@sealedspace/mcp — SealedSpace MCP server for Claude Code

Plan projects in chat and apply them to your SealedSpace Tracker, then pick issues and work on them — with the zero-knowledge model intact. This is a headless crypto client: tracker content is encrypted/decrypted locally under delegated Space Keys; the SealedSpace server only ever sees ciphertext.

Setup

# 1. Link this machine (one-time ceremony):
npx @sealedspace/mcp link
#    → enter the code at app.sealedspace.com/link-agent,
#      VERIFY THE FOUR-WORD FINGERPRINT matches, pick spaces, approve.

# 2. Add to Claude Code:
claude mcp add sealedspace -- npx -y @sealedspace/mcp

Local dev: npx @sealedspace/mcp link --api http://localhost:3000 --app http://localhost:5173.

Use

• /sealedspace:plan — discuss requirements; Claude drafts epics → stories → tasks, shows you the full tree (validate_plan), and applies it only after your confirmation (apply_plan). Re-applying an identical plan is idempotent.
• /sealedspace:work NUC-42 — Claude reads the issue, moves it to In Progress, does the work, and asks before marking it Done.
• Tools: status, list_boards, list_issues, get_issue, list_my_issues, create_issue, update_issue, move_issue, validate_plan, apply_plan.

Security model (read this)

• What the server learns: nothing new. Keys are wrapped to this agent's public key by your own client at approval; credentials are stored hashed; scope enforcement is default-deny server-side (tracker routes in granted spaces only). See packages/crypto/THREAT_MODEL.md (agent delegation).
• What leaves the E2E boundary — by design: content from granted spaces is decrypted for Claude. It enters Claude Code transcripts on this machine and is processed by Anthropic according to your Claude settings.
• ~/.sealedspace/mcp.json is a credential (0600): together with its key it grants scoped access until revoked — treat like a logged-in device. Revoke anytime in SealedSpace → Settings → Connected agents (takes effect immediately).
• Issue content is third-party input. Descriptions are authored by other space members and are delivered to Claude wrapped in untrusted-content markers; Claude is instructed to treat them as data, not instructions. There are deliberately no delete or bulk tools.
• Pin the version when installing (npx @sealedspace/[email protected]) if you want protection against npm supply-chain surprises.

Verify it yourself

The crypto this package uses is the public auditable core (github.com/sealedspace/crypto-core). The decrypt-proof on link verifies the server delivered the real Space Keys — a substituted key fails loudly before anything is written.