run in Claude Desktop and Claude Code. claude.ai and Cowork use the remote connector.
- PROTECTEDSHARE_API_URL
- Optional. The ProtectedShare instance to use, such as a self-hosted one. Default
https://protectedshare.me. Must be https, except for localhost. - PROTECTEDSHARE_HIBP_URL
- Optional. Where breach checks go. Default
https://api.pwnedpasswords.com.
Tools
Each tool tells Claude whether it only reads, creates a link, or deletes something.
| Tool | What it does | Effect | Where |
|---|---|---|---|
create_secret_link | Encrypts a password, key or note into a link that burns after one read by default. | Creates a link | Remote and local |
share_env_file | Encrypts a .env file or other credentials into an EnvShare link that opens 1 to 100 times. Up to 50,000 characters remotely, 200,000 locally. | Creates a link | Remote and local |
request_secret | Makes a link someone uses to send you a secret, and a private inbox link that opens their answer once. | Creates a link | Remote and local |
check_link_status | Shows whether a link was opened, how many reads are left and when it expires. Never returns the secret. | Read-only | Remote and local |
revoke_link | Deletes a link's encrypted content right away, so it no longer opens. | Deletes data | Remote and local |
generate_password | Makes a random password, passphrase or PIN and reports its entropy. | Read-only | Remote and local |
open_secret_link | Decrypts a note, EnvShare or inbox link on your computer. Uses up a read, so a burn-after-reading note is deleted. | Deletes data | Local only |
check_password_breach | Checks a password against Have I Been Pwned. Only 5 characters of its SHA-1 hash leave your computer. | Read-only | Local only |
Where your secret goes
The same encryption as the website. What changes is where it runs.
| Website | Remote connector | Local server | |
|---|---|---|---|
| Encrypted on | Your browser | ProtectedShare's MCP server (a Cloudflare Worker), in memory | Your computer |
| Plaintext travels to | Nowhere. It stays in your browser. | The MCP server, over TLS. It goes straight to our MCP server, a Cloudflare Worker; our web host never sees it. The Worker doesn't store or log it. | Nowhere. It stays on your computer. |
| ProtectedShare stores | Ciphertext, token hashes, expiry and read limits. Never the key or the plaintext. | The same | The same |
| Claude sees | Nothing | What you write and the link it gets back | What you write, the link, and anything a tool opens |
| Passwords on links | Yes | No, the key in the link only | Yes |
| Opens links | In the browser | No | Yes, decrypted on your computer |
The MCP server's logs hold request metadata such as the path, status code and timing, never tool arguments or results. The privacy policy covers what our hosts see.
How it works
Both servers use the code that runs in the website. A random 32-byte key goes in the link after the #, which is never sent to a server. HKDF-SHA256 turns it into an AES-256-GCM key and a separate token; the server keeps the ciphertext and a SHA-256 hash of that token, and hands the ciphertext only to a reader who presents it. Burned, used-up, revoked and expired links are deleted from the database.
Secret requests use ECDH P-256: the person answering encrypts in their browser to a public key whose private half is only in your inbox link. Every link a tool creates also gets a manage token, whose hash sits next to a receipt (opened or not, reads left, expiry). That is what lets Claude check or revoke a link later in the conversation.
The full design is on the security page, and the servers are in the GitHub repository.
Questions
Does Claude see my secret?
Yes. Anything you type or paste into a conversation is part of it, and so is the link a tool returns, which carries the key after the #. The connector protects the secret on its way to the recipient and on our servers. It can't take it back out of the conversation it was typed into.
What does the remote connector store?
Nothing. It encrypts the text in memory and sends only ciphertext to the same storage API the website uses. It doesn't log tool arguments or results. Requests to mcp.protectedshare.me go straight to that Worker on Cloudflare; our web host, Vercel, isn't in the path.
Why run the local server instead?
The text is encrypted on your computer, so it never reaches us unencrypted. You can also add a password to a link, and Claude can open links people send you. It needs Node.js 20 or later.
Do I need an account or an API key?
No. The connector works without signing in, and the local server has nothing to set up.
Will links made in Claude show up in My links?
No. My links lives in the browser that made a link. Each tool result includes a manage token instead: while it's in the conversation, Claude can use it to check whether the link was opened, or to revoke it.
Can Claude open a link someone sent me?
With the local server, yes. It decrypts the link on your computer and uses up a read, exactly like opening it in a browser. The remote connector can't open links.
Why can't the remote connector add a password?
A password is stretched with 600,000 rounds of PBKDF2. That takes more processing time than the connector gets per request, so it only makes links that open with the key in the link. The local server adds passwords on your computer.
Which MCP versions and clients does it work with?
The remote server speaks Streamable HTTP at https://mcp.protectedshare.me/mcp with no sign-in. It supports MCP 2026-07-28 and the earlier 2025-11-25, 2025-06-18 and 2025-03-26 revisions, so any MCP client that connects to remote servers can use it. The local server speaks the same versions over stdio.
Is it open source?
Yes. The connector and the local server are MIT licensed and live in the same GitHub repository as the website: apps/mcp, packages/mcp-core and packages/mcp-server.