putervision Cryptographic Memory & Vault Tooling (webcrypt-mcp)
This project provides webcrypt-mcp, a native Model Context Protocol server for zero-dependency AES-256-GCM encryption, RSA-4096 hybrid public-key encryption, digital signatures, cryptographic hashes, and post-quantum cryptography.
1. Mandatory Workflow & Priority
- Confidential Artifacts: Whenever saving sensitive credentials, tokens, or private workflow states, encrypt them using
encrypt_payload(mode: "data", password: "...")orencrypt_payload(mode: "symmetric", password: "..."). - Key Management: Use
manage_keys(action: "generate", type: "rsa" | "ecdh" | "hmac")to generate cryptographically strong JWK-formatted keys for inter-agent communication. - Integrity & Signatures: Before completing tasks that produce verifiable evidence (such as evidence packs or release binaries), compute signatures or HMAC tags using
sign_verify(action: "sign", algorithm: "ECDSA" | "HMAC"). - Triple Memory Triad:
state-memory-mcp: Workflow state tracking.vision-memory-mcp: Visual state caching.webcrypt-mcp: Encryption of sensitive DAG nodes, visual cache database vaults, and signature verification.
2. Complete Tool Reference
| Tool Name | Key Inputs | Description |
|---|---|---|
encrypt_payload |
mode ('symmetric' | 'asymmetric' | 'data'), data, password?, public_key_jwk? |
Encrypt plaintext, JSON object, or binary data. |
decrypt_payload |
mode ('symmetric' | 'asymmetric' | 'data'), ciphertext, password?, private_key_jwk? |
Decrypt ciphertext back to plaintext or structured JSON. |
manage_keys |
action ('generate' | 'generate_random_password'), type ('rsa' | 'ecdh' | 'hmac'), modulusLength?, namedCurve?, length? |
Generate cryptographic keys (JWK format) or secure random passwords. |
crypto_hash |
algorithm ('SHA-256' | 'SHA-384' | 'SHA-512' | 'SHA3-256' | 'SHA3-512'), data, encoding ('hex' | 'base64') |
Compute cryptographic hash digests. |
sign_verify |
action ('sign' | 'verify'), algorithm ('ECDSA' | 'RSA-PSS' | 'HMAC' | 'HMAC-SHA3'), data, signature?, password?, key_jwk? |
Sign or verify messages with ECDSA, RSA-PSS, or HMAC. |
pqc_kem_sign |
action ('generate_kyber_keypair' | 'kyber_encapsulate' | 'kyber_decapsulate' | 'hybrid_encapsulate' | 'hybrid_decapsulate' | 'generate_dilithium_keypair' | 'dilithium_sign' | 'dilithium_verify'), level?, public_key_b64?, private_key_b64?, ... |
Post-quantum Kyber KEM, Dilithium signatures, and Hybrid KEM. |
3. Agent Permissions & Auto-Run Configuration
To allow WebCrypt MCP tools to run seamlessly without interactive confirmation:
- Add
"command(webcrypt-mcp)"or"command(npx webcrypt mcp)"to global agent permission grants.