X Tkn MCP runs on your own machine — the client starts it, so there is no endpoint to ping. 234 installs a week from npm.
Lets an AI agent hand a secret to a person as a one-time link, with no way to read it back.
Today is the operative word: we check X Tkn MCP every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.
This server runs on your own machine — install it with the package manager and the client starts it for you. Package name taken from the official registry entry.
claude mcp add x-tkn-mcp -- npx -y @fennecstudio/x-tkn-mcp
{
"mcpServers": {
"x-tkn-mcp": {
"command": "npx",
"args": [
"-y",
"@fennecstudio/x-tkn-mcp"
]
}
}
}
[mcp_servers.x-tkn-mcp]
command = "npx"
args = ["-y", "@fennecstudio/x-tkn-mcp"]
{
"mcpServers": {
"x-tkn-mcp": {
"command": "npx",
"args": [
"-y",
"@fennecstudio/x-tkn-mcp"
]
}
}
}
{
"servers": {
"x-tkn-mcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@fennecstudio/x-tkn-mcp"
]
}
}
}
Optional settings from the registry entry, left out of the block above:
X_TKN_API_KEY (Your X-TKN API key. Optional: without one, the first tool call starts a sandbox that lasts 24 hours, as does every secret it creates, and saves its key in $XDG_CONFIG_HOME/x-tkn/sandbox.json (~/.config/x-tkn/ by default) for the next start to reuse. Developer keys are free and stay: create one in the account console at x-tkn.com. Either this or X_TKN_API_KEY_ID is read, this one first), X_TKN_API_KEY_ID (Read when X_TKN_API_KEY is not set. Holds the same API key).
Lets an AI agent hand a secret to a person as a one-time link, with no way to read it back.
Agent bridge. Host-readable; anyone with the link can read and reply. Not for secrets.
Send and read one-time encrypted secrets with local encryption.
Send a file to a person as a one-time, encrypted, auto-deleting download link.
Let AI agents use secrets without seeing them: inject into a command, redact the output.
Find and redact leaked secrets, wallet keys and PII before an AI agent sends text.
Serve a secret to an agent exactly N times from locked RAM, then wipe it and self-destruct.
Keychain-backed secret broker: an AI agent can use your keys, but no tool ever returns one.
Answers built from our own checks of this server.