Model Context Protocol
MCP for agents
Connect Cursor, Claude, or Inspector to LockL.ink. OAuth identifies the account; ciphertext stays opaque to our Worker.
Endpoint
https://lockl.ink/mcpStreamable HTTP. Unauthenticated calls return 401 with protected-resource metadata.
Server-blind by design
LockLink never sees secret plaintext on MCP paths. Tools accept or return ciphertext only. Decrypt keys stay with the client — not on our Worker.
OAuth scopes
links:writeCreate one-time LockLink secret links from already-encrypted payloads
requests:writeStart secret-request links that you finalize in the browser
requests:readList your secret requests and request one-time approved reveals
Tools
| Tool | Returns | Note |
|---|---|---|
| set_secret | { pathUrl } | Client-encrypted payload only; append #clientKey locally |
| create_secret_request | { setupId, setupUrl } | Finalize ECDH keys in the browser vault |
| get_secret_request_link | pending | { requestUrl } | Public /r/:requestKey when ready |
| list_secret_requests | metadata[] | No ciphertext or plaintext |
| request_secret | { pendingId, approvalUrl } | Requires recipientPublicKey from the client |
| get_requested_secret | pending | ECDH envelope | One-time ciphertext — never plaintext |