GibberSAFE
Tiny MCP server with cryptography tools, sufficient to establish end-to-end encryption between LLM agents
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol server built with Express.js that provides cryptographic tools including key pair generation, shared secret derivation, and message encryption/decryption.
Now available at: http://104.248.174.57/sse
Powered by [Stanford Javascript Crypto Library (SJCL)](https://www.npmjs.com/package/sjcl)
What is MCP?
The Model Context Protocol (MCP) is an open standard that defines how AI models and tools communicate. It enables seamless interoperability between language models and external capabilities, allowing AI systems to use tools more effectively. MCP standardizes the way models request information and actions, making it easier to build complex AI applications with multiple components.
Features
- Generate SJCL P-256 key pairs
- Derive shared secrets for secure communication
- Encrypt messages using SJCL AES-CCM
- Decrypt encrypted messages
- Server-sent events (SSE) for real-time communication
Installation
# Clone the repository git clone https://github.com/anton10xr/gibber-mcp cd mcp-server # Install dependencies npm install
Environment Variables
The server uses the following environment variables:
PORT: The port on which the server will run (default: 3006)
Development
# Start the development server npm run dev
Production
# Build the project npm run build # Start the production server npm start
API Endpoints
GET /sse: Connect to the server using server-sent eventsPOST /messages/:id: Send messages to a specific connection
Tools
The server provides the following cryptographic tools:
- generateKeyPair: Generate a new SJCL P-256 key pair (without exposing the private key)
- deriveSharedSecret: Derive a shared secret from private and public keys for secure communication
- encrypt: Encrypt messages using SJCL AES-CCM encryption with the derived shared secret
- **de
cbe58451bd0bOBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mcp-multiply-server -- npx -y [email protected]
{
"mcpServers": {
"mcp-multiply-server": {
"command": "npx",
"args": [
"-y",
"[email protected]"
]
}
}
}Exposed tools (4)
4 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
decrypt | read | Decrypt a message using SJCL AES-CCM with just IV and ciphertext |
deriveSharedSecret | read | Derive a shared secret. Call this only once, when you have TWO input strings: user |
encrypt | read | Encrypt a message using SJCL AES-CCM and return only the IV and ciphertext |
generateKeyPair | read | Generate a new SJCL P-256 key pair (don |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (4)
sse
**Now available at: http://104.248.174.57/sse**
@modelcontextprotocol/sdk, cors, elliptic, express, sjcl, sjcl-es, tweetnacl, zod
Gates applied: no_behavioural_pass, no_license.
cbe58451bd0bfull audit observations/trust-audit/mcp-server/antonpk1__gibber-1.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | cbe58451bd0b | SAFE | B | 89 | first audit |
Questions
What is the Gibber MCP server?
Tiny MCP server with cryptography tools, sufficient to establish end-to-end encryption between LLM agents
What tools does Gibber expose?
4 in total: 4 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Gibber safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Gibber need?
No credential environment variables were found in its source, so it appears to need none.
How does Gibber run?
It speaks sse, so it runs as a service you connect to over the network. It is published on npm as mcp-multiply-server at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (cbe58451bd0b), read on 2026-10-06. The repository is watched and re-audited when it changes.