webcryptCAUTION
Zero-dependency Web Crypto suite & Model Context Protocol (MCP) server for AES-256-GCM, RSA-4096, and AI agent security.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Zero-dependency Web Crypto & native AI Agent Tooling (MCP) for modern JavaScript.
[](https://www.npmjs.com/package/webcrypt) [](https://www.npmjs.com/package/webcrypt) [](https://nodejs.org) [](https://www.typescriptlang.org) [](https://modelcontextprotocol.io) [](./_tests_) [](./coverage) [](https://putervision.com) [](LICENSE)
AES-256-GCM symmetric encryption, RSA-4096 hybrid public keys, ECDH key agreement, ECDSA/HMAC digital signatures, and Post-Quantum KEM (Kyber/Dilithium) — zero runtime dependencies, pure Web Crypto API.
⚡ Quickstart (15 Seconds)
1. Installation
# 📦 Install as project library (Node.js, TypeScript, Browser) npm install webcrypt # 🌐 Install globally (CLI utilities & global MCP tools) npm install -g webcrypt
import { WebCrypt, WebCryptAsym } from "webcrypt";
// 🔒 Symmetric AES-256-GCM (600k PBKDF2 iterations)
const wc = new WebCrypt();
const encrypted = await wc.encryptText("Secret payload", "password");
const decrypted = await wc.decryptText(encrypted, "password");
// 🔑 Asymmetric RSA-4096 Hybrid Encryption
const wca = new WebCryptAsym();
const keyPair = await wca.generateKeyPair(4096);
const cipher = await wca.encryptText("Secret payload", keyPair.publicKey);
const plain = await wca.dec9894adaef77OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add webcrypt -- npx -y [email protected]
Exposed tools (6)
3 read · 3 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
crypto_hash | read | Compute cryptographic hashes (SHA-256, SHA-384, SHA-512, SHA3-256, SHA3-384, SHA3-512). |
decrypt_payload | read | Decrypt ciphertext produced by WebCrypt back into plaintext or JSON object. |
encrypt_payload | read | Encrypt text, JSON objects, or files using AES-256-GCM symmetric or RSA-4096 hybrid asymmetric encryption. |
manage_keys | write | Generate, export, or import cryptographic keypairs (RSA-4096/2048, ECDH P-256/P-384, HMAC). |
pqc_kem_sign | write | Post-Quantum Cryptography operations (Kyber KEM, Dilithium signatures, and Hybrid classical+PQC KEM). |
sign_verify | write | Create or verify digital signatures and HMAC authentication tags (ECDSA, RSA-PSS, HMAC, HMAC-SHA3). |
Trust audit
CAUTIONgrade C · trust 78/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- none-observed
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (13)
console.log(`Generated 32-byte secure key/password:\n${pass}`);const PASSWORD = "my-super-secret-password-2025";
const password = "my-argon2-test-password";
password: "super-secure-password",
password: "super-secure-password",
.windsurfrules
join(__dirname, "../../../../src/mcp/server.js"),
join(__dirname, "../../../src/mcp/server.js"),
const binary = atob(padded);
const signatureBuffer = Uint8Array.from(atob(hmac), c => c.charCodeAt(0));
const bytes = Uint8Array.from(atob(padded), c => c.charCodeAt(0));
return Uint8Array.from(atob(padded), c => c.charCodeAt(0));
jest, prettier, tsup, typescript
Gates applied: no_behavioural_pass.
c9894adaef77full audit observations/trust-audit/mcp-server/putervision__webcrypt.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | c9894adaef77 | CAUTION | C | 78 | first audit |
Questions
What is the webcrypt MCP server?
Zero-dependency Web Crypto suite & Model Context Protocol (MCP) server for AES-256-GCM, RSA-4096, and AI agent security.
What tools does webcrypt expose?
6 in total: 3 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is webcrypt safe to connect to an agent?
With care. The audit graded it C (78/100) and found 13 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does webcrypt need?
No credential environment variables were found in its source, so it appears to need none.
How does webcrypt run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as webcrypt at 1.0.1.
How current is this page?
The grade is for one exact copy of the source (c9894adaef77), read on 2026-10-12. The repository is watched and re-audited when it changes.